The white-label customer portal for MSPs running rConfig Vector.
rConfig Vector Prism gives every customer a branded, MFA-secured portal scoped to their own devices. Tags map to teams, teams map to customers. The whole thing runs on your infrastructure, not ours.
The front-office layer of rConfig Vector, the distributed NCM platform that already runs your network.
- Secure
- Multi-tenant
- On-Prem
- MFA mandatory
- Tag-scoped
What is a white-label MSP customer portal?
A white-label MSP customer portal is a branded web application that gives an MSP's end customers controlled access to their own data without exposing the MSP's internal tooling. rConfig Vector Prism is the version for network configuration management: tag-scoped, MFA mandatory, on-premise, fully brandable per customer.
Your customers want to see their configs. You don't want to give them Vector logins.
Three options have been on the table for years, and none of them are good. You can share Vector logins with your customers. You can spend three quarters of an engineer's time building an in-house portal. Or you can email PDF reports and pretend the request never came up.
Each option fails for a different reason. Shared logins blow up the moment your auditor sees the access list. One customer can enumerate every other customer's estate. A custom portal is a project, not a feature; it ages, it accumulates tickets, and the engineer who built it leaves. PDF reports age in five minutes and tell the customer nothing they can act on.
The information your customers want already exists. Tags on devices in Vector are already the multi-tenancy boundary. Every MSP we've worked with already tags devices by customer for billing and routing. Prism turns that existing structure into a customer-facing experience without you writing a single line of portal code.
As of April 2026: SolarWinds, Cisco Prime, ManageEngine, BackBox, Oxidized, RANCID. None of them ship a white-label, tag-scoped, MFA-mandatory customer-facing portal. MSPs running those tools have to build it themselves or buy a generic SaaS portal builder and bolt it on. Prism is the first NCM-native portal designed from the outset to be the layer your customers actually log in to.
Verified across SolarWinds, Cisco Prime, ManageEngine, BackBox, Oxidized, RANCID product pages, April 2026.
Six decisions that turn tags into a customer-facing portal.
Prism is opinionated where it matters: scope, MFA, brand, and audit. Everything else stays out of your way.
- 01
Tag-based multi-tenancy
Customers see only devices whose tags are mapped to their account. Empty mapping returns an empty result, never the full estate. The scope is double-checked on every request, server-side, before anything renders.
- 02
Mandatory MFA
TOTP enrolment is enforced at the route layer. No opt-out, no “we’ll do it later”. Every login, every account. Recovery codes issue on first login; admins can reset 2FA on demand.
- 03
Full white-label branding
Your logo, your colours, your favicon, your domain, your support links, your footer. Optional per-customer branding overrides for MSPs serving multiple end-clients with their own brands.
- 04
On-premise, no phone-home
One binary, one database, one nginx vhost. Runs alongside Vector on your own infrastructure. Zero telemetry, zero outbound calls, zero dependency on a third-party SaaS.
- 05
Read-only by design
Prism never writes back to Vector. End customers can view, diff, search, and download their configurations. They cannot change anything. There is no API surface that mutates source data.
- 06
Audit-ready
Every login, mapping change, branding edit, and download is captured in a structured audit log. CSV export for QBRs, security reviews, and SOC 2 evidence trails.
Who actually runs Prism, and what they ask of it.
Six scenarios pulled from MSP and telco product teams already evaluating Prism. Pick the one that sounds most like your quarter.
- Use case 01
“I run an MSP with 40 customers and they all want a portal.”
One Prism instance, 40 teams, 40 mapped tag sets. Provisioning a customer is a form, not a project. Done in an afternoon. The engineer who used to dread these requests now closes them in tickets.
- Use case 02
“We white-label everything we sell.”
Per-customer branding overrides the instance brand. Each tenant sees their own logo, colours, and domain, and they never see anyone else’s. The instance brand is your fallback for customers who don’t need their own.
- Use case 03
“Our auditors require scoped access proof.”
The audit log shows exactly who saw which device and when, with IP and user agent. Tag-scope authorisation is double-checked on every request, and the check is itself logged for SOC 2 evidence.
- Use case 04
“We want a paid tier for premium customers.”
Prism sits behind your billing. Provision a portal as a value-add SKU, an upsell, or a paid tier. Mapping a customer to a portal is one toggle and a tag set on the back end.
- Use case 05
“I don’t want my customers to know they’re using rConfig.”
They won’t. The branding is yours, the domain is yours, the experience is yours. Toggle the “powered by rConfig” footer off if your tier permits. The HTML, the favicon, the email templates: all carry your name.
- Use case 06
“Compliance team wants MFA on every external user.”
Built in. TOTP enrolment is mandatory at first login, recovery codes are issued, and admins can reset 2FA on demand. There is no global setting to disable MFA, by design.
How a customer request flows through Prism, and why nothing leaks.
Prism sits in front of Vector. Every request is authenticated, tag-scoped, and read-only by the time it reaches the source of truth. No part of this diagram leaves the MSP's perimeter.
- Layer 1End customerBrowser, MSP-branded
- Layer 2rConfig Vector PrismLaravel 13 · Vue 3 · On the MSP's box
- Layer 3rConfig VectorThe MSP's existing NCM control plane
- Layer 4Vector AgentDistributed collectors at customer sites
- Layer 5DevicesThe customer's actual network kit
- 01
Customer logs in to the MSP's branded portal
Custom domain, MSP logo, MSP colours. The user-agent never sees rConfig in the URL or the chrome unless the MSP wants them to. TOTP MFA is enforced before the session is established.
