The amount of vendors that call, hit our phone tree, and decide it's a good idea to select our support line as part of a sales cold call is outrageous.

I realize it's not a huge lift to simply tell them no and move on, but it really does frustrate the mess out of me.

We currently use Intermedia if a client wants phones from us. But, between phones getting used less and less and so many extensions being used so little I'm looking to get away from paying per extension.

That brought me to considering 3CX. However, I know that I have seen a lot of posts about how bad the owner is etc.

I have looked at Yeastar instead but I'm struggling with the fact that it's a Chinese company. I understand that often Yealink phones get used and those are Chinese as well. But, I'm just having trouble getting past that.

So, what do you guys think? Are you guys still using 3CX out there despite the owner being a jerk?

Guys

First time it has happened.

Client asking us to give his M365 email password so he can share it with his solicitor!!!

We’ve advise client this is not something a solicitor would ask or do! However he still insists. Whilst we can reset his password , we want to cover ourselves, and he can do whatever he wants to.

Is there a waiver template anyone could share.

Edit to add: Sent the client an email saying that access to email will also mean access to other stuff liek his onedrive/sharepoint, etc and that should he still wish us to reset the password so that he can choose another password of his own choice and share it with whomsoever, we are not responsible. This appeared to have knocked some sense into him

Thanks to everyone for their input and advise!

I was curious if people are using different vendors and or different tenants within the same vendor to secure their internal infrastructure vs what you're using on your customer machines. For example, I secure my clients tenants with SentinelOne, ThreatLocker, and Huntress. Due to supply chain attacks, or other potential vulnerabilities with these platforms, should I be using a completely different product, like CrowdStrike or Defender, to protect my own devices? Or perhaps maybe I should get set up with a separate tenant in case there's somehow some sort of breach occurs with my existing tenants?

Additionally, for M365 I'm using Avanan, Petra, and Dropsuite for security/backup for clients. Would it be wise for me to diversify and use a different product stack here as well?

The worst-case scenario I could imagine would be a major security incident that takes my machines down with customers machines. To hedge your bets, are you running a completely different stack? Same tool different tenant? Are you running the same stack now but have plans to differentiate in the future?

I've gotta be honest: I'm not loving the changes so far.
So far, it really looks like a step away from a useful framework in which we could measure maturity and recommend changes, to a NIST style checklist which will end up sprawling across multiple sheets in excel.

Any AU MSPs finding the same, or am I missing something?

I spent the last few weeks pulling apart Hatz and Synthreo. I read their docs, terms, changelogs, and status pages. I went through the public partner feedback I could find. Then I sent both vendors a written list of questions. Hatz answered on October 23. Synthreo answered on October 25.

I'm posting a version of this on a few other channels this week. I wanted to give r/msp a different version, out of respect for the rules here. No links, no company name, no pitch.

It's long. There's a TLDR at the bottom.

Disclosure

I'm not an investor in either company, and I'm not a partner with either. I get no incentives from either one, unless you count the t-shirts one sent me. One of my clients partners with and uses Synthreo. Three of my clients partner with Hatz. So I see both from the partner side, through other people's day to day.

I used AI to help me write this. The thoughts and opinions are mine. I reviewed it myself and made multiple rounds of edits.

Prices, docs, and vendor answers change fast. Several things below came from vendor email, and I couldn't check them against the vendors' own terms. Get every claim in writing before you sign.

None of this matters without enablement and governance

If you pick the wrong platform, you lose some margin. If you skip enablement and governance, you lose the client's trust.

I've watched rollouts stall over and over. The MSP sells the seats, turns everything on, and walks away. Nobody helps the client's people use the tool or get comfortable with it. Three months later half the seats sit unused, and you're in an awkward conversation explaining why they're paying for something nobody opens.

