One integration, 700+ tenants looted
In August a group tracked as UNC6395 stole long-lived OAuth and refresh tokens tied to the Salesloft Drift integration. With those tokens in hand, they bypassed MFA entirely (a valid token is already past the login) and exported data from more than 700 Salesforce tenants. Google’s threat team and the FBI put out advisories. The attackers weren’t after CRM records for their own sake. They were grepping support-case text for embedded secrets: AWS keys, Snowflake credentials, passwords pasted into tickets by well-meaning staff.
Read that back as an MSP owner. Broad, persistent OAuth grants across many tenants. Support cases full of secrets. That is not a Salesforce story. That is a description of a multi-tenant SaaS PSA.
Why this is a PSA problem, not a Salesforce problem
Think about what your PSA holds. Delegated OAuth connections into every client’s Microsoft 365. A live link to your accounting. CRM data. And tickets, thousands of them, stuffed with local admin passwords, VPN keys, and “here’s the temp login” notes your techs will swear they never leave lying around.
Now put that in a cloud PSA that holds the same grants for hundreds of other MSPs. Your vendor’s token cache becomes a single master OAuth target. One compromised integration, one leaked token store, and the blast radius is every MSP on the platform and every client behind them. The uncomfortable part: research suggests around 85% of organisations lack full visibility into the third-party OAuth apps sitting in their environment. You cannot revoke what you cannot see.
Self-hosted, single-tenant means you own the token store
Here is Opentra’s answer, and it is structural, not a feature you toggle. Opentra is self-hosted and single-tenant. Your instance holds your own OAuth connection to your own Microsoft 365 and Xero. There is no shared vendor cache holding delegated tokens that span hundreds of MSPs. The token store lives on infrastructure you control, and you revoke on your terms, not by filing a ticket and waiting.
If the worst happens somewhere in the supply chain, your exposure is your instance, not an industry-wide fire sale. That is the whole point of not handing your book of business to a cloud landlord. See how we think about this on our security page.
One more thing worth saying plainly: this is PSA only. Your monitoring stays yours. We are not the master key to your client fleet, because we are not sitting on everyone’s tenants at once.
Own the front door
OAuth tokens are keys. The question is who holds the copies. In a single-tenant deployment, the answer is you.
Self-host it free, or run it flat on Pro or Opentra Cloud. Compare the numbers on our pricing page, no per-seat tax either way.