Skip to content
Plugboard docs

What managed hosting is

Managed hosting means we run your deployment. Not a slice of a shared system: one stack per customer, with its own containers, its own PostgreSQL database, its own secrets and its own backups.

Isolation is physical rather than a policy. The answer to “is our data segregated from other schools” is “you have your own database, and here is its backup”, rather than an explanation of row-level security.

What that gets you

Section titled “What that gets you”

Your own database. Not a schema, not a set of rows with a tenant column in somebody else’s table. A database.

Your own upgrade moment. One school can sit on the previous release while another takes the new one. Nothing forces every customer through the same change on the same night.

A named region. Chosen during the sale, recorded on your deployment, and shown back to you during onboarding to confirm. Backups replicate within that region and nowhere else. See regions and data residency.

Backups taken and tested. Including a restore drill, which is the part in-house regimes usually skip.

Certificates and renewal. Yours to name, ours to issue and keep current.

Updates on a ring schedule. Releases soak on our own instance and the public demo before they reach you, and you are told before anything that changes the database schema. See releases and update windows.

What is still yours

Section titled “What is still yours”

Being hosted does not make these somebody else’s problem.

The configuration. Modules, workflow, roles, connectors, email templates. This is your service desk and it is set up the way you run it.

Your identity provider. SSO and SCIM connect to your Entra or Google tenant. We cannot configure that from our side.

Connector credentials. You paste them in; we never see them in the clear. They are encrypted before they touch the database.

A connector agent, if you want private systems connected. Active Directory, a local SIS database, PaperCut and printers on SNMP live inside your network. A managed deployment reaches them through an agent you install. It dials out only, so there is no inbound firewall rule to ask for. See connector agents.

Deciding who has access. Roles and accounts are yours. So is vendor access, which you can switch off entirely.

How your deployment is put together

Section titled “How your deployment is put together”
              your users
                   |
            Cloudflare Tunnel        no inbound ports on the host
                   |
        +----------+----------+
        |   your stack        |     one compose project, per customer
        |   web · api · worker|
        |   PostgreSQL        |     your database, your volume
        +---------------------+
                   |
          the region you chose

Several customer stacks share a host at first, each with no published ports and its own tunnel for its own hostname. Hosts split as load grows. There is no Kubernetes, because at this scale it would add failure modes rather than remove them.

The control plane holds no customer content

Section titled “The control plane holds no customer content”

There is a vendor-side console for customers, licences, deployments, usage and billing. It is global, and it holds counts, versions and billing records only. No names, no records, no ticket content. See the control plane.

Your deployment reports count-only telemetry to it: technician accounts, managed devices, enabled modules, version. That is what the plan is measured against.

Licensing, and what happens if billing goes wrong

Section titled “Licensing, and what happens if billing goes wrong”

Entitlement lives in the signed licence your deployment already holds, not in the billing system. A school’s service desk keeps working through a billing outage, an expired card or a failed webhook.

Nothing in the billing path revokes anything. A failed payment starts a conversation. Revocation is a deliberate act, not an automatic consequence.

Contracts are annual and invoiced annually, with automatic collection off, because most schools pay by transfer against a purchase order. A hosted payment page is available for anyone who would rather use a card or direct debit.

Overage accrues on the licence and is trued up at renewal as a single line, rather than raising a small invoice every month that finance has to process against a fresh purchase order.

Getting your data out

Section titled “Getting your data out”

Any time, without asking. Admin, Backups exports a portable per-tenant copy. It is a normal feature, not a support request.

Next

Section titled “Next”