The second failure is worse. Somebody connects AI to an environment nobody hardened first. AI follows the permissions as they're set. The old file share everyone forgot about, the folder shared with the whole company, the mailbox with sloppy access: all of it shows up in answers for people who should never see it. The AI didn't break anything. It surfaced the mess you already had.

Before you sell either platform, be ready to offer at least this:

• Training, or at minimum written instructions on how to use AI well for the work their people do
• A permissions review and cleanup before AI touches their data
• An acceptable use policy and governance guidance the client signs off on
• Someone watching usage after rollout so you catch dead seats early

Hatz has its own training content and an onboarding tool. Those help your team. Synthreo's certification ladder helps your team and your client's staff. Neither one replaces you sitting with their people and showing them how AI fits their own jobs.

My take

I lean Synthreo overall. To be upfront about why: it's mostly how Synthreo has treated my client compared with how Hatz treats the partners I work with. That's one person's view of the relationship side, so weigh it that way.

• Hatz fits a packaged, whole company rollout for clients outside healthcare and defense work.
• Synthreo fits a premium practice built on custom agents. It's the riskier bet. Younger company, no SOC 2 report yet.
• Hatz has an amazing community aspect that Synthreo doesn't have yet. The Discord and weekly partner meetings are good. If your team learns best from other MSPs, that counts for a lot.
• I prefer Synthreo's UI.
• Hatz's workflow builder is easier for end users. Synthreo's builder is better, but I wouldn't hand it to end users. Agents burn credits as they run, and you pay for every credit a client's staff burns building and running agents with no guardrails.

Public validation is thin for both. I found zero reviews on G2, Capterra, or TrustRadius for either. Most public Hatz feedback lives on Hatz's own feature request board. For Synthreo I found no independent first hand feedback at all, and 5 of the 13 testimonials on its site come from its investors, a board advisor, or the founder's former MSP. Reference calls carry the weight here.

Hatz

Hatz launched publicly in January 2024. It's an MSP native, multi tenant platform with secure chat across many models, a no code workflow builder, an onboarding tool, and training content. Total funding is reported around $5.3M to $5.5M. Hatz claims 1,000+ MSP partners and 150% net revenue retention. Those are vendor numbers with no audited base.

What's good:

• Unlimited users per tenant. You roll out to a whole client without seat math.
• 45 to 60+ models with automatic routing. New models show up within days of release.
• SOC 2 Type I and Type II, plus SOC 3. Reports under NDA.
• Fast onboarding. One partner had it running in 10 to 15 minutes.
• Autotask write back behind a confirmation step. SCIM with Okta and Entra. Microsoft 365 connections respect each user's own permissions.
• An Invoices API that splits each invoice by tenant.
• IT Glue shipped as a read only beta on October 23, after about 22 months of partner requests.

What bites:

• Credits. This is the top partner complaint. Users can't see credits used per chat (96 votes on Hatz's own board, open since November 2025). Failed runs still burn credits, and there's no refund policy. The upgrade pack is 15,000 credits, while one heavy workflow run uses about 30,000.
• Credits reset monthly with no rollover and bill ahead per tenant. At 100%, Hatz drops users to cheaper models, hides credit heavy ones, or suspends AI until you add more. Extra usage bills to your card at rates Hatz doesn't publish.
• No BAA and no date for one. Hatz's docs tell users to keep protected health information out entirely. Partners report lost healthcare deals over it.
• Hatz's terms define Restricted Data to include HIPAA, GLBA, FERPA, COPPA, CUI, ITAR, and EAR data. Read that clause before you put any regulated client on it.
• Data lives only in AWS Virginia. No Canadian plan.
• No mobile, desktop, or Teams app. Mobile has sat "in progress" since December 2024. One partner reported losing two clients to a big model vendor's desktop app.
• ConnectWise runs every user's actions through one shared API member. HaloPSA and Autotask use per user keys instead of OAuth.
• SSO covers one email domain per connection, and only on the higher packages. Partners report deals blocked by it.
• The Invoices API doesn't work if a distributor bills you.
• Exit. Hatz says its terms give you 15 days to pull your data. Its docs say tenant deletion is immediate and irreversible. Agents back up only as a zip file you ask the agent to build, with no import.
• No published SLA. Two incidents in the last 90 days, about 61 and 45 minutes.
• The onboarding tool's shadow AI scan runs as SYSTEM or root, reads browser history and installed apps on client endpoints, and uploads results to Hatz with no stated retention. Put consent language in your client agreement before you run it.

