We build white label SaaS platforms that partners deploy under their own brand — one codebase, one infrastructure, infinite brand configurations. Custom domains, CSS variable theming, SAML SSO, and partner portals included.
White Label Stack We Build On — Next.js, Clerk, Stripe, CSS Variables, Terraform, and the modern SaaS toolchain
White label SaaS is a product distribution model where you build and operate one platform, and your partners deploy it under their own brand to their own customers. From the end user's perspective, they are using their software. From your perspective, you are running one codebase, one infrastructure stack, and one engineering team — serving every partner and their customers from a single deployment.
The unit economics of white label SaaS are structurally different from direct SaaS. Each new partner you onboard adds revenue without a proportional increase in engineering cost — you are selling access to infrastructure you have already built and are already operating. The marginal cost of adding a partner is a provisioning workflow and a support relationship, not an engineering sprint. At scale, white label SaaS businesses have higher gross margins than direct SaaS because the per-customer engineering cost approaches zero.
The architecture that makes this possible is more complex than a standard multi-tenant SaaS platform. You need a theming system that isolates brand configuration from application code. You need custom domain routing with automated TLS provisioning. You need a partner admin portal that allows non-technical partners to configure their brand without engineering involvement. And you need a permission model that allows partner administrators to manage their users without accessing other partners' data. We build all of this as a coherent platform, not as a collection of disconnected features.
Scaling revenue
Each new partner requires a separate development engagement — revenue is gated by engineering capacity
Scaling revenue
One build serves unlimited partners — new partner revenue adds without engineering cost
Maintenance burden
Multiplies with every partner — each deployment is a separate liability
Maintenance burden
One codebase, one maintenance burden — fixes reach all partners simultaneously
Releasing updates
Updates must be applied to every partner deployment individually — slow, error-prone, costly
Releasing updates
One deployment serves all partners — a single release reaches every brand at once
Partner onboarding
Every new partner requires manual operational involvement — no self-serve
Partner onboarding
Self-serve partner onboarding — new partners go live in minutes, not weeks
Partner analytics
No cross-partner analytics — partner performance data is siloed across deployments
Partner analytics
Cross-partner analytics in the operator dashboard — compare performance across your entire partner network
The crossover point — where white label SaaS is more economical than custom builds per partner — is typically at three to five partners. Above that, the operational savings compound with every new partner onboarded.
Seven specialist service lines covering every component of a production-grade white label SaaS platform.
We design the platform architecture that supports white label deployment: the theming system model, the tenancy architecture, the custom domain routing infrastructure, and the partner permission model. Architecture is documented and agreed before implementation begins.
We build a CSS variable-based theming system that allows every visual property — colours, typography, logo, favicon, and layout variants — to be configured per partner from a central configuration without touching application code. Themes are applied at request time based on the incoming domain or tenant context.
We implement automated custom domain provisioning: partners submit their domain, a CNAME verification confirms ownership, TLS certificates are provisioned via Let's Encrypt or ACM, and the domain is activated in the platform routing within minutes. The entire workflow requires zero manual intervention from your operations team.
We build a partner admin portal where partners manage their brand configuration, users, subscription tiers, and usage analytics. The portal exposes the configuration surface your partners need while keeping the underlying platform architecture invisible. Role-based access within the partner portal supports sub-reseller hierarchies.
We implement SAML 2.0 SSO with per-partner identity provider configuration — each partner connects their own Microsoft Entra ID, Okta, or Google Workspace instance. We also implement SCIM provisioning so enterprise partners can automate user creation and deprovisioning from their IdP.
We build partner-branded onboarding flows — registration, email verification, and first-run experience — that reflect the partner's visual identity from the first user interaction. Onboarding configuration is managed per-partner from the partner admin portal, not hardcoded in application code.
We build operator dashboards showing cross-partner metrics — active users per partner, feature adoption, revenue, and usage trends — alongside partner-facing analytics covering their own user base. Data is always partition-scoped: partners see their data, operators see everything.
A structured six-stage process from free partner programme discovery through production launch and partner enablement.
We review your partner programme model, the level of brand customisation required, the enterprise authentication requirements, and the self-serve vs managed onboarding model. We agree the architecture approach and produce a timeline estimate. Free.
We design the theming system — CSS variable model, configuration schema, and admin portal surface — and the custom domain routing architecture. We produce a partner onboarding flow specification and agree the partner permission model.
