Glossary

Terms used across the KW Group Unified Platform.

Admin tenancy

The root tenant in a multi-tenant install. Users in the admin tenancy manage other tenants and get shadow memberships in customer tenants automatically.

Agent (RMM agent)

The persistent service installed on a managed endpoint. Reports inventory, runs scripts, opens screen sessions, accepts file transfer.

Asset

A tracked physical thing — laptop, monitor, switch, etc. Stored in the asset register. Distinct from an RMM device (though one asset can link to one device).

Asset tag

The auto-generated identifier of an asset, e.g. LAPTOP-0042. Made up of a category prefix + zero-padded number. Monotonic and never reused.

Audit log

Append-only record of every write action across the platform. At /admin/audit. Retained 1 year; older entries archived to MinIO.

Campaign

An email send (one-off or recurring) targeted at an audience. Lives in the Marketing module.

Checkmk

Third-party monitoring tool integrated with RMM device pages. The Checkmk web UI is also exposed publicly at https://portal.kwgroup.org.uk/checkmk/ (a Traefik path-rewrite proxy in /opt/data/traefik/dynamic/checkmk.yml). Login is with Checkmk's own cmkadmin user — the platform does not wrap the Checkmk UI in portal auth. See Admin → Integrations → Checkmk.

Contact

A person at a customer/company in the CRM. Distinct from a user (login account) or a person (internal staff HR record).

Contract (support contract)

Per-customer agreement that ties a customer to an SLA policy, hours allowance, billing rate, and term. See Admin → Helpdesk config.

Customer

An external company you do business with. The customer view at /customers is the 360° aggregator — same underlying record as the CRM company.

Deal

A sales opportunity in the CRM. Has stages, value, expected close.

Device

An RMM-managed endpoint (server, workstation, laptop). Has an installed agent. Distinct from an asset (a physical thing) although one device usually corresponds to one asset.

E-Sign

The signature-request workflow. Send a PDF to a recipient, they sign at esign.kwgroup.uk, audit trail is preserved.

Feature

An enabled capability for a tenant — e.g. helpdesk, crm, rmm. The licence sets which features are available; the tenant admin chooses which to enable.

Helpdesk

Ticketing module. Each ticket has a customer, contact, status, priority, type, and conversation thread.

Installer

A signed binary built per-OS that installs the RMM agent on an endpoint. Built per-tenant under Admin → Agent installers.

KB (Knowledge base)

Articles for staff and customers. Internal-only and public articles both supported. Public articles live at kb.kwgroup.uk.

Licence / license

Signed entitlement that limits what features a tenant can enable. Polled hourly from license-server.portal.kwgroup.org.uk.

Location (asset location)

A curated physical site for asset placement. Managed under Admin → Asset locations.

Macro

A saved reply template in the helpdesk. Supports placeholders.

Membership

A (user, tenant, role) tuple. A user can have memberships in multiple tenants.

MinIO

Built-in object storage (S3-compatible). Stores attachments, KB images, MinIO-keyed file storage, and avatars.

NATS

Message broker used internally for event distribution between services.

Person

An internal staff member's HR record at /people. Different from a user (login account).

Project

A piece of work in the Projects module. Has a code (SNAG-014), tasks, customer, owner.

Project type

Categorises projects and drives the project-code prefix and counter. See Admin → Project types.

Quick-support

A one-shot remote-support session that doesn't require a persistent RMM agent. Customer downloads a one-off binary from a public URL. See Quick-support & remote.

Relay (relay-service)

Separate Docker container at relay.portal.kwgroup.org.uk that proxies WebSocket binary traffic for screen viewing, remote control, and file transfer.

Role

A permission bundle for a user. Examples: admin, support, helpdesk-admin, read-only.

RMM

Remote Monitoring and Management. The endpoints module; covers inventory, monitoring, scripts, remote sessions.

Shadow membership

A membership in a tenant that doesn't appear in that tenant's user list. Used by admin-tenancy users for cross-tenant operator access.

SLA policy

Response & resolution time targets per priority. Linked to customers via support contracts. See Admin → Helpdesk config → SLA.

Studio (Design studio)

Branding & template editor at /studio. Drives the look-and-feel of emails, KB site, e-sign pages.

Tag

Two distinct concepts:

1. Asset tag — auto-generated identifier (LAPTOP-0042)
2. Free-form tag — labels you add to entities (CRM, helpdesk, etc.) for filtering. Search uses tags as keywords.

Task

A work item inside a project. Status, assignee, due date, notes. Distinct from a ticket (which lives in the helpdesk).

Template

Reusable shape. Two types in this platform:

1. Task template — a project skeleton (set of tasks + checklists)
2. Email template — a marketing/email design

Tenant / organisation

A logical container for data with isolated users, customers, etc. The platform is multi-tenant — one install hosts many tenants.

Ticket

The unit of work in the helpdesk. Has number, status, priority, type, customer, contact, conversation.

Trial

A 30-day no-cost licence auto-issued to fresh installs.

User

A login account. Distinct from a person (HR record) and a contact (CRM external).

Vault (Vaultwarden)

Embedded password manager. SSO from the portal at /vault.

Watchdog

Internal service that probes every other service for liveness and correctness. Drives /admin/health and the public /status page.

See also

• Architecture overview — for engineers
• User guide README — index of operator docs