Published
9 MIN READ
White label SaaS: what to build for each brand
A white label SaaS is a single piece of software that partners offer to their own customers under their own brand, domain, and email. For whoever builds it, the brand is only the top layer: underneath, there has to be a multi-tenant core that keeps each customer's data separate and accepts a different domain per partner.
The Brazilian pages on the topic read in September 2026, nearly all from vendors of ready-made platforms, speak to resellers. This guide sits on the other side of the table, with the product owner, and assumes you already know the method for building a SaaS from scratch.
At Wama, this model came through the portfolio. In 2026 the studio did the branding, the SaaS platform design, and the Framer website for Stric, an infrastructure that lets companies operate as digital banks on a white label model. In the financial sector, the architecture also carries its own rules for the fintech that operates under a partner's license.
Reselling is not building: the side of whoever makes the platform
A reseller buys a ready-made platform and applies its own brand. The builder is the vendor, and every item the reseller gets ready-made is a feature that someone designed and maintains.
A white label CRM vendor's page, updated on September 28, 2026, lists six criteria for true white label: brand, domain, visual identity, billing, revenue sharing, and dedicated partner support. From the builder's side, the list becomes scope, and billing with revenue sharing calls for a billing engine of your own, the subject of how the plan fits into the product's billing.
What does a white label SaaS need to have per customer?
A white label SaaS stores six things for each partner: theme, domain, email sender, app distribution method, isolated data, and support. A foreign social media management platform, in an August 2026 page, sums it up: the brand is a presentation layer on top of the multi-tenant core.
Piece | What the product does | What the partner does |
|---|---|---|
Theme (logo, colors, fonts) | Stores the theme per tenant and applies it when the screen loads | Sends the brand files |
Domain | Validates ownership, issues the certificate, and routes access | Creates the records in their DNS |
Sends signed with the partner's domain | Publishes the authentication records | |
App in the stores | Offers an aggregator app or hands over the code | Keeps the developer account, if the app ships under their name |
Data | Isolates each tenant's data | Defines who on their team accesses what |
Support | Serves the partner | Serves the end customer |
The right-hand column is the one that disappears from the scope. And the theme weighs on the design: an interface that takes any color and any logo needs contrast that works with the partner's palette, a concern that belongs in the design of a product used every day.
Custom domain per customer: what does the platform need to do?
With a subdomain, each partner gets an address like partner.yourproduct.com, resolved by a single wildcard DNS record. With a custom domain, like app.partner.com.br, the platform validates ownership, issues a certificate, and cleans up what is left when the contract ends.
Microsoft's guide on domain names in multitenant solutions, updated in September 2026, calls for a TXT record with a random value before accepting the domain. The bigger risk is the dangling subdomain: the partner leaves, forgets the pointer in their DNS, and a third party creates an account with the same name and inherits the address. The recommended safeguards are to require removal of the record before disconnecting the domain and to never reuse a tenant identifier.
The certificate can come from the platform, if the customer's CAA record authorizes the issuer. The infrastructure cost is small: the Cloudflare for SaaS plan, updated in August 2026, includes 100 custom domains and charges US$ 0.10 for each additional one. The real cost is rollout: a build write-up published in July 2026 says the hard part was getting agency owners with no technical background to edit their DNS.
Email from the partner's domain depends on their DNS
Email sent on behalf of a domain that has not authorized the sending is treated as suspicious. Gmail's sender guidelines, in force since February 2024, require SPF or DKIM from every sender and, above 5,000 messages a day, SPF, DKIM, DMARC, and an aligned sender domain.
In practice, the product only switches the sender to contact@partner.com.br after the partner publishes those records. Invitations and password resets are the first messages the end customer receives.
White label apps in the stores: what does Apple accept?
Apple rejects apps built from a commercialized template when the vendor submits them on behalf of its clients. Guideline 4.2.6 of the App Store Review Guidelines accepts two paths: the content provider submits the app in their own account, or the vendor publishes a single aggregator app, with each client as an entry.
Guideline 4.3 closes the third way out: no multiple bundle IDs of the same app, one per client. With an app per partner, the vendor delivers code and a publishing process, and each partner keeps their own account. For financial apps the bar goes up, a detail covered in the store rules for financial apps.
