✨ AI
Sign inBook a demo

MSP · Telco · Multi-tenant

Network configuration management built for MSPs

Back up, audit and roll back configuration across every customer site from one multi-tenant, self-hosted platform. It works alongside the network monitoring you already run.

Book a demoSee the architectureTry the live MSP demo
  • Self-hosted
  • Outbound TLS by default
  • Optional bidirectional mode
  • Customer portal
  • Tenant-isolated
  • Unlimited collectors
Vector Agents at remote sites reporting to one Vector ServerVector Agents at sites in Paris, Dublin and New York each collect from a local fleet of devices over SSH, and connect outbound over TLS to a single central Vector Server. The Dublin agent also runs the optional bidirectional mode, shown with arrows both ways, and acts as a proxy: an amber dotted path runs from the server through that agent to the devices behind it. A dashed node marks further sites.Vector ServerTenants · policies · jobs · auditPARISVector Agent10.42.0.0/16Local devicesSSHDUBLINVector AgentBidirectionalLocal devicesSSHNEW YORKVector Agent10.10.0.0/16Local devicesSSH+N sitesSame agent,same outbound linkOutbound TLS by defaultAgents connect out over TLS. Bidirectional connectivity is optional.Optional proxy from the server to end devicesVector Agents at remote sites reporting to one Vector ServerVector Agents at sites in Paris, Dublin and New York each collect from a local fleet of devices over SSH, and connect outbound over TLS to a single central Vector Server. The Dublin agent also runs the optional bidirectional mode, shown with arrows both ways, and acts as a proxy: an amber dotted path runs from the server through that agent to the devices behind it. A dashed node marks further sites.Vector ServerTenants · policies · jobs · auditOutbound TLS by defaultPARIS · 10.42.0.0/16Vector AgentOutbound onlySSHDUBLIN · 10.77.0.0/16Vector AgentBidirectionalSSHNEW YORK · 10.10.0.0/16Vector AgentOutbound onlySSH+N sitesDotted amber: optional proxy to end devices.
View full size
Meet the Vector Agent
TRUSTED WORLDWIDE
  • ESPN
  • Motorola
  • Uniti
  • Eurobank
  • Police Scotland
  • Chr. Hansen
  • University of Nebraska
  • JCDecaux
  • CVS Health
  • C Spire
  • Siemens
  • University of Florida
  • Singtel
  • Ole Miss
  • JYSK
  • EDF
  • Council of Europe
  • US House of Representatives
  • Caesars
  • Orange
  • Carhartt
The problem

Too many customer devices to back up

An MSP network can have a lot of devices across dozens of customer sites. One network configuration management tool cannot back them all up, because each customer connects in a different way and has its own security rules. So you add more tools, and each one works in a different way.

  • Backups crawl across the WAN

    Every site needs its own firewall exception back to the core, and the fallback is a full server per customer with its own patching, licensing and inventory.

  • Control is scattered across boxes

    Schedules live on one box, credentials on another, and a customer question about what changed last Tuesday turns into a tour of every site's tooling. Standards drift because there is no single place to set them.

  • One flat inventory is an audit risk

    A single flat inventory means one engineer can see every customer, and a mistaken filter shows one customer another's devices. Most MSPs answer by never giving customers access, then fielding the same report requests every month.

How it works

One Vector Server in the middle, and a collector at every site

Vector keeps control in one place, so you manage every customer from there. The work of backing up and checking devices runs right next to them, so it does not have to travel across the wide network.

  1. Vector Server

    One place and one API to manage your customers, policies, jobs and compliance. Inventory, history and audit trails live here.

    The Vector ServerThe Vector Server has one UI and API, and it holds tenants, policies, jobs, compliance, inventory, history and audit trails.Vector ServerOne UI and APIWHAT IT HOLDSTenantsPoliciesJobsComplianceInventoryHistoryAudit trailsThe Vector ServerThe Vector Server has one UI and API, and it holds tenants, policies, jobs, compliance, inventory, history and audit trails.Vector ServerOne UI and APIWHAT IT HOLDSTenantsPoliciesJobsComplianceInventoryHistoryAudit trails
    View full size

  2. Vector Agent collectors

    Small engines you place at each customer, in each region or in each network zone. They run backups, fetch configs, run commands and check policies close to the devices. Add as many as you need. Meet the rConfig Vector Agent.

