ShipItWorks

Home Helmline

For managed service providers

Helmline

Unified RMM and PSA platform for managed service providers, one multi-tenant schema

Helmline is a codename. It is one app for managed service providers: device alerts, tickets, time and invoices in one place.

65 / 100 · Beta on our own rubric · 9 not finished in Helmline

Proof, by scorecard line: zero proven, 15 built, two not built, which names six features. No feature is proven yet; the eight that run were tested with sample data.

Request a demo or join the waitlist

The button opens your email app with the subject "Demo request: Helmline"; the waitlist link uses the subject "Waitlist: Helmline". There is no sign-up database yet; your email comes to support@shipitworks.com and we keep it only to set up the demo you asked for or to tell you when Helmline is ready. To be removed, send an email with the subject "Remove me". Privacy notice.

Scorecard

65/ 100

Stage: Beta on our own rubric. Google Play: No Android app.

Primary journey: shown with sample data

Scored 2026-11-08 on our own rubric; repository at commit dd7cf78.

Helmline demo · 3:39Captions · Transcript

Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

What Helmline does for an MSP

65 / 100 · Beta on our own rubric · 9 not finished in Helmline

Proof, by scorecard line: zero proven, 15 built, two not built, which names six features.

Device alerts
Proven: A sustained threshold breach on a device opens one alert and, optionally, one ticket on that device.
Tickets
Built: Tickets also arrive by email (email-to-ticket with quarantine) and from a customer portal, where contacts sign in with an emailed single-use link.
SLA
Proven: Each ticket's priority and SLA clock come from the alert severity and the customer's SLA policy; in the recorded run the first staff reply met the response target.
Built: A breached SLA state is covered by unit tests only.
Not built: Business-hours SLA calendars.
Time
Proven: Time logged on a ticket becomes invoice lines.
Invoices
Proven: Every invoice line names the devices or time entries it came from, and a second invoice does not bill time that was already billed.
Not built: Payment collection.
AI assist
Proven: Summarize a ticket and draft a reply, or draft a fix script; both are off by default and need a person's click.
Proven: When an admin turns it on, ticket text goes from the Helmline server to Anthropic's Claude through a Supabase Edge Function, which holds the Anthropic API key.
Built: Spend is capped at 5 USD per organisation per month by default, a hard stop; the refusal at the cap has not run against the real database.

How it is built

Tenancy
Built: One multi-tenant Postgres schema links endpoint telemetry to alerts, tickets, SLAs, time tracking and billing.
Every table has a tenant_id column with a forced row-level security policy, and requests run as the restricted role helmline_app with the tenant set, so a query missing its WHERE clause is still limited to its tenant (covered by the database and HTTP tests).
Limit: this protects against missing filters and privilege escalation, not against injected SQL; every query is parameterised.
Sign-in
Built: Sign-in and data are Helmline's own Postgres, not Supabase Auth: scrypt-hashed passwords, signed session tokens with expiry, a login throttle per email, and two roles, admin and technician.
Not built: SSO and MFA.
Agents
Built: Linux: one-line install as a sandboxed service; CI builds the Docker image and installs the agent as a customer would; the agent is exercised in CI and with demo agents only.
Built: macOS and Windows: packages built and structurally checked only, never run on real machines.
The agent runs as an unprivileged account and sends telemetry only by default; it runs scripts only when started with scripts enabled, and only scripts signed by a key the server does not hold.
Where it runs
Built: Self-hosted on one machine you control, with Docker or Podman Compose: Postgres, a one-shot migrate step, and the app (API and console in one), plus an HTTPS proxy when installed with a domain.
The database is not published to the network, and the app does tenant work as helmline_app, a role without the right to bypass row-level security.
Limit: one machine with no high availability; backing up the database, the attachments volume and the secrets file is the operator's job.
Optional: a ClamAV container scans attachments, and an upload is refused when the scanner cannot be reached.
How Helmline is deployed: endpoint agents and browsers reach one self-hosted server running the app and Postgres; mail and the optional AI assist sit outside it.Browsersstaff console,customer portalEndpoint agentsLinux: built, run in CImacOS, Windows:built, not runtelemetry,script resultsYour server: one machineDocker or Podman ComposeHTTPS proxy (with a domain)App: API and consolePostgresone schema, forced RLSmigrate(one-shot)ClamAV (optional)Mail serveremail in, SMTP outAI assist, off by defaultSupabase Edge FunctionAnthropic API (Claude)
Boxes from the Helmline README (Layout, Install, Adding machines, Virus scanning) and docs/AI.md at commit d57c9dd.

What we promised, and what we have not finished. We promised one public rubric for every product, a list of what is not finished on every page, and a named source for every number. Most of these products are not finished, and each page says where it stops. Read the rubric or every claim and its source.