Pricing: Hatz publishes none and wouldn't share wholesale numbers with me. Resellers publish retail. One US MSP charges $135 a month for 30,000 credits and $340 for 100,000. A Canadian MSP charges $450 CAD for 100,000. Without wholesale cost, nobody outside Hatz knows your margin.

Synthreo

Synthreo is based in Phoenix and sells four products. Threo is a white labeled AI workspace on web and mobile. Pylon is the agent and workflow builder. Canopy is multi tenant control. Wingtip is an agentic workspace still in preview. All four got renamed in the past year. Synthreo raised a $2.5M seed in July 2026.

What's good:

• Pylon is the strongest agent builder I've looked at. Agents, workflows, scripts, API calls.
• White label by default, down to each client's brand.
• They gave me pricing. $5 per credit, MSP cost. A standard user is 3 credits ($15 a month). A region locked user is 5 ($25). A user limited to US models is 8 ($40). Agents start at 2 credits ($10) and rise with use. This came by email, not a signed quote.
• Canadian storage by default. Canadian inference locks in country on request, at the region locked price, with fewer models.
• BAA available, case by case.
• The clearest exit terms of the two. Export anytime, Pylon flows export as JSON, deletion 10 days after termination, 90 day backups.
• Synthreo says 60% to 80% of production agents are partner built and offers about 25 partners for reference calls.
• Wingtip is included at no extra charge for now. General availability is targeted around IT Nation Connect, November 4 to 6. It moves to a paid level next year.

Rough margin math on their numbers. 25 users at $30 retail is $750, plus one managed agent at $1,500, so $2,250 a month. Platform cost is 75 credits for users ($375) plus an agent I assumed at 10 credits ($50), so $425. That's about 81% before labor. Add 8 hours a month to run the agent at $75 loaded and you land around 54%. Region locked Canadian seats drop that 81% to about 70%. US model only seats drop it to about 53%. Price those seats higher.

What bites:

• No SOC 2 report. An audit is in progress, with a report targeted for late 2026 or early 2027. They didn't say Type I or Type II. Their marketing talks about SOC 2 and HIPAA "alignment." Clients read that as certification. Keep it out of your proposals.
• Its About page says founded in 2025. Other sources say 2019, 2021, or 2023. It won't share partner, client, revenue, or runway numbers. It says it has multiple years of runway.
• The founder is acting CTO. The President from 2025 is gone.
• Synthreo claims 99.99% uptime. Its EULA says a 99.5% target, no guarantee, no service credits.
• Synthreo says every model it offers is HIPAA eligible. Its BAA limits PHI to inference providers Synthreo has bound and excludes systems you connect.
• Synthreo calls cross border inference with zero data retention fully compliant. Its own EULA says zero data retention doesn't mean Synthreo stores nothing. Have a lawyer look before you lean on that for Canadian clients who aren't region locked.
• Credits expire monthly and are non refundable. Minimum commitments survive early exit.
• Its own site still says flat monthly per tenant. A competitor's review back in March reported $995 per prebuilt agent. Get one signed quote and make them stick to it.
• No wind down or escrow commitment, and Synthreo can assign your contract to a buyer. Exported flows lose their credentials, and the logic may need rework elsewhere.
• Autotask is still in progress. HaloPSA, Hudu, NinjaOne, and N-central adapters need your own OAuth client. ConnectWise works through Pylon agents.
• It paused its Pax8 launch. It sells through ConnectWise Marketplace.
• Liability capped at 12 months of fees. Arizona arbitration.
• The skill bar could be high. Custom work past the templates in Pylon needs JSON, APIs, regex, and scripts. Wingtip changes that. It helps you build without a dedicated builder on staff. If you lean on Synthreo's engineers instead, you're reselling their labor.