    Vector Agent collectors connecting out to the Vector ServerThree Vector Agent collectors, one for a customer, one for another customer and one for a network zone, each connect out over TLS to the single Vector Server. Each can be scaled out.Vector ServerCUSTOMER AVector AgentAt each siteCUSTOMER BVector AgentAt each siteNETWORK ZONEVector AgentAt each siteOutbound TLS by defaultOne agent for each customer, region or network zone.Vector Agent collectors connecting out to the Vector ServerThree Vector Agent collectors, one for a customer, one for another customer and one for a network zone, each connect out over TLS to the single Vector Server. Each can be scaled out.Vector ServerOutbound TLS by defaultVector AgentCustomer AVector AgentCustomer BVector AgentNetwork zone
    View full size

  3. Devices and services

    Routers, switches, firewalls, CPEs, GPON/FTTH, DC networks, wireless, IoT and OT. All of them are backed up, checked and reported on in the same way.

    A Vector Agent reaching the devices at a siteA Vector Agent at a site reaches the devices behind it over SSH: routers, switches, firewalls, CPEs, GPON and FTTH, DC networks, wireless, IoT and OT.Vector AgentAt the siteSSHDEVICES AND SERVICESRoutersSwitchesFirewallsCPEsGPON/FTTHDC networksWirelessIoTOTA Vector Agent reaching the devices at a siteA Vector Agent at a site reaches the devices behind it over SSH: routers, switches, firewalls, CPEs, GPON and FTTH, DC networks, wireless, IoT and OT.Vector AgentAt the siteSSHDEVICES AND SERVICESRoutersSwitchesFirewallsCPEsGPON/FTTHDC networksWirelessIoTOT
    View full size

  4. How they connect

    The Vector Agent connects outbound only to the Vector Server, with no inbound firewall rules. For customers on VPN, MPLS or private WAN, the Vector Hub adds bidirectional mode for real-time backups, live interrogation and Vector Access.

    How a Vector Agent connects: outbound TLS by default, with an optional proxyBy default the Vector Agent at a customer site connects out over TLS through the customer firewall to the Vector Server. In the optional bidirectional mode the server can also reach the agent and use it as a proxy to the devices behind it, shown as an amber dotted path.Vector ServerOne UI and APIFirewallCUSTOMER SITEVector AgentAt the siteDevicesOutbound TLS by defaultOptional bidirectional mode:the server can reach the devicesthrough the agent, as a proxy.How a Vector Agent connects: outbound TLS by default, with an optional proxyBy default the Vector Agent at a customer site connects out over TLS through the customer firewall to the Vector Server. In the optional bidirectional mode the server can also reach the agent and use it as a proxy to the devices behind it, shown as an amber dotted path.Vector ServerOne UI and APIOutbound TLS by defaultFirewallCUSTOMER SITEVector AgentAt the siteDevicesOptional bidirectional mode: the servercan reach devices through the agent.
    View full size
View the full diagram
See the full architecture
Customer separation

Keeping customers apart, in layers

One screen for you, a private space for each customer

Vector keeps customers apart in layers, not behind one wall. Roles decide which customers each person on your team can see. A separate collector sits in each customer's network. Prism gives each customer a view of only their own devices.

Built for

  • Secure, with role-based access control (RBAC)
  • Unlimited scale, with a collector for each customer
  • Remote management of every customer from one console
One NOC console over three customers, with Prism for the customer's own viewA single NOC console reaches three customers, Customer A, B and C, each in a dashed space holding its own devices, jobs, policies and audit trail inside a Vector Server box, while a customer user reaches only Customer A's devices, through Vector Prism, the customer portal.NOC viewAll customers, one consoleVector ServerCUSTOMER ADevicesJobsPoliciesAudit trailCUSTOMER BDevicesJobsPoliciesAudit trailCUSTOMER CDevicesJobsPoliciesAudit trailVector PrismCustomer portalCustomer userSees Customer A onlyCustomers stay apart.Each one sees only their own devices.One NOC console over three customers, with Prism for the customer's own viewA single NOC console reaches three customers, Customer A, B and C, each in a dashed space holding its own devices, jobs, policies and audit trail inside a Vector Server box, while a customer user reaches only Customer A's devices, through Vector Prism, the customer portal.NOC viewAll customers, one consoleVector ServerCUSTOMER AOwn devicesJobsPoliciesAudit trailCUSTOMER BOwn devicesJobsPoliciesAudit trailCUSTOMER COwn devicesJobsPoliciesAudit trailVector PrismCustomer portalCustomer userSees Customer A onlyCustomers stay apart.Each one sees only their own devices.
Integrations / Your monitoring stack

Network monitoring for MSPs says it is down. Vector says why.