- 02
Prism resolves the customer's team and tag scope
Each customer is one team. Every team has an explicit set of tags mapped to it. Empty mapping resolves to an empty result, never to the full estate.
- 03
Read-only API call to Vector, tag-filtered
Prism uses a single service-account API token to call Vector. The tag filter is applied at the request layer and double-checked on every response before anything renders.
- 04
Customer sees only their devices
Configurations, diffs, and downloads are all scoped. The customer cannot enumerate other tenants, cannot see device counts that aren't theirs, and cannot mutate anything in Vector.
What it looks like running in production.
Prism is boring on purpose. systemd starts it, FPM serves it, the queue worker hums in the background. Every request is tag-scoped and MFA-gated before it ever reaches Vector.
Runtime characteristics
Reference deployment: 4 vCPU / 8 GB Linux VM, MariaDB, Redis-backed Laravel queues, 2 default workers, 100 customers provisioned, 50 concurrent end-customer sessions sustained. Page-load and MFA targets are pre-GA; the rest are measured.
- Cold-start memory
- ~80 MB
- PHP-FPM idle, queue worker started
- Steady-state memory
- ~180 MB
- 50 concurrent customer users
- Page load p95
- < 800 ms
- device list, 100-row tag scope
- MFA challenge p95
- < 300 ms
- TOTP verify, single round trip
- Database
- ~20 MB
- MariaDB, single schema, 100 customers
- Queue workers
- 2
- Laravel queues on Redis, default
No other NCM vendor ships a white-label customer portal. Prism is the first.
As of April 2026
The other patterns on this page have all run in production MSPs for years, but every one of them is a workaround. Prism is the only purpose-built, vendor-maintained, on-premise customer portal in the network configuration management market today. That is not a marketing line; we have looked.
Verified across SolarWinds, Cisco Prime, ManageEngine, BackBox, Oxidized, RANCID product pages, April 2026.
As of April 2026: SolarWinds, Cisco Prime, ManageEngine, BackBox, Oxidized, RANCID. None of them ship a white-label, tag-scoped, MFA-mandatory customer-facing portal. MSPs running those tools have to build it themselves or buy a generic SaaS portal builder and bolt it on. Prism is the first NCM-native portal designed from the outset to be the layer your customers actually log in to.
| Capability | Vector Prism | Shared Vector logins | Custom in-house portal | PDF reports | Generic SaaS portal builder |
|---|---|---|---|---|---|
| True multi-tenant isolation | yessupported | nonot supported | partialpartially supported | nonot supported | partialpartially supported |
| White-label brand · logo + domain + colours | yessupported | nonot supported | partialpartially supported | nonot supported | partialpartially supported |
| MFA mandatory, no opt-out | yessupported | yessupported | partialpartially supported | nonot supported | partialpartially supported |
| On-premise · no SaaS dependency | yessupported | yessupported | partialpartially supported | yessupported | nonot supported |
| Read-only by design | yessupported | nonot supported | partialpartially supported | yessupported | partialpartially supported |
| Tag-based scope · no engineering required | yessupported | nonot supported | nonot supported | nonot supported | nonot supported |
| Audit log out of the box | yessupported | partialpartially supported | partialpartially supported | nonot supported | partialpartially supported |
| Maintained by vendor, not you | yessupported | yessupported | nonot supported | n/a | yessupported |
| Time to first customer onboarded | ~1 day | minutes | 1–2 quarters | minutes | weeks |
| Cost predictability | fixed | fixed | open ended | low | per-seat |
If you have two customers and a relaxed security posture, sharing logins is fine. If you have ten customers, an audit team, or a brand worth protecting, you need Prism. Right now, in this market, Prism is the only product purpose-built for the job.
From clone to first customer in three steps.
Expand any step to see the exact commands.
The third leg of the rConfig MSP stack.
- Back office
rConfig Vector
The NCM control plane. Schedules, diffs, compliance, change alerts, RBAC, and the API surface that everything else talks to.
- Data plane
rConfig Vector Agent
Distributed Go collectors at customer sites. Pulls jobs from Vector, talks to local devices over SSH, SNMP, HTTP, ships results back over outbound TLS.
- Front office
rConfig Vector Prism
The branded customer portal. Tag-scoped, MFA-secured, white-label: the layer your customers actually log in to.
Prism does not replace anything in your stack. It completes it. rConfig Vector already runs your network. The rConfig Vector Agent already reaches every customer site. Prism turns the data those two already produce into a portal your customers can log in to, under your brand, on your domain.
Need help sizing a deployment, mapping the first dozen customers, or planning brand overrides for an MSP with mixed tiers? The deployment services team does this every week. Or skip the meeting and start with a demo.
Built on Laravel 13. MFA implementation follows the OWASP Multifactor Authentication Cheat Sheet.
Maintained by the rConfig engineering team. Last updated: .
Frequently asked questions
Give every customer their own branded portal, without rebuilding your stack.
rConfig Vector Prism is the white-label front office for MSPs already running rConfig Vector. Tag-scoped, MFA-mandatory, on-premise. Installed in an afternoon, branded in a morning.