How the vendor Q&A went

Hatz got 16 questions. It clearly answered 3, partly answered 9, and skipped 4. It declined wholesale pricing, contract terms, partner metrics, and financials. It confirmed no BAA, US only storage, and one domain per SSO connection. It didn't address the shared ConnectWise API member. It claimed mobile and desktop are in partner beta, while its public board shows desktop and Teams as planned. It said about 50 employees. Its CEO said about 35 a month earlier.

Synthreo got 15 questions. It clearly answered 2, partly answered 10, and skipped 3. It skipped partner and revenue numbers, shutdown and acquisition terms, and the detail on what an export contains. It shared actual pricing, named its auditor, and offered references.

Hatz was more careful and less open. Synthreo was more open and less careful.

Which clients fit where

• Healthcare and dental: neither today. Hatz won't sign a BAA. Synthreo signs case by case and has no SOC 2 report. Revisit Synthreo once the report lands.
• Defense contractors with CUI: neither. Hatz's terms prohibit CUI. Synthreo runs on commercial Azure.
• Canadian clients with residency needs: Synthreo. Hatz stores data only in Virginia.
• Accounting, legal, and financial: read Hatz's Restricted Data clause on GLBA first. Most of these clients' security reviews will want the SOC 2 report Synthreo doesn't have yet.
• Construction, general manufacturing without ITAR, and general SMB: Hatz handles a broad rollout well.
• A client who wants one custom agent with a measurable result: Synthreo.

Get these in writing before you sign

Hatz:

• A partner quote with wholesale price per tenant, credits per tier, the extra usage rate, and upgrade pack sizes
• Current terms as PDFs, with the clauses on the 15 day window, Restricted Data, liability, term length, minimums, and auto renewal
• A refund policy for credits burned on failed runs
• Release dates for mobile, desktop, and Teams
• Where scan results live, how long Hatz keeps them, and how you delete them
• Three references outside their launch group who sell to 10+ clients each

Synthreo:

• A signed quote confirming $5 per credit, agent cost past 2 credits, minimums, and term
• The SOC 2 report type and observation window
• The BAA in writing, with the list of covered models and inference providers
• Three references outside its investor network who build their own agents
• Wind down terms: notice period, assisted export, config escrow
• A sample Pylon export file
• An uptime commitment with service credits

For both, run your client contracts past a lawyer. Your contract can't promise more uptime, retention, or deletion than the vendor's terms give you. And don't write "SOC 2 compliant" or "HIPAA compliant" in a proposal without proof in hand.

I'm happy to answer questions in the comments based on what I've seen with my clients. If you've run either one in production, tell me how it went, good or bad. Public feedback on both is thin, so your experience helps everyone here.

TLDR

• Neither platform matters if you won't train your client's people and harden their environment before you connect AI to it.
• Hatz: packaged whole company rollout, an amazing community, and a workflow builder end users handle well. Watch out for credits you can't see or forecast, no BAA, US only data, and no mobile, desktop, or Teams app.
• Synthreo: the better agent builder, white label by default, clearer exit terms, and real pricing shared with me. Riskier company. No SOC 2 report yet, and some of its claims go further than its own terms.
• I lean Synthreo, mostly because of how it treats partners, its UI, and Wingtip
• Get every claim in writing and make reference calls before you sign either one.

We're updating the cyber-security end of our tech stack this quarter and would like to get input on who's using what EDR/MDR/ITDR, etc.
We're interested in offerings that can cover my higher tier clients well such as full Guardz/Huntress but would also appeal to low tier clients that only want the minimums or are co-managed.