Two tools, two jobs

Vector works with the monitoring you already use. Monitoring tells you if something is up. Vector tells you what changed, who changed it, and how to put it back. Vector syncs inventory from the monitoring and inventory tools you already use, such as Zabbix, PRTG, Checkmk, AKIPS, Statseeker, NetBox, Nautobot and Infrahub. Vector also has a REST API and webhooks. So a change can open a ticket or send an alert where your team already works. Do you use Auvik? See how rConfig compares.

Who answers what

  • Is it up? Your monitoring tools
  • What changed? Vector compares every backup
  • Who changed it? Vector's audit trail
  • Can we roll back? Restore a known-good config
Monitoring and inventory tools feed Vector, which says what changed; Vault handles credentialsMonitoring and inventory tools such as Zabbix, PRTG, Checkmk, AKIPS, Statseeker, NetBox, Nautobot and Infrahub sit in one lane answering whether the network is up, with an inventory sync flowing into Vector, which answers what changed, who changed it and whether you can roll back. HashiCorp Vault sits in its own separate square, marked credentials management, with its own arrow into Vector.YOUR MONITORING STACKIs it up?AlertsUptimePerformanceZabbixPRTGCheckmkAKIPSStatseekerNetBoxNautobotInfrahubCREDENTIALSSecretsCredentials managementHashiCorp VaultKept apart from monitoringInventory syncCredentialsVECTORWhat changed, who changedit, can we roll back?What changedDiff between versionsWho changed itAudit trailCan we roll back?Restore a known-good configMonitoring and inventory tools feed Vector, which says what changed; Vault handles credentialsMonitoring and inventory tools such as Zabbix, PRTG, Checkmk, AKIPS, Statseeker, NetBox, Nautobot and Infrahub sit in one lane answering whether the network is up, with an inventory sync flowing into Vector, which answers what changed, who changed it and whether you can roll back. HashiCorp Vault sits in its own separate square, marked credentials management, with its own arrow into Vector.YOUR MONITORING STACKIs it up?AlertsUptimePerformanceZabbixPRTGCheckmkAKIPSStatseekerNetBoxNautobotInfrahubInventory syncVECTORWhat changed, who changed it,can we roll back?What changedDiff between versionsWho changed itAudit trailCan we roll back?Restore a known-good configCredentialsCREDENTIALSCredentials managementHashiCorp Vault
Onboarding

Your first customer in two weeks, the next in days

From install to your first backups

Your first customer usually goes from install to working backups in one to two weeks. Each new customer after that takes one to three days, once your set-up template is ready.

Onboarding timeline: one to two weeks for the first customer, one to three days afterThe first customer takes one to two weeks from installation to first successful backups, with install, credential vault and customer set-up design in week one and collector deployment, device import and policy and report configuration in week two; each repeat customer then takes one to three days.FIRST CUSTOMER: 1 TO 2 WEEKSFrom installation to first successful backupsWeek 1Week 2Vector ServerinstallCredential vaultsetupCustomer set-updesignCollectordeployment atthe customer siteDevice importPolicy and reportconfigurationREPEAT CUSTOMERS: 1 TO 3 DAYSEach further customer, one to three days1 to 3 daysSame day scale as the bar aboveDeploy a collectorfor the customerImport devicesAttach the globalpolicies alreadydefinedGrant scopedportal accessOnboarding timeline: one to two weeks for the first customer, one to three days afterThe first customer takes one to two weeks from installation to first successful backups, with install, credential vault and customer set-up design in week one and collector deployment, device import and policy and report configuration in week two; each repeat customer then takes one to three days.FIRST CUSTOMER: 1 TO 2 WEEKSFrom installation to firstsuccessful backupsWeek 1Week 2Vector ServerinstallCredential vaultsetupCustomer set-updesignCollectordeployment atthe customer siteDevice importPolicy and reportconfigurationREPEAT CUSTOMERS: 1 TO 3 DAYSEach further customer, one to three days1 to 3 daysSame day scale as the bar aboveDeploy a collectorfor the customerImport devicesAttach the globalpolicies alreadydefinedGrant scopedportal access
Compliance

