Partners and distribution

Partner Area: linked ISPs and Master support

Manage brands, ISP requests, and secure Master support access to owned tenants.

Last updated: 2026-08-19

Master role

The Partner Area is intended for distributors that own one or more brands and manage linked ISPs. A Master sees only ISPs associated with its brands; this is never a global tenant list. Brand ownership, ISP state, and exact domain are verified server-side, so an ISP identifier supplied by the browser is never sufficient authorization.

Support access has elevated privileges. Before entering a tenant, confirm the target ISP, the reason for the intervention, and the applicable internal authorization.

Brand and domain setup

Configure at least one Master-owned brand with the correct identity and custom domain. The domain determines both ownership of the linked ISP and the destination used for support access. Verify DNS, HTTPS, login, password recovery, outbound sender, legal links, and brand presentation before onboarding customers.

Use a domain controlled by the organization and keep certificate and DNS renewal ownership explicit. A visually correct login page is not enough: authentication, e-mail delivery, return URLs, and tenant isolation must also be tested.

Prepare the Partner Area

The Partner Area has no separate global settings page: its effective preparation is provided by the Master account, eligible brands, domains, licence catalogue, module catalogue, registration declarations, document requirements, and the System account used for authorized assistance.

Before accepting real registrations, verify that at least one eligible brand exists, plans and module choices are current, mandatory company and administrator fields are known, required documents can be uploaded safely, and support access returns to the correct Master domain. When no eligible brand exists, new-ISP registration remains unavailable by design.

Request a new ISP: brand, licence, and modules

Open Partner Area → My ISPs → New ISP. Select the responsible brand, then choose the licence according to the expected customer volume. A free licence cannot add paid modules; a compatible paid licence allows the required modules to be selected and shows the estimated monthly total.

Select modules from the ISP’s real operating needs, including the integrations that will later have to be configured. The review separates licence, included modules, added modules, and total before submission.

Request a new ISP: company data and documents

Enter legal name or full name, VAT number where applicable, address, postal code, city, province, email, an internationally valid telephone number, certified email, and SDI code. A company-registration document can be attached as PDF, JPG, or PNG. Then enter the administrator or owner’s first name, surname, and tax code and attach the required identity document.

The final step requires all contractual, module-price, support-service, privacy appointment, and delegated-submission declarations. The system validates declarations and telephone number before sending. Submission creates a pending request, not an immediately operational tenant.

Pending requests, My ISPs, and details

The first section lists pending requests with company, email, brand, licence, status, and request date. Use it to avoid duplicates and to confirm that the selected brand and plan are correct while activation is being processed.

The active-ISP table shows ISP ID, brand and domain, company, licence, state, customer count, creation date, and available actions. Search by company or brand, then open Details rather than relying only on a name.

The detail page brings together legal identity, address, tax and electronic-invoicing information, contact, creation date, licence, state, brand, and active modules. Modules are separated between included and paid items, with the configured recurring price where applicable. Review this page before support access: a disabled ISP has no operational access button, and module visibility describes the active scope without activating additional products.

Support access

Access asks for confirmation and opens a new tab on the exact brand domain. The system creates a random, one-use ticket valid for 60 seconds and sends it through a POST form, keeping it out of the URL. The destination domain consumes the ticket atomically and opens the configured support account in the selected tenant.

The Master session remains open on the original domain. Cookies and the original session are not copied across domains. If the short-lived handoff fails, return to My ISPs and start a new authorized access instead of reusing old data.

Support banner and return

A persistent banner identifies the ISP currently being assisted throughout navigation. Check the displayed tenant before every action, especially when several partner records have similar names or brands.

Return to Master ends the assisted session on the brand domain and redirects to the original Partner Area, where the Master session remains available. Use this control instead of manually changing the URL, then verify that the tenant banner has disappeared before opening another ISP.

Permissions during assistance

The configured System account operates as a full administrator inside the impersonated tenant, but only for that ISP’s active modules. It cannot enable unlicensed modules, enter a disabled or unrelated ISP, or start nested impersonation.

Actions remain attributed to System, so sensitive work should be accompanied by the partner’s authorization and an appropriate change or support record. Assistance access must never be used to bypass the ISP’s internal approval process, retrieve unnecessary customer data, or perform unrelated administrative work.

SSO ticket protection

The support ticket is stored only as a SHA-256 hash, locked during consumption, marked as used, and bound to the Master, target ISP, brand domain, and return domain. Expired, reused, wrong-domain, and wrong-owner tickets are rejected.

Never copy tickets, intermediate URLs, cookies, or session data into chats, documentation, screenshots, or support cases. If entry fails, return through the Partner Area and create a fresh authorized support session rather than modifying the ticket URL.