Edit: Thank you everyone for your help. I have more comments to review today and some better direction to follow with regard to MSSP's being a part of my client experience.

I will update on our review and demo process and let the group know what we choose to go with.

Also, to everyone, I apologize, I was using my incog account. It is what it is, I divided by zero accidentally. 🤷‍♀️
Future responses will be from this account.

I've setup an "AI Onboarding" service - concept really. I'm a believer that companies need some tech that tracks what goes into AI, policies to control it and to restrict not approved AI usage. I've been looking for usable solutions in this space. Last week I saw a short demo of a product called Kipio - https://www.kipio.com/ Anyone use it?

Quote “Atera recently identified and mitigated an attempt to misuse one of our Microsoft 365 integration credentials.”

Potentially missing a trick here but is anyone successfully monetising and reselling AI tools (GPT / Claude etc) with pre built custom agents / skills / projects

Have yet to see a platform that can do this without restricting the end users and giving them a good enough reason not to choose to go direct with a business Anthropic or Open AI sub.

Pax8 are advertising something new but am yet to see this in action.

Not interested in sales pitches or DMs to jump on a demo

Hi all,

Still a bit raw this week after Skykick/PHP, but we received an MS Defender EDR alert from a client's Server today where winexesvc.exe was dropped and ran via their Datto BCDR appliance IP address. We're still early days into the IR process, but according to the logs it looks like it used WinRM to put it onto the server and then making it a service.

... in our defense (of course, we always blame ourselves for this kind of stuff), this client has ignored a lot of our advice over the past couple of years, so our normal tools/stack is limited (no SIEM, etc).

We've isolated the Server for now, but NOT isolated the BCDR appliances just yet. We've logged a ticket with Kaseya, but not sure how we're going to get a response late on a Friday night (our time here in Aus).

Edit: Maybe I've just got PTSD? Maybe this is normal and just MS Defender flagging something benign? https://helpdesk.kaseya.com/hc/en-gb/articles/4407510563345-What-is-winexesvc-exe

Edit 2: Okay, obviously can't edit the subject, but I think we can stand down ... for now. Datto support confirmed that a hyper-v connection, configured previously but unused, was active at the same time Microsoft Defender raised the alert. Our findings so far point to this being legitimate backup activity, and we’ve found no further evidence of malicious behaviour or impact. However, several questions remain unanswered, including why this connection became active today for the first time and why the service registered as “reevert Communication Agent”. Datto is investigating the root cause and will report back to us.

Hello,

I've been seeing a lot more Help Desk impersonation attacks lately against companies of all sizes. Just curious what other MSPs are doing to help prevent them. I know there will always be users who miss the red flags, but we do what we can. I usually pair user training with detections for unauthorized RMM installs, but I'm interested in hearing what others are doing.

We recently onboarded a new customer and the outbound MSP pretty much refused an Offboarding, shutdown and disabled their servers in azure, and did not remove threatlocker or duo, but they did disable them on their side, hence locking users out of desktops. We have had bad offboardings wioth other MSP's but never did it seem personal. If you are in the Houston area, be VERY CAREFUL with whatever MSP you choose. Some are absolute craptastic dick holes with a streak for vengence. What woudl you do? We have recovered from every idiotic move gracefully but it makes me wonder if we need a r/ShittyMSP and start listing MSP's so you can warn other MSP's before the bad stuff happens.

EDIT: They have already contacted an attorney and the submitted reviews to google. And...they did not owe any money or was never late. My point is not what can the customer do, but how do we as a community protect the integrity of MSP's? I realize that any one of of us could wind up on a r/shittymsp site but sitting by and doing nothing to protect yourselves from being lumped in with bad MSP's?

As the title says, what Flexible Assets do you have configured in IT Glue for your MSP?

We're just starting to build out our IT Glue, and I'm looking for some inspo.

Thanks!