Built for regulated estates

Evidence that stays in your perimeter

Vector is self-hosted, so the Vector Server and collectors run in your own environment and your configuration data stays inside your perimeter. Role-based access control (RBAC) decides who can see and change what. Audit trails and compliance reports support configuration auditing and compliance reporting, and help you evidence control for NIS2, DORA, ISO 27001, the UK Telecommunications (Security) Act, CISA guidance and other frameworks.

For auditors and customers

  • Self-hosted, with no SaaS dependency
  • Role-based access control (RBAC)
  • Audit trails and compliance reports
Vector's access control and audit evidence, mapped to the frameworks it helps you evidenceOn the left, what Vector provides: role-based access control, an audit trail, compliance reports and a self-hosted deployment. On the right, the frameworks that evidence helps with: NIS2, DORA and GDPR in the EU, the Telecommunications (Security) Act in the UK, CISA, NIST, HIPAA and SOX in the US, and ISO 27001, PCI DSS and CIS Controls worldwide. It supports audits and does not make a network compliant on its own.WHAT VECTOR GIVES YOURole-based access (RBAC)Least privilege, by roleAudit trailWho changed what, and whenCompliance reportsEvidence for your auditorsSelf-hostedData stays in your perimeterEvidenceFRAMEWORKS IT HELPS YOU EVIDENCEEUNIS2DORAGDPRUKTelecoms (Security) ActUSCISANISTHIPAASOXGlobalISO 27001PCI DSSCIS ControlsEvidence for audits.It does not make a network compliant on its own.Vector's access control and audit evidence, mapped to the frameworks it helps you evidenceOn the left, what Vector provides: role-based access control, an audit trail, compliance reports and a self-hosted deployment. On the right, the frameworks that evidence helps with: NIS2, DORA and GDPR in the EU, the Telecommunications (Security) Act in the UK, CISA, NIST, HIPAA and SOX in the US, and ISO 27001, PCI DSS and CIS Controls worldwide. It supports audits and does not make a network compliant on its own.WHAT VECTOR GIVES YOURole-based access (RBAC)Least privilege, by roleAudit trailWho changed what, and whenCompliance reportsEvidence for your auditorsSelf-hostedData stays in your perimeterEvidenceFRAMEWORKS IT HELPS YOU EVIDENCEEUNIS2DORAGDPRUKTelecoms (Security) ActUSCISANISTHIPAASOXGlobalISO 27001PCI DSSCIS ControlsEvidence for audits.It does not make a network compliant on its own.
The Vector Suite

The Vector Suite: back office, data plane, front office

Start small. Grow as big as you need.

Vector fits the way you work. Start with one server and a few agents. Add a server for each region, and a Central Manager for many countries. The rConfig reference architecture sets out the same design for estates of 100,000+ devices.

  • Network intelligence

    A normalised, searchable view of every customer's estate.

  • Governed change

    Approvals, maintenance windows and rollback for configuration changes.

  • Reporting

    Rollups and scheduled report delivery.

  • AI assistance

    Bring your own model, with your data staying in your perimeter.

  • Extensibility

    Connect Vector to your own tools, and build on top of it.

  • Policy and compliance

    Check every change against your policies and keep the evidence.

Further reading

Go further with the Vector Suite

rConfig Vector FAQ for MSPs

What is rConfig Vector and who is it for?

rConfig Vector is a distributed, multi-tenant network configuration management platform for MSPs, telcos and large enterprises that operate many networks across customers, regions or business units. It combines the full feature set of rConfig V8 Pro with a three-tier architecture that separates the central control plane from the collectors that run close to devices, so you get standardised backups, compliance and change control without losing per-tenant isolation.