In 2025 Wama did the design and development of the app for Cappta, a payment institution that offers payment acquiring and a digital account on a white label model, with the interfaces designed in Figma. In an app like that, deciding under whose name it reaches the store comes before the first screen.
How do you separate each customer's data in a white label SaaS?
There are three patterns: one database per customer, one schema per customer in the same database, or shared tables with a column that identifies the customer. The Azure SQL multitenant patterns page compares the three and warns that switching models later is expensive.
In the shared model, the database can do the separation. The PostgreSQL documentation on row-level security, in version 18, shows that a table with the rule enabled and no policy returns no rows at all, and that the table owner bypasses the rule by default unless it is forced. Two Brazilian technical articles from 2026 reach the same yardstick: a separate database only when a contract or regulation requires physical isolation, as in healthcare and financial services. It is worth running the isolation test a founder runs on their own app before the first partner.
The LGPD in the white label chain: controller and processor
In most arrangements, the partner decides about their customers' data and is the controller, and the SaaS owner processes that data on their behalf and is the processor. Law 13,709 of 2018 (the LGPD, Brazil's data protection law) defines the roles in Article 5, requires the processor to follow the controller's instructions in Article 39, and demands security measures from both in Article 46. The split between company and vendor is covered in who is controller and who is processor when an agency operates the product.
On Wama's websites, the delivered project stays in the client's account, and whoever decides to switch vendors takes everything, because it is already in their name. On a white label platform, the logic goes one step down: the contract with each partner needs to say how they export their own customers' data when they leave, and who owns the code and the accounts.
How much does it cost, and when is white label not worth building?
White label is worth it when the partner distributes the product to many end customers and their brand is part of what they sell. When three customers just want their own logo, a per-account theme and a subdomain solve it, as a higher-tier plan.
In Wama's projects, a SaaS MVP runs between US$ 4,000 and US$ 20,000 and can reach US$ 40,000 depending on complexity. The prices Wama records have no separate range for white label: domain, email, theme, and app enter the scope as features and move the budget by complexity, and how much the first version of a product costs helps place the rest.
Common mistakes when building a white label SaaS
Treating white label as a logo swap. Domain, email, app, and data are features.
Removing the partner without requiring DNS cleanup. The abandoned address can be taken over by another account.
Publishing one app per client in the vendor's account. Apple's guideline 4.2.6 rejects that format.
Leaving isolation only in the application code. A query without the customer filter exposes another partner's data.
Frequently asked questions about white label SaaS
What is the difference between white label SaaS and multi-tenant SaaS?
Multi-tenant is the architecture: a single system serves many customers with each one's data kept separate. White label is what is sold on top of it: each partner uses the system with their own brand, domain, and email. Every white label SaaS is multi-tenant, but not every multi-tenant SaaS offers the customer's brand.
Does each partner need their own domain?
No. A subdomain, like partner.yourproduct.com, is simpler and covers most cases. A custom domain appeals to those who sell the platform as if it were their own, but it requires ownership validation, a certificate, and an offboarding process that deletes the DNS pointer before removing the partner from the account.
Can you publish a white label app for each client on the App Store?
Only if each client submits the app in their own developer account. Apple's guideline 4.2.6 rejects template apps submitted by the vendor on behalf of clients. The accepted alternative is a single aggregator app, in which each client appears as a separate entry inside the same app.
Does the database need to be separate per customer?
In most cases, no. Shared tables with row-level security enabled in the database isolate the data at a lower cost and with a single schema update. A separate database per customer makes sense when a contract or regulation requires physical isolation, as in healthcare and financial services, and the contract value pays for the operation.
Who is responsible for the data in a white label SaaS?
In general, the partner is the controller, because they decide about their customers' data, and the SaaS owner is the processor, who handles the data following the instructions received. Both need security measures, under Article 46 of the LGPD, and the contract should record instructions, isolation, and export on exit.
If you are going to turn your SaaS into a white label platform and want to design domain, theme, and isolation from the first version, talk to Wama about your project.
