TenantFlex holds the configuration of your most sensitive integrations, so it is built for the security review it will get: strong sign-in, a log of every action, an export of that log, and the option to run it inside your own network.
TenantFlex supports MFA with authenticator apps (TOTP) and passkeys, as a second factor or as the sign-in itself, plus single-use recovery codes. Revealing a stored secret asks for a fresh factor.
Every sign-in, second factor and administrative change in a workspace, exportable for audits and kept for three years.
The audit trail for any date range as CSV or JSON, from the Security log or through an API key.
Signed CloudEvents pushed to any HTTPS endpoint in order and retried with backoff, with a Splunk HEC payload format and set-up notes for Microsoft Sentinel.
TenantFlex keeps the application configuration it reads from your tenants, the credentials it needs to connect, and the execution log of every job. Connection secrets, signing secrets and the provider payloads inside stored snapshots are encrypted at rest with versioned keys that can be rotated. Secret values are removed from snapshots before they are stored, and the API never returns a stored secret in a listing.
Every connection starts read-only. Write permission is asked for only on a destination tenant, and only when you migrate into it. The exact permissions are listed per provider.
The same product, two ways to run it.
Hosted and operated by TenantFlex. Connect your tenants and start discovery the same day, with upgrades and new provider support delivered continuously.
Generally availableThe same production release, deployed inside your own environment for customers who need data residency or regulator-mandated control. Application metadata, credentials and migration logs never leave your network.
Generally available
Get started We would rather answer it before the pilot than after. Tell us which provider you run and whether data residency applies.
team@tenantflex.com · www.tenantflex.com