How is rConfig Vector different from rConfig V8 Pro?

rConfig V8 Pro is a single-instance platform suited to one deployment for up to 1,000 devices, with automated backups, search, diff, rollback, compliance checks, RBAC and integrations. Vector takes that core feature set and adds a Vector Server with multiple tenants, distributed Vector collectors, tenant-by-tenant isolation, hierarchical RBAC and global policies that can be reused across customers and regions. Choose Vector when you run configuration management as a shared service across many environments.

Can rConfig Vector help us replace tools like Oxidized, RANCID, CatTools or homegrown scripts?

Yes. Many Vector deployments start as a consolidation project, replacing a mix of Oxidized, RANCID, Kiwi CatTools, Ansible and Python scripts. Instead of maintaining separate pipelines and cron jobs per customer, you get one inventory, policy engine and audit trail on the Vector Server across all environments, while jobs still run close to devices through the rConfig Vector Agent at each site. You can migrate in stages, moving customers or regions to Vector one at a time.

Is rConfig Vector suitable for NIS2, DORA, and other regulatory frameworks?

rConfig Vector is self-hosted and designed to support operators working under NIS2, DORA, ISO 27001, CIS and similar frameworks. It helps you demonstrate control over configuration, backups, change workflows and access. Because the Vector Server and collectors run in your own environment, you can align deployment with data residency and segmentation requirements, and per-tenant audit trails and compliance reports support questions from regulators, customers and internal risk teams.

How does Vector handle multi-tenant separation and access control?

Vector lets you define tenants that represent customers, regions or internal business units. Each tenant has its own devices, jobs, policies and audit history. Hierarchical RBAC lets your NOC and engineers see and manage multiple tenants, while customer administrators or limited support teams get scoped access to their own configuration backups, change history and compliance status, without seeing other customers.

What deployment options are available for rConfig Vector?

Vector is self-hosted. Run the Vector Server in your own data centre or private cloud, and place collectors in customer sites, regional data centres, POPs or network zones behind firewalls. Our team can help you design a deployment pattern, including HA patterns, and plan migration from your existing platforms, and we offer professional services for complex MSP and multi-region architectures.

How is rConfig Vector priced?

Vector is licensed per managed device with a base subscription that includes the Vector Server and an unlimited number of collectors. Pricing tiers are designed around MSP scale, so onboarding more customers needs device capacity, not additional infrastructure licences. See the pricing page, or contact our team for a quotation shaped to your customer count, device count and regions.

How long does it take to onboard the first MSP customer?

For a new Vector deployment, a first customer typically goes from installation to first successful tenant-isolated backups within one to two weeks. The first week covers Vector Server install, credential vault setup and tenant model design. The second week covers collector deployment at the customer site, device import, and policy and report configuration. Most MSPs settle into a one to three day onboarding pattern per new customer once their tenant template is stable.

Does Vector integrate with ITSM and PSA tools like ServiceNow, Jira, or HaloPSA?

Vector exposes a documented REST API that connects configuration events and inventory to ITSM platforms such as ServiceNow and Jira, and to PSA platforms commonly used by MSPs, including HaloPSA, Autotask and ConnectWise. Typical integrations create change tickets from configuration drift, attach diff output to change records, and post compliance breaches into customer-specific queues. For other platforms, webhooks and API tokens are designed to plug into iPaaS tools like n8n, Make or Workato.

What HA patterns does Vector support?

Vector supports HA deployment patterns for the Vector Server, and you can run multiple collectors per tenant or per region. Our team can review your topology and help you design a pattern that fits your RTO and RPO targets.

What are the Vector Hub and bidirectional mode?

By default, the Vector Agent connects outbound only to the Vector Server. That needs no inbound firewall rules and covers scheduled backups and configuration changes. For customers connected over VPN, MPLS or private WAN, the Vector Hub, a service that runs alongside the Vector Server, adds bidirectional mode. Bidirectional mode adds real-time backups, live interrogation of devices and Vector Access, which logs an engineer in to a device through the agent.

Standardise configuration management across every customer

rConfig Vector is the distributed control plane for MSPs, telcos and multi-region enterprises. Deploy collectors close to your devices, keep tenants cleanly isolated and run one consistent configuration management story across the whole estate.

Book a demoRead the docs