Proven, built, not built

17 scorecard lines, eight listed under Works today and nine under Not finished, by proof level: zero proven, 15 built, two not built. Each line links to the scorecard row that backs it.

Proven (0)

    Built (15)

    Not built (2)

    What changed

    Dated lines from the scorecard. The source code is private, so these lines are the public record.

    How Helmline compares

    The same 19 rows for every product, including rows where another product lists a feature Helmline does not have. Vendor cells come only from that vendor's own pages; each cell names its source, and the addresses are listed under Sources with the date each was checked; they open in a new tab. "Not stated" means the pages read do not say; it does not mean the vendor lacks the feature. Helmline cells show a proof level: proven (run against the real thing), built (code and tests, not run against the real thing) or not built.

    Skip the table

    Helmline compared with five MSP tools: rows 1 to 6 of 19, checked 2026-11-04 (UTC); 2026-11-03 US time
    RowHelmlineAteraNinjaOneKaseya / DattoN-ableSuperOps
    Agent platforms (Windows, macOS, Linux, mobile)[proven in CI] Linux agent, one-command install. [built] macOS and Windows packages, never run on a real machine. [not built] mobile agent. H1Agent: Windows, Mac, Linux. Mobile app: iOS, Android. A1Windows, Mac, Linux devices. Android and Apple mobile device management. N2, N1Datto RMM: Windows, macOS, Linux devices, network devices, printers, ESXi hosts. VSA: Windows, macOS, Linux endpoints; mobile through device management (Apple, Android). K1, K2Not stated on the N-central, platform and comparison pages read. NA2, NA3, NA4Discovers Windows, macOS, Linux, iOS and Android devices automatically, syncs them from Intune, and picks up switches and routers through SNMP. Agent operating-system support: not stated. S1
    Remote access or remote control[not built] H1Splashtop included; AnyDesk; TeamViewer and ScreenConnect with the customer's own licences. A1Remote access with end-to-end encryption and MFA. N3Datto RMM: Web Remote on supported Windows and macOS devices. VSA: remote desktop, private RDP, on-demand sessions. K1, K2Take Control is listed as the remote access and remote support product. NA1"Use remote control, an SSH terminal, file transfer, and scripting on any endpoint or network device, all from one console." S1
    Operating-system patching[not built] H1"Automate update and patch deployment". A1Patches across Windows, macOS, Linux. N4Datto RMM: Windows patching by policy; macOS and Linux updates with reusable components. VSA: patch policies for operating systems. K1, K2N-central: "AI Accelerated vulnerability and patch management". N-central UEM: "built-in vulnerability management (coming soon)". The N-sight and N-central comparison table lists "Multi OS Device Patching" (product not attributed). NA2, NA3, NA4Patching across Windows, macOS, Linux and mobile; rings and maintenance windows; each patch carries a CVSS score and a Patch Confidence score. S2
    Third-party application patching[not built] H1Stated: "Does Atera's solution support third-party application patching? Yes" (WinGet, Chocolatey, Homebrew). A2Its own pages state three figures: 8,800+ and 6,000+ applications (patch page); "over 200" third-party applications (RMM page). N4, N2Datto RMM: "supported third-party applications". VSA: patch policies for third-party software. K1, K2Not stated on the pages read. NA2, NA3, NA4"Patch 10,000+ Windows apps from catalogs such as Winget and Chocolatey, and keep macOS and Linux apps current through Homebrew and your own custom apps." S2
    Scripting and automation[built] Scripts signed offline; every run needs a second admin's approval; the agent verifies the signature. [proven live] AI drafts a script, saved unsigned and needing approval. Running one on a real device: not shown. H2Shared Script Library; AI script generator. Scripting languages: not stated. A3, A1Scripts in PowerShell, Batch, ShellScript, JavaScript, VBScript. N6Datto RMM: "over 500 pre-built components" to install applications, run scripts and monitor conditions. VSA: scripts, tasks, visual workflows. K1, K2N-central comparison row: "Drag and Drop No-Code Automation". N-central UEM: "AI scripting". NA4, NA3Policies for "software patching, security, data backups, and scripting"; "AI-assisted scripting". S1
    Monitoring and alerting[proven, demo agents] CPU, memory and disk threshold rules open an alert and optionally a ticket. H3Remote monitoring and alerts; custom alert profiles. A1Alerts on "over 100 monitoring conditions"; delivery by in-app alert, email, SMS, mobile push, Slack, Teams. N7Datto RMM: thresholds by policy; alert actions include ticketing, webhooks, automated response. VSA: health, services, performance, availability through profiles and notifications. K1, K2N-central: "hundreds of templates and monitors". The comparison table lists a remote monitoring and management row (product not attributed). NA2, NA4"Deploy and monitor antivirus and backup across your fleet"; discovery can "alert technicians when support may be needed". S1, S6
