3 stepsagent, signed script, audit export
One pilot session
Install one agent, run one signed script, export the audit file. That is usually enough to answer the buy-or-not question.
Record every signedscript run
Govern PowerShell with signing policy and exportable audit, so MSPs can answer assessors and insurers without RMM log archaeology.
Install one agent, run one signed script, and export the audit file. We designed the first run to fit in one short session.
3 steps
agent, signed script, audit export
1
Govern for signed scripts
15MB
Lightweight agent target
No credit card · Select product interestWe reply to pilot requests within approximately two business days · Enterprise reviewed manually
Request early access
Install one agent, run one signed script, export the audit file.
Govern modules that close the audit gap
Signed scripts, agents, trust evidence, and optional monitoring, beside your RMM.
Scripts
Sign, approve, and run PowerShell
Block unsigned scripts when policy requires it. Every run is recorded with who ran what on which machine.
- PowerShell IDE with approval workflows
- Push/pull file pipeline in script runs
- Platform catalog duplication into tenant libraries
- Execution queue with a clear audit record
- Complex install pipelines when Win32 is the wrong tool
1 agent, 1 script, 1 exportfirst signed script + export
Explore script governance
Agents
Lightweight Windows agents
Deploy a small agent that polls outbound. Search and target machines with catalog APIs built for large fleets.
- ~15MB single-file deployment target
- Outbound polling, no inbound firewall holes
- Catalog APIs with server-side search and paging
15MBagent footprint target
Explore agent management
Trust
Evidence for security reviewers
Download what is built vs. not. Export audit rows from Govern early access and attach them to your questionnaire.
- Shipped and Gap tables on the trust hub
- Downloadable trust pack
- Architecture notes for procurement
1Govern early access session to export audit rows
Download trust materials
Monitoring
Optional probes and NOC views
Add SNMP ingest and NOC dashboards when your SKU includes the Monitoring module.
- Packaged Monitoring module gates
- Probe ingest with rollup retention controls
- Lazy policy trees for fleet-scale operators
Optionalmodule, buy when entitled
Explore monitoring moduleWhat you get from a Govern pilot
Three distinct outcomes: pilot fit, audit export, and fleet scale.
Test on one customer first
1pilot tenant before portfolio rollout
Run a pilot group before you mandate Govern fleet-wide.
Compare optionsHand auditors a file
JSON/CSVexportable script run history
Export who ran which signed script on which machine, without digging through RMM logs.
Review security evidenceGrow the fleet safely
Pagedserver-side agent search, no full-fleet dropdowns
Server-backed search and pagination, not full-fleet dropdowns.
See Govern architectureHow to evaluate Govern
Run one signed script in a Govern early access tenant and export the audit file. Shipped and Gap tables show what is built and what is not.
Shipped/GapHonest evidence tables published
69%of 900 MSP leaders surveyed said they were breached two or more times in the past 12 months (CyberSmart MSP Survey 2025). Source (PDF)
Privileged script runs need governance proof
Signing, four-eyes approval, and exportable audit-verify in a Govern early access tenant. No SOC 2 badge claims; honest Shipped/Gap evidence for assessors.
Compliance by region
Pick your jurisdiction hub for framework-specific evidence pages.
Australia
Essential Eight and ISM mapping, and AU hosting plans.
United States
NIST CSF and CMMC Level 2 practice mapping.
United Kingdom
Cyber Essentials mapping and NCSC remote access guidance.
European Union
GDPR processor framing, DORA ICT risk, NIS2 supply-chain evidence, and EU hosting by enterprise arrangement.
SOC 2 evidence framing applies across regions · Compare incumbent tools · Trust downloads
Request Govern access
Start a pilot or contact us for enterprise entitlements
Request Govern early access
Pilot by request, reviewed by our team before onboarding
- Agent seats per bundle
- Signed script orchestration
- Security audit export
- Optional monitoring module
Explore Govern
Jump to feature depth, tenancy evidence, or stack-fit guidance.
Agents
Lightweight Windows agents with polling credentials and fleet-scale catalog APIs.
Scripts
IDE, signing policy, platform catalog, and execution queue.
Governance
Policy and evidence control plane: Govern to Evidence to Observe.
Agentic IT governance
Gate Rewst/Neo execution-intent behind signed-script policy and record it in the audit log.
Observe (optional)
Packaged monitoring/NOC upsell when entitled, not the hero GTM.
Security
Shipped/Gap evidence, access controls, and audit export.
Stack fit
Where script governance belongs in your environment.
Core modules: - Agent Management: lightweight Windows agent, polling credentials, fleet catalog APIs, ad-hoc and bulk push/pull file operations - PowerShell IDE: editor, approval workflows, push/pull file pipeline in script runs, platform script catalog, execution queue - Software (winget): browse the full public winget catalog, tenant-approved packages, scheduled deployment policies, inventory compliance, and break-glass push (apps Intune's storefront may not list) - Monitoring (optional): probe SNMP ingest, NOC dashboards, module gates
Push installers and configs. Run signed automation. Pull logs and evidence without Win32 repackaging for every change. When the install is conditional PowerShell, not a silent MSI, Govern stages files, runs parameterized scripts on demand or on a schedule, and records full output for auditors.
Each MSP tenant keeps its own customers, scripts, agents, and audit history. Privileged actions land in a security audit table with JSON/CSV export, separate from HTTP request logs.
Govern fits when script signing, file orchestration, and audit export are the buying trigger, not when you need a different Trustholm product. See the product family and Microsoft Intune comparison for coexistence guidance.
Govern questions
- Can I enable only some modules?
Yes. Packaged modules (Agent Management, Monitoring, PowerShell IDE) are gated globally and per-tenant via SKU entitlements. Navigation and API routes respect module enablement.
- Does Govern push and pull files on endpoints?
Yes. Push files from your tenant library before a script runs, pull artifacts back afterward, ad-hoc, in bulk from the agent catalog, or as part of a published script pipeline in the PowerShell IDE. Every transfer ties to execution and audit records.
- When should we use Govern instead of Intune Win32?
Use Intune Win32 for silent MSI-style apps. Use Govern when the install is conditional PowerShell, requires staged files, needs run-as context, or must produce exportable execution evidence. Many MSPs keep both layers.
- How is my data separated from other MSPs?
Each MSP tenant gets its own PostgreSQL schema, and portal tokens are bound to one tenant. We are fixing scope gaps between customers inside a tenant (software deployment, agent commands, probes); see the Gap rows on the trust hub. Enterprise buyers can request a dedicated database.
- What identity providers are supported?
OIDC and SAML SSO with MFA flows. Entra ID, Google Workspace, and Okta-style providers are supported configurations; live sign-off with each IdP is pending. Customer IdP lifecycle remains your responsibility.
- Is there an API for large fleets?
Yes. Agent, script, and catalog endpoints use cursor/keyset pagination and indexed filters, so large fleets do not load into one list. We have not yet published a load test; ask us for current scale testing status.