This is interesting. So you're creating an ITFlow instance per customer and then want a central instance that you run to host all the data? I'm not sure if that's the best approach.
Either way, syncing contact and asset data should be possible with the API but you'd have to write some logic to do the syncing.
However syncing passwords is tricky as they're encrypted. You'll need to be storing your master encryption key/account credentials somewhere (this is the reason that we don't currently offer API/client access to passwords).
Regarding password management specifically, are these clients more co-managed? It's generally not a great best practice to 'shared' passwords between you and your client in my experience. Sometimes it's unavoidable, but generally you want your MSP account so that actions are auditable to you, not them.