We build the multi-tenant core with the theming system integrated from the start. The first partner brand is configured as a test case during the core build phase so the theming architecture is validated against real brand configuration before more partners are onboarded.
We build the partner admin portal with brand configuration, user management, and usage analytics. We implement the custom domain routing with automated TLS provisioning and test the end-to-end partner onboarding workflow.
We implement SAML SSO with per-partner IdP configuration and SCIM user provisioning. For white label platforms with a developer API, we build the partner API with API key management, rate limiting, and partner-scoped access controls.
We launch the platform, onboard your first partners, and produce partner documentation covering domain setup, brand configuration, and user management. We train your team on the partner onboarding workflow and hand over operator runbooks.
We review your partner programme model, the level of brand customisation required, the enterprise authentication requirements, and the self-serve vs managed onboarding model. We agree the architecture approach and produce a timeline estimate. Free.
We design the theming system — CSS variable model, configuration schema, and admin portal surface — and the custom domain routing architecture. We produce a partner onboarding flow specification and agree the partner permission model.
We build the multi-tenant core with the theming system integrated from the start. The first partner brand is configured as a test case during the core build phase so the theming architecture is validated against real brand configuration before more partners are onboarded.
We build the partner admin portal with brand configuration, user management, and usage analytics. We implement the custom domain routing with automated TLS provisioning and test the end-to-end partner onboarding workflow.
We implement SAML SSO with per-partner IdP configuration and SCIM user provisioning. For white label platforms with a developer API, we build the partner API with API key management, rate limiting, and partner-scoped access controls.
We launch the platform, onboard your first partners, and produce partner documentation covering domain setup, brand configuration, and user management. We train your team on the partner onboarding workflow and hand over operator runbooks.
Select a market to see how we build white label SaaS platforms that your partners and customers can adopt under their own brand.
White label SaaS in financial services allows banks, credit unions, and fintech brands to offer digital financial products under their own brand without the cost of building from scratch.
White label SaaS in financial services allows banks, credit unions, and fintech brands to offer digital financial products under their own brand without the cost of building from scratch.
HR technology vendors resell white label platforms to HR consultancies, PEOs, and enterprise clients who want branded HR software without the development investment.
Healthcare technology vendors resell white label platforms to health systems, insurers, and digital health brands who need patient-facing products under their own brand.
Logistics technology platforms resell white label shipment tracking, carrier management, and supply chain visibility tools to freight brokers, 3PLs, and shipper brands.
Legal technology vendors resell white label contract management, compliance tracking, and document automation platforms to law firms, Big 4 consultancies, and regulated industries.
E-commerce technology vendors resell white label ordering, inventory, and loyalty platforms to retail brands, franchise networks, and B2B distributors.
Perimattic's work resulted in stable production systems. The team was helpful, easily accessible, and communicative through email. Their professionalism was impressive.
Quality
4.5
Schedule
5.0
Cost
5.0
Willing to Refer
4.5
DevOps Managed Services · Oct 2023 – Aug 2024
24/7 monitoring and support for production environments plus Linux server administration for a leasing automation company.
The new architecture is scalable and highly efficient, saving a lot of money in fees. Perimattic provides high-quality IT consulting and cloud development work promptly and at great value. The team remains involved from the planning stage to providing support, showing diligence and proactiveness.
Quality
5.0
Schedule
5.0
Cost
4.5
Willing to Refer
5.0
AWS Migration (Legacy → Microservices) · Nov 2018 – Ongoing
Transitioned a travel systems company's legacy server system to an AWS-based microservices architecture with ongoing maintenance.
Four structural advantages that make our white label SaaS platforms genuinely partner-ready from launch day.
We architect white label platforms where adding a new partner brand is a configuration operation, not a development operation. The theming system, domain routing, and partner provisioning are designed from the start to be self-serve — not a recurring engineering task.
A white label platform without brand governance is a support burden. We build validation into the theming system — colour contrast checking, image dimension enforcement, and mandatory field requirements — so partners cannot misconfigure their brand in ways that break the UI.
Enterprise partners want to build on your platform, not just use it. We build partner APIs with OpenAPI documentation, partner-scoped API key management, webhook delivery for platform events, and the integration surface your partners need to connect to their own systems.
We build theming on CSS custom properties with a documented configuration schema, design token architecture, and a Storybook component library that validates brand configuration against every component before it reaches production — no specificity wars.
“Unlike boutique dev shops that build to spec without strategic context, or large consultancies that advise without shipping, Perimattic brings both capabilities to every engagement.”
