You run compliance for other companies. A mandate owns those client organizations and gives your team one way into all of them: one portfolio to see where each client stands, one queue of what they need, and your own brand in front of every one. Available from five licences.
A mandate sits above the organizations you run and changes nothing about how each one works inside. You get the view across them, and the client keeps its own workspace.
Create a client organization from the mandate, or attach one that already exists and keeps everything it has. Each client takes a licence, and the mandate never absorbs the client: controls, evidence, policies, people and audit log stay where they are.
Your staff are carried into each client in the role they hold on the mandate, so nobody collects a second set of credentials and nobody is handed more access in a client than they have with you
The portfolio shows each client’s coverage, the frameworks it has adopted, what is overdue and what falls due soon, so the weekly question of which client needs you is answered on one screen. The task queue is grouped by organization rather than flattened, because the answer you need is what this client needs, not what is most urgent anywhere.
The template transfer copies a setup you have already built into the client you are starting. It belongs to the mandate rather than to any client’s settings, and only the clients you administer are offered on either side of it.
Your logo and colours apply to every organization under the mandate, and your support address and help link replace ours inside them. Your client’s staff reach you rather than us, which is the arrangement you sold them.
Four choices behind how mandates work here — each one something you can check, not an adjective
Your staff are carried into every client organization in the role they hold on the mandate, whether that is owner, admin, member or auditor, so an auditor on your team reads a client and changes nothing. An employee is never carried in at all. There is no shared login and no second password list to keep.
The portfolio reads. Anything that changes a client happens inside that client, under that client’s own audit log, so a bulk push can never touch twenty tenants from a screen nobody audits. The client’s record stays the client’s record.
A client organization holds its own controls, evidence, people and audit log, isolated from every other client you run. Detaching one leaves it intact and standing on its own, which is what makes handing it back possible. A mandate that still has clients cannot be deleted.
You buy licences and attach a client to each one. Every licence is invoiced whether a client sits on it or not, so the number is yours to set, and lowering it takes effect at the end of the period rather than silently cutting a client off mid-month. Mandates start at five licences.
Hosted in Switzerland by default, in German and English, with on-premise possible. Every client’s data and evidence are exportable in full at any time, with no lock-in.
The portfolio reads what each client’s own modules hold: its coverage per framework, its open tasks, the reports it hands an auditor, and who holds which role
An account that owns the client organizations you run compliance for. Your consultancy, vCISO practice or MSP is the mandate; each client you look after is an organization under it, with its own controls, evidence and people. You work the portfolio from one portal instead of signing in and out of a dozen separate workspaces.
Five. A mandate is for running compliance as a practice, and below five clients the ordinary organization switcher already does the job without the portal, the portfolio or the whitelabel. Above it, buy a licence per client and attach the client to it.
Yours. Your logo and colours go in front of every organization under the mandate, and your support address and help link replace ours there, because the people in a whitelabelled client need somewhere to go and our own help content names devguard throughout. You are their first line of support, and the product says so.
Yes. Building a client once and repeating it is the job, so the transfer lives in the mandate rather than in any one client’s settings: pick the client you built, pick the client you are starting, and copy the setup across. Only clients you administer are offered on either side.
You detach it and it keeps everything. Its controls, evidence, policies, people and audit log stay with the organization, which carries on as an ordinary devguard tenant your former client can run alone or hand to someone else. Nothing is held hostage, and the licence it occupied frees up.
Swiss-hosted by default, in German and English, with on-premise possible. Each client’s data is exportable in full at any time, by you or by them, with no lock-in.
Attach the clients you already run, see where each one stands without signing in and out, copy a setup you built once into the next client, and put your own brand in front of all of them