Multi-tenant backup for service providers
By Lucas Flores, IT Systeme Flores UG. Last updated
One Restow installation can serve many isolated tenants: an organization is a tenant, PostgreSQL row-level security keeps every tenant's data separated at the database level, and the Service Provider edition adds several tenants, delegated tenant administrators and a provider overview across all tenants on top of that isolation, so a provider runs backup for many clients from one console without one client ever seeing another's data.
How tenants get populated
For a Microsoft 365 tenant, users, mailboxes and OneDrives come in automatically through Entra ID directory sync, with the protected scope controlled per tenant: everyone, a specific group, or an exclusion list. IMAP-only tenants are added by a manual mailbox list or CSV import instead. Mail files are imported per tenant, by browser upload or from a server-side import folder with one subfolder per tenant (see mail import and export), and a server or client joins a tenant through the agent, with its own repository (see server and client backup).
Administrators, roles and lost access
Several administrators, each an owner, administrator, technician or read only, work in every edition, Community included. Limiting a member to chosen tenants is Service Provider. Owners invite and change members, every change is audited, and an owner can reset a member's access. Before a change of the public URL or of the operating mode would make passkeys unusable, the settings name the affected accounts and refuse a lockout of yourself. Under your account you can change your password and see and sign out your sessions.
Since 0.3.5 there is also a restore operator role per tenant. A restore operator sees and restores every backup of the tenant without administering it (jobs, storage, users). Creating a user or an invitation now always needs a role to be chosen; no role is preselected any more.
If someone loses access, the login page offers "Lost access?": a reset
link by mail when notification mail is set up (the second factor
stays in place), and always the way back through an owner or through
restow admin recover.
Running it for clients
Since 0.4.0, the Service Provider edition has "All tenants" in Jobs: the Jobs of Mail & SaaS and of Servers & clients list every tenant with its jobs per kind, what runs and waits, how the newest backups ended and the next run, with filters and sorting, and a row opens that tenant's jobs read-only. The settings that agents follow can be set per tenant on the tenant page, under Agents (the agent policy, beneath the installation's policy, with the backup job as a third level), and a tenant's notification recipients are columns of the notification matrix. Restore operators of a tenant can browse and download files of machines and Proxmox VE guests and restore files onto a machine, without administering the tenant.
Since 0.4.7 the owner of the installation can enter a monthly price per mailbox and per GB or TB of stored backups under Installation › Prices, and the overview of each tenant shows provider admins a card "Price per month" with what the tenant comes to at these prices, plus a link to the prices. It is an estimate for you: Restow bills nothing and limits nothing, and tenant users never see the prices.
Delegated tenant administrators ship: each tenant has its own administrators, invited by the provider or by a tenant administrator, who see and manage only their tenant. Members of the provider team can be limited to chosen tenants with Service Provider, and a Provider Admin can act across tenants when needed, always as logged impersonation. For the overview, the Overview page of Service Provider shows every tenant in one matrix: status, KPIs, stale backups, failures, storage problems and alerts. Business and above also send per-tenant scheduled summary reports by e-mail (daily, weekly, monthly or cron), and alert rules per tenant exist in every edition. A REST API with per-tenant API keys and scopes (plus, in the Service Provider edition, a provider-wide key for cross-tenant queries) lets an RMM, PSA or ticketing system pull backup/restore/verify status, jobs, storage, archive evidence and a clean per-tenant user/mailbox directory for billing, instead of someone checking a dashboard by hand. White-labelling for the Service Provider edition is planned, not available yet. See the roadmap.
The Service Provider edition at a glance, with the cost per mailbox for an MSP and an example margin, is on multi-tenant Microsoft 365 backup for MSPs.
Frequently asked
Can one Restow installation serve multiple clients?
Yes, under the Service Provider edition. Business is licensed for one organization; managing several tenants is part of Service Provider, which adds any number of tenants (your own customers), a provider overview across all tenants (tenant reporting) and a cross-tenant REST API with provider keys. There is no mailbox limit in any edition.
Can the Community edition have several administrators?
Yes. Several administrators with roles (owner, administrator, technician or read only) are in every edition, Community included. Limiting a member to chosen tenants stays part of Service Provider, which is also the edition that manages several tenants.
Can someone restore backups without being able to change jobs, storage or users?
Yes, since 0.3.5. There is a restore operator role per tenant: it sees and restores every backup of the tenant without administering it (jobs, storage, users). When you create a user or an invitation you now always choose the role; none is preselected.
Can a provider see the jobs of all tenants in one place?
Yes, with Service Provider, since 0.4.0. Under "All tenants", the Jobs of Mail & SaaS and of Servers & clients list every tenant with its jobs per kind, what runs and what waits, how the newest backups ended and the next run, with filters and sorting. A row opens that tenant's jobs read-only.
Does Restow bill my customers or show what a tenant costs?
Restow bills nothing and limits nothing. Since 0.4.7 the owner of the installation can enter a monthly price per mailbox and per GB or TB of stored backups under Installation › Prices (in EUR, CHF, USD or GBP), and each tenant's overview then shows provider admins a card "Price per month" with what the tenant comes to at these prices, one line for the mailboxes and one for the storage. It is an overview for you, not an invoice: tenant users never see the prices, mailboxes are counted as in the mailbox usage, and storage is the tenant's stored backups, deduplicated and compressed.
What if an administrator loses access?
The login page offers "Lost access?": a reset link by mail when notification mail is set up, with the second factor staying in place, and always the way back through an owner or the command restow admin recover. Owners can also reset a member's access.
Is tenant data actually isolated, or just filtered in the interface?
Isolation is enforced by PostgreSQL row-level security at the database level, per tenant, not only by the application hiding rows in the UI. Encryption keys are also separate per organization, which limits the impact of a bug in the application layer rather than making cross-tenant exposure structurally impossible.
How do provider technicians restore data for a client without direct database access?
Through delegated administration: each tenant has its own administrators who see and manage only that tenant, and members of the provider team have roles in every edition, with Service Provider letting you limit a member to chosen tenants. A Provider Admin can act on a tenant's behalf, and every such action is impersonation, written to the tamper-evident, hash-chained audit log (who, when, for whom, from which IP; the viewer for that log ships in Business and Service Provider, including export as CSV and JSON since 0.3.1), the same rule that applies to any other restore on someone else's behalf.