BACKUP OPERATIONS
Integrations
Give Client Care visibility, not recovery privileges.
PSA company directory
Autotask now · Ticket Desk adapter later · never sourced through Client Care
Fixture directory · no Autotask credentials configured
Company metadata is synced into VEXbackup; Client Care only consumes backup status.
Microsoft technician sign-in is required to access live PSA company data.
| Company | PSA source | External ID |
|---|
No PSA companies have been synced in this workspace.
Signed MSI upgrades
Record a site-scoped push/offer; installation remains blocked until Authenticode verification on Windows
| Site | Component | Delivery | Version | State |
|---|
Expected publisher: Vexitey. Signature verification is mandatory; this records intent, not a completed install. QNAP is not an MSI target.
Client Care · Read-only status
Server-to-server integration stub · disabled until a service token and explicit company scope are configured.
Company scope uses the Autotask company ID. The service token must remain on Client Care’s server, never in browser code.
GET /v1/status/companies/{autotaskCompanyId}
GET /v1/status/companies/{autotaskCompanyId}/sites/{siteId}
GET /v1/status/companies/{autotaskCompanyId}/vms/{vmId}Bearer authentication · no-store responses · explicit company allowlist · no key material
| Status | Meaning |
|---|---|
| 200 | Linked company, with configured state and sites; configured: false and sites: [] when not set up. |
| 404 | Unlinked or out-of-scope company / missing resource. |
| 401 | Invalid or missing bearer token. |
| 503 | Service token not configured. |
Payload includes per-VM job result, last successful backup, local USB / NAS copy, encrypted Windows / QNAP offsite copy and application-aware AD/DC, SQL and Exchange consistency and log truncation.
Security boundaries
Client Care has no restore, unwrap or Key Vault endpoint. Security endpoints live separately: pairing grants ciphertext transport only; restore unwrap remains denied.
Technicians use Microsoft 365 sign-in when configured. This session identifies the operator; it never grants restore unwrap authorization.
Per-site wrapping keys belong in Azure Key Vault. An operator must be authenticated, authorized for the site and verified with recent MFA before any production unwrap. The in-process library requires an explicit authorized restore context; this UI cannot supply one.
Before production
- Company/site RBAC and durable audit logging.
- Verified mTLS enrollment and certificate lifecycle.
- Engine code signing and hardened, signed updates.
- Real engine telemetry and tested recovery workflows.