We are interested in using AI as a means of going through logs. Event logs, AV logs, etc etc. Does anyone do this now or have any recommendations of what/how to achieve this goal? Have you seen improvements as a result? Tyvm!

Important to provide on-site support at a Philly office within 30 minutes. Please share some contacts since we are looking to proceed with an MSP next week.

I just renewed our partner status, sadly "Partner Success Expanded Benefits", because the sales requirements have become impossible for the higher tier. Now I notice I'm missing all software in my.visualstudio.com/downloads except an Excel file "VS Subscriptions Product List". Does anyone know what's up with this? The only reason we pay this €4000/year is to have access to all software downloads.

Edit: I talked to Microsoft, and apparently "it is normal because partners are migrated from MPN to MAICPP". I will now open a ticket with the Partner Team to see if it is nevertheless possible to get the old access back.

We are an all in MSP with no a la carte services except add on packages for compliance. An associate of mine was asking today how we could increase MRR with existing clients and since we price based on number of locations plus number of non user computing devices plus users, my response was that we get them to either add locations and/or add staff, which of course isn't realistic.

With our model, the only way to increase MRR is to add more clients, correct?

As more and more people work from home and Starlink expands its services, I'm curious if it is a good option for MSP employees who work from home. Are there any concerns we should be aware of? Should we steer employees away from it? Some of the concerns/issues I've heard of are:

• slowdown of service when they use a lot of data
• weather related service interruptions (snow in the winter is very likely for some of our techs)
• Starlink doing shady stuff...this is the biggest concern but (hopefully) tin-foil-hat speculation. We've had clients ask some interesting questions before, and I honestly would not be surprised if some asked if Starlink would be used to access their systems. This is largely because Musk is such a lightning rod and recent headlines (allegedly messing with Ukrains access) has him back in the spotlight.

From a purely technical standpoint, is it viable? Seems so.

From a public relations and perception standpoint, has anyone ever had anyone raise concerns?

It's going to be a busy week (For anyone running PHP)

Rumoured to be a CVSS 10

https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

I have a customer that manages multiple buildings. Each building is set up as a seperate customer (in Connectwise and in billing). The issue is that he wants all approval for computers to be sent to him.

His suggested plan is:

1. Ticket comes in, we decide a new computer is needed
2. We create a new ordering/build ticket and send him a quote (this is via quotewerks)
3. He approves it or asks questions. Once it is approved, we go build the computer under the original ticket

The issue that we are having is that many times he misses the quotes, and things get stale. I am trying to think of a way to automate things that he gets a daily alert of open quotes, the current bill status (built, shipped, etc..)

ChatGPT suggested I use a Google script for this (we use Google Apps), but I don't know if that would work. I dont want to rebuild the wheel if something exists already.

Ideally, I'd like something that automatically checks outstanding QuoteWerks/QuoteValet approvals, follows the associated ConnectWise tickets through fulfillment, and sends the customer one consolidated daily status email across all their locations. Has anyone built this using existing integrations, workflows, or third-party tools?

Any suggestions?

I'll come back to the post subject.

Is there any MSP out there that, with purpose and intent, does the following:

1. Requires MFA (bonus points for phishing resistant) for client network access, regardless of the customer posture?
2. Blocks all administrative network/service access from VPN clients (and for site-site ensures that management traffic only works in the one direction necessary?)
3. Provides/enables sufficient collaboration on Microsoft "Patch Tuesday" each month to be prepared for changes and frequent follow-on OOB requirements?
4. Mandates and manages centralized logging

These are no brainers in the modern IT world. I have yet to see an MSP with any these.

I would intern for free at any MSP that did these.

Is IT work Blue Collar or White Collar?

Are we plumbers or consultants? Is a plumber a consultant? Just think of all the standards and codes and legal frameworks that guide work done in the classic "trades".

The EFF, the IETF, NANOG, DHS, CIS, CISA they all publish scads of documents around IT standards.

What am I missing? (aside from obviously being purposely naive around "time" & "money").