    Show the other 13 rows
    Rows 7 to 19 of 19, checked 2026-11-04 (UTC); 2026-11-03 US time
    RowHelmlineAteraNinjaOneKaseya / DattoN-ableSuperOps
    Software deployment[not built] H1Software management with Chocolatey, Homebrew, WinGet. A1Software Package Repository for custom installation packages. N8Datto RMM: jobs to devices, sites, filters or groups. VSA: "deploy patches and software". Autotask PSA: not stated. K1, K2, K3N-central UEM: "Automated deployment of security software". NA3"Advanced app distribution" listed; "deploy and update apps" on iPhone, iPad and Android; third-party apps deployed through the patch tool. S1, S2
    Network discovery[not built] H1Listed under the Enterprise plan; also listed as an add-on at $29 per month per technician. A1Scans every IP-addressable device using standard TCP/IP protocols, "no credentials required". N9Datto RMM: device discovery across site subnets, topology maps. VSA: discovers network devices. K1, K2N-central: "Automated onboarding and discovery". NA2"Discovery tools use a combination of probes and sensors or network traffic patterns to help with network discovery." Devices include "network switches, firewalls, servers, printers". S6
    Ticketing[proven] Tickets from console, portal, email and alerts; internal notes; status changes. H3Ticketing and service portal. A1Ticketing. N10Autotask PSA: "ITIL-aligned ticketing module". Datto RMM: alerts can trigger ticketing. VSA: not stated. K3, K1, K2MSP Manager: "a help desk offering ticketing, reporting, and billing management". The comparison table lists "Built in Ticketing and Billing". NA1, NA4"AI-powered ticket workflows"; "RMM alerts and PSA tickets exist in the same platform natively." S4, S5
    SLA tracking[proven] Due dates from a per-customer policy (high: response 60 min, resolution 480 min by default); first public staff reply meets the response target. [built, unit-tested] breached state. [not built] business-hours calendars. H3"SLA management" listed in the plan feature table. A1SLA management; SLA tracking. N10Autotask PSA: visual timeline that highlights the SLA. Datto RMM, VSA: not stated. K3Not stated. "SLAs" appears only in a sentence about integrating third-party tech through open APIs. NA2, NA3, NA5, NA1"SLA tracking & breach alerts". S4
    Time tracking[proven] Time entries on tickets, rounded by customer rate card. H3One mention: "time-tracking" in the ticketing description. A4"Track billable time, services, and automated work in one place." N11Autotask PSA: "Accurately track time for services rendered". Datto RMM, VSA: not stated. K3MSP Manager: "capture previously unbilled time and expenses". NA3"Automated worklogs" listed. S4
    Billing and invoicing[proven] Invoice per period; each line names the devices or time entries it came from; billed time is not billed again. [not built] payment collection. H3"Flexible contracts and billing"; QuickBooks integration: "create customized invoices". A4"Automated billing and invoicing software for MSPs". N11Autotask PSA: invoicing from tracked labor, contracts, expenses and services; contract types, terms, billing options. Datto RMM, VSA: not stated. K4, K3MSP Manager: "billing management". The comparison table lists "Built in Ticketing and Billing for an All-In-One solution". NA1, NA4"Connect contracts, billable work, and invoicing in one flow"; "One-click invoice conversion". S4
    Customer portal[built] Emailed single-use link; needs an outgoing mail server. Not shown in the browser journey. H4Service portal for submitting and tracking service requests. A1Portal where end users submit, track and update tickets. N10Autotask PSA: Client Portal for customers to collaborate on tickets and projects. Datto RMM, VSA: not stated. K5Passportal feature list includes "Custom Branded Portal" (listed without a description). Customer portal for tickets: not stated. NA5Not stated on the pages read. S1, S2, S3, S4
    Reporting[proven] Dashboard of devices, alerts, tickets, SLA state. [not built] SLA and billing exports. H3Classic reports (all plans); 11 preset reports (Expert); custom reports "up to 10" (Master), "unlimited" (Enterprise). A1Not stated on the pages read (the reporting page loaded without reporting content). N16Datto RMM: scheduled, configurable reports. VSA: report designer without code. Autotask PSA: reports on resource utilization, ticket resolution times, profitability. K12, K2, K4Passportal: "complex reporting" beyond credential strength checks. MSP Manager: ticketing, reporting, billing. The comparison table lists a "Reporting" row (product not attributed). NA5, NA1, NA4"Profitability Reports" listed. S4
