Distribution
Pax8 integration
Reads your client list and each client's active subscriptions — what they already buy through you. Read-only.
Setup steps are for connected customers — sign in to read them.
What we find in Pax8
Every active subscription the MSP resells per client, classified into the same security/BDR/email-security/MFA categories a PSA agreement is — feeds the existing agreement_gap signal directly, so a client whose security SKU only exists in Pax8 (never logged in the PSA) is caught.
Every finding lands on your Client Upsell board as a named client with a number beside it — not a report you have to read.
What the Pax8 connection does
Read — powers Client Upsell
Read your clients' stack
What each client already buys through you — the gap a PSA agreement alone can't see.
Read-only, and checked
A write-capable credential is refused, not warned about
We test the key you give us the moment you submit it. If it can write to Pax8, we reject it and tell you which step to change — there is no override. It is encrypted at rest, held in one vault in one application, and nothing is ever written back to Pax8.
Pax8 integration — common questions
- What does the Pax8 integration read?
- Reads your client list and each client's active subscriptions — what they already buy through you. Read-only.
- What does MSProspector find in Pax8?
- Every active subscription the MSP resells per client, classified into the same security/BDR/email-security/MFA categories a PSA agreement is — feeds the existing agreement_gap signal directly, so a client whose security SKU only exists in Pax8 (never logged in the PSA) is caught.
- Is the Pax8 connection read-only?
- Yes. The credential is checked live when you submit it and a write-capable one is refused, with no override — and every connector we ship is checked, at every commit, by an automated build rule that fails if it contains anything other than a GET call. The credential itself is wrapped by a key that lives in Azure Key Vault's hardware security module and never leaves it — our application can ask the vault to wrap or unwrap it, but cannot read the wrapping key. See our security page for the full picture.