White-Label Web Application: Custom Domains and Branding

White-Label Web Application

Imagine your SaaS product is about to be sold by a large enterprise client, but they need their own brand—their domain, logo, colors, and even email templates. Without white-label, you would have to write a separate copy for each client, which doesn't scale. We have implemented white-label for 20+ projects; our engineers have deep experience in multi-tenant architecture. We build a white-label version of your web application with full tenant isolation, custom domains, and automatic SSL issuance via Cloudflare. Contact us for an audit—we will prepare a deployment plan within 2 days.

Problems We Solve

Data Isolation Between Clients. If data from two clients ends up in the same table without a tenant_id filter, it's a disaster. We use middleware that identifies the tenant based on the domain and passes its ID into all queries. For key entities in Prisma, we add @@index([tenantId]) and always filter by it. This way we handle up to 10,000 requests per day without isolation errors.

Custom Domains and SSL. A client wants app.acmecorp.com, but you need to issue an SSL certificate for each domain. Manual issuance via Let's Encrypt would mean thousands of requests per day. The solution is Cloudflare Custom Hostnames: they issue and renew certificates automatically, while we only verify the CNAME record. The process is fully automated and takes a few minutes.

Branding Without Rewriting UI. Each client wants their own colors, logo, fonts, and even custom CSS. Storing this in CSS variables is not enough: you need to dynamically generate styles and load fonts. We use a TenantStylesheet component that injects CSS variables and optional custom CSS based on tenant settings.

How We Do It: A Real Implementation Case

From our practice: one project was a white-label platform for project management. Our client was a large company with 50+ brands. Tech stack: Next.js 14 (App Router), Prisma, PostgreSQL, Cloudflare, and Resend for email.

Middleware for Tenant Determination. In Next.js, we created middleware that intercepts requests and determines the tenant from the host header. If the domain is not found, it redirects to 404. We pass tenantId and tenantSlug in response headers so that server components can read them. This solves isolation at the routing level.

Custom Domain Verification. When a client adds a custom domain, we verify that the CNAME points to our platform. We use Node.js dns/promises to look up the CNAME. If the record is correct, we save the domain in the database and add the custom hostname via the Cloudflare API. The certificate is issued automatically in minutes.

Branded Emails. All transactional emails (invitations, notifications) are sent via Resend with tenant branding: logo, color, sender name. If the client hides the watermark, we do not display the "Powered by" badge.

Process of Work

Comparison of Isolation Approaches

Approximate Timelines

Minimal white-label configuration (subdomains + branding) — from 5 business days. Full solution with custom domains, SSL, and email — up to 10 business days. If data isolation at the individual database level is required — up to 15 days. The cost is calculated individually after auditing your stack. Order a consultation—we will prepare a precise estimate.

What Is Included in the Work

• Source code of middleware, branding components, and custom domain module
• Documentation for adding a new client (API endpoints, admin panel)
• Example CI/CD for deployment on Vercel or your own server
• 30 days of technical support after launch

When Should You Choose White-Label?

Compare: a custom solution means copying code, separate repositories, duplicate work. White-label—one codebase, one infrastructure, thousands of clients. According to our data, white-label maintenance costs 3–5 times less than maintaining separate instances. And the speed of onboarding a new client goes from weeks to hours, reducing operational costs. If your product has more than 10 clients, white-label is almost always more cost-effective.

How to Implement Data Isolation Between Tenants?

We use the shared database, per-tenant rows approach: all records in tables are tagged with tenantId, and in Prisma we have a global middleware that automatically adds a filter for the current tenant. This is simpler than separate schemas and does not require complex orchestration. If pure isolation is needed, we can switch to separate databases with automatic creation upon client registration. We verify the correctness of filtering with load tests: simulate 1000 simultaneous requests from different tenants.

Typical Mistakes and How to Avoid Them

• Not rechecking CNAME after verification. The client might delete the DNS record—then the domain stops working. We add a cron job that checks CNAME for all active domains every hour.
• Ignoring watermark. Some clients do not want to see "Powered by". Give them the option to disable it in branding settings.
• Forgetting SEO. On custom domains, there must be unique title and description. Use generateMetadata in Next.js to pull appName and favicon from tenant settings.

We use Cloudflare Custom Hostnames to automate SSL and Next.js Middleware for tenant determination. Get a white-label architecture consultation today. Contact us—we will evaluate your project for free and propose an implementation plan.