    AI features[proven live] Summarize and draft reply; draft a fix script. Off by default; ticket text is sent to Anthropic's Claude; monthly cap 5 USD per organisation by default. Cap refusal on the real database: not run. H5AI Copilot in all plans: AI script generator, ticket summaries and solutions, reply generator. A1Katana AI: every recommendation needs a technician's approval before platform actions; a global kill switch. N12Datto RMM: log insights through Kaseya Intelligence. VSA: Kaseya Assist suggests workflows. Autotask PSA: ticket classification and routing, summaries, writing assistant. K1, K2, K6N-central: "N-zo, our AI assistant" that "answers questions, surfaces risks, and guides decisions without leaving the console"; an MCP Server connecting MCP-compatible AI tools to live N-central data; "Shadow AI visibility". N-central UEM: "AI scripting". NA2, NA3Monica AI: "Monica handles routine IT tasks within the guardrails you set"; autonomous L1 resolution and autonomous patching are listed as features. S4, S3, S2
    Integrations[built] Inbound email to ticket, outgoing SMTP, audit-receipt webhook. [not built] billing, accounting or PSA connectors. H4Count not stated; the integrations page lists logos. A5Count not stated. N13Autotask PSA: "250+ Third Party Integrations" (integration hub) and "170+" tools (overview): two figures on its own pages. Datto RMM, VSA: named examples; count not stated. K7, K4, K1, K2"90+ Third-Party Integrations" (as shown on the page); "integrate third-party tech through open APIs"; the comparison table lists 3rd-party application and PSA integration rows. NA3, NA4Marketplace integrations named on the PSA page: Splashtop, TeamViewer, ConnectWise Control, Xero, Webroot, QuickBooks Online, QuickBooks Desktop, Pax8. Also named: ServiceNow, Entra ID, Intune. Count not stated. S4, S1
    Security attestations the vendor statesNone held. A NIST CSF 2.0 mapping written by the project lists what is and is not built; it is not an attestation. H6ISO 27001, 27017, 27018, 27032; SOC 2 Type II; ISO 42001. States compliance with HIPAA and GDPR. A6SOC 2; ISO 27001:2022; ISO 27018; ISO 42001; FedRAMP Rev5 Class C certification. N14Trust centre lists SOC 2 Type 2 reports (Kaseya, Datto), SOC 3 reports, a SOC 1 Type 2 report (ConnectBooster). ISO 27001: not stated. K9N-able's own attestations: not stated. The security statement says its data centres are "ISO27001 certified" and hold "Service Organization Control (SOC) 2 Type II attestation letters". N-central page: "N-able EDR FedRAMP Editions for federal and DIB fleets". NA6, NA2"SOC II Type 2, GDPR, ISO 27001, and HIPAA compliance". S7
    Pricing model and published priceNone set. Licence: all rights reserved. H7Per technician: Professional $149 per month billed annually ($169 monthly); Expert $189 ($229); Master $219 ($269); Enterprise "Let's talk". 30-day free trial. A1Per endpoint: "as low as $1.50 per month at 10,000 endpoints, increasing to $3.75 at 50 or fewer" (commercial, non-FedRAMP instance). 14-day trial. N15Price: not stated; "request pricing". Datto RMM is sold through a "single, integrated subscription" (Kaseya 365 Endpoint). VSA price depends on deployment model, device volume, packaging, capabilities. K10, K1, K2Not stated. Buttons: "Try it free", "Get a quote". NA1, NA2, NA3, NA4Per endpoint per month, "with unlimited technicians at no extra charge"; "Each plan has a minimum of 150 endpoints." Amounts: "Request pricing". S8
    HostingSelf-hosted (Docker Compose, install script). [proven in CI] image build and install. No hosted service offered. H1Platform hosting: not stated. AI models are hosted in Microsoft's Azure environment. A6Cloud-based, with "no infrastructure or VPN required" (patch page FAQ). Self-hosted: not stated. N4Datto RMM: cloud-based. Autotask PSA: cloud. VSA 10: SaaS and on-premises. K12, K4, K2N-central UEM: "A single SaaS solution for IT management, security, and automation at scale". Passportal: cloud-based. The comparison table lists "On-Premises Deployment Option" (product not attributed). NA3, NA5, NA4"We are hosted on Amazon Web Services (AWS) cloud." Self-hosted: not stated. S7

    Sources

    Read 2026-11-04 (UTC); 2026-11-03 US time. Skip the sources

    Corrections welcome: write to support@shipitworks.com with the page address and the wording on the page.

    Next step

    Request a demo or join the waitlist

    The button opens your email app with the subject "Demo request: Helmline"; the waitlist link uses the subject "Waitlist: Helmline". There is no sign-up database yet; your email comes to support@shipitworks.com and we keep it only to set up the demo you asked for or to tell you when Helmline is ready. To be removed, send an email with the subject "Remove me". Privacy notice.