White label SaaS development is the process of building a SaaS platform designed to be deployed under multiple partner brands — each with their own domain, logo, colour scheme, and user identity — without the partner needing to build or operate the underlying platform themselves. A white label SaaS product has one core codebase and one operational infrastructure, but it presents differently to each partner's users. The platform operator builds and runs the technology; the partners resell or deploy it under their own brand.
Multi-tenant SaaS is a technical architecture — one application serving multiple customer organisations with isolated data. White label SaaS is a commercial and branding model — one application deployed under multiple partner brands with custom visual identity and domain. Most white label SaaS platforms are built on a multi-tenant architecture: the tenancy model provides the data isolation, and the white label layer provides the brand differentiation. You can have a multi-tenant platform that is not white label (all tenants see the same brand), but a white label platform almost always requires multi-tenant architecture underneath.
Custom domain routing allows each partner to access the platform through their own domain — for example, app.partnerbrand.com — rather than a subdomain of your platform. Technically, this requires the partner to point a CNAME or A record to your infrastructure, automated TLS certificate provisioning for each custom domain via Let's Encrypt or AWS Certificate Manager, and application-level tenant resolution that identifies the partner from the incoming hostname and loads the correct brand configuration. We automate the certificate provisioning pipeline so new partner domains are activated in minutes without manual intervention.
The customisation depth depends on how you architect the theming system. At the minimum level, partners can change the logo, primary colour, and email sender identity — sufficient for many reseller scenarios. At a deeper level, partners can configure full colour palettes, typography, custom CSS overrides, custom email templates, and custom onboarding content. At the deepest level, partners can configure navigation structure, feature enablement per their plan tier, and custom domain email. We design the theming architecture based on the level of customisation your partner programme requires, and we build the partner admin portal that allows partners to configure their brand without engineering support.
Partner onboarding involves provisioning the partner's tenant in the database, configuring their brand settings, activating their custom domain and TLS certificate, setting up their billing relationship, and granting access to the partner admin portal. We build this as an automated workflow — a new partner submits their details, the platform provisions everything in the background, and the partner receives an activation email with their admin credentials and domain setup instructions. The process is designed to require zero manual intervention from your operations team.
SAML (Security Assertion Markup Language) SSO is an authentication protocol that allows enterprise users to log in to your platform using their corporate identity provider — typically Microsoft Entra ID, Okta, or Google Workspace — rather than a separate username and password. Enterprise buyers frequently require SAML SSO as a condition of purchase because it allows them to control access centrally, enforce MFA policy, and deprovision access instantly when employees leave. For white label SaaS targeting enterprise customers, SAML SSO support is typically non-negotiable. We implement SAML SSO with per-partner identity provider configuration so each partner can connect their own IdP.
Because all partners run on the same codebase and the same infrastructure, a software update is deployed once and reaches every partner simultaneously. There is no need to coordinate updates with individual partners or maintain multiple versions. This is one of the core operational advantages of white label SaaS over selling source code licences. For breaking changes or UI changes that affect partner-specific configuration, we implement feature flags that allow new versions to be enabled per partner at a controlled cadence.
GDPR compliance in a white label SaaS context requires several measures: a data processing agreement with each partner covering your role as data processor and their role as data controller; tenant-level data isolation ensuring partner customer data is not accessible by other partners or by the platform operator unless required for support; data export APIs allowing partners to fulfil subject access requests; and data deletion workflows for partner offboarding. Data residency requirements are handled by deploying partner tenants to the appropriate cloud region and documenting the data flow in the partner DPA.
Building the core white label architecture — theming system, custom domain routing, partner admin portal, and automated onboarding — typically takes ten to eighteen weeks depending on the complexity of the theming model and the partner feature set. A full-featured white label platform with SAML SSO, usage-based billing, partner analytics, and API access for partner integrations is typically sixteen to twenty-eight weeks. We start with a free discovery session to define the partner programme requirements and produce a realistic delivery timeline.
A white label SaaS platform with core theming, custom domain routing, partner onboarding automation, and a partner admin portal typically starts from USD 50,000. A full-featured platform with SAML SSO per partner, usage-based billing, partner API access, and multi-tier reseller support typically ranges from USD 90,000 to USD 200,000 depending on scope. We scope every engagement before quoting and provide a detailed breakdown of what is included at each phase.
Tell us about your partner programme — the number of partners, the level of brand customisation required, and the enterprise authentication needs — and we will scope the white label architecture that fits. Free discovery call, no obligation.