Goal: deliver a branded client portal with billing to every client under your own name, so you resell a platform as "your" product and keep the whole fee instead of paying a per-seat cut to someone else's SaaS.
This is for agencies and MSPs who currently resell someone else's platform — a GoHighLevel, a course tool, a booking SaaS — and watch a slice of every client's fee leave the building each month. White-labelling a self-hosted platform flips that: you host it, you brand it, you bill for it, and there's no platform cut. The honest trade is that you also become responsible for running it — uptime, updates, backups. You're swapping a per-seat tax for an operations job. For an agency with a handful of clients that maths rarely works; for one with a growing book of recurring clients, it starts to work fast, because the cut you stop paying compounds.
dev-install-ce.sh.Both frontends are yours to theme. Replace the logos, and set your palette through the CSS variables rather than forking components — the design tokens are the supported override point, so a platform update won't stomp your brand. Rebrand the transactional emails too: the confirmation, invoice and password-reset messages a client sees should carry your name, not the platform's.
The customer-facing app (fe-user) and the admin backoffice (fe-admin) are separate applications, so you can brand the client-facing surface heavily while keeping the admin console lean for your own team.
Success looks like: a client logging in sees your logo, your colours, and emails from your domain — nothing that reveals the underlying platform.
This is the decision that shapes everything after, so make it deliberately. Two options:
Per-client instance. Each client gets their own deployment — separate database, separate domain, hard isolation. Maximum separation (one client's data can never touch another's), easy per-client customisation, and a clean handoff if a client leaves. The cost is more moving parts to operate: more instances to update, back up and monitor.
Shared multi-tenant instance. One deployment serving many clients, isolated by tenancy. Fewer things to run, but tenancy isolation is now load-bearing — the platform's access-level and data-boundary system is what keeps client A from seeing client B, and you must trust and test it.
For agencies handling sensitive or regulated client data (health, legal, finance), per-client instances are the safer default and the easier compliance story. For lots of small, low-sensitivity clients, shared multi-tenant is cheaper to run. Pick before onboarding, because migrating between them later is real work.
Use the platform's RBAC to model the actual relationship. Typically three tiers: you (the agency) with platform-level administration across everything; the client admin who manages their own portal but sees nothing outside it; and the client's end users with whatever access the client grants them.
The critical distinction is platform-admin versus client-admin. Conflating them is how a client discovers they can see another client's data, or worse, your admin console. Define these access levels explicitly and test the boundaries: log in as a client admin and confirm you can reach your own portal and nothing above or beside it.
Success looks like: a client-admin account can administer its own client and is denied — cleanly — any route into another client or into your agency-level controls.
This is the point of the exercise. Configure subscription plans and invoicing so you bill the client, on your terms, through your payment provider. The subscription and entitlement engine handles the recurring charge and flips the client's access with their subscription status — pay, and the portal works; lapse, and it doesn't — automatically.
Because there's no platform transaction cut, the margin between what you charge the client and what it costs you to run their portal is entirely yours. Set your plans at the value you deliver, not at a markup on someone else's per-seat fee.
Success looks like: a client's payment (or its failure) automatically changes what they can access, and the invoice carries your brand.
Decide, and write down, how you run this ongoing — because "who patches it" is the question that turns a good margin into a bad support burden if you skip it. Define: your update cadence (the platform ships changes; you decide when to apply them per client), your backup schedule and where backups live, your monitoring (you need to know a client's portal is down before the client does), and your support boundary (what's included, what's billable).
This is the part agencies underestimate. The per-seat SaaS you're replacing was also doing all of this invisibly; now it's your job. Price it in.
You are now the platform vendor. Uptime, security patches, backups and support are yours. That's the whole trade — you keep the cut because you do the work the cut was paying for. Don't take it on without pricing the operations in.
Isolation is a decision you must test, not assume. Whichever model you chose in Step 2, prove the boundary holds (Step 3's cross-client test) before a real client's data is in the system.
This replaces the platform, not your agency skills. White-labelling gives you the product to resell; it doesn't give you clients, positioning, or the service quality that retains them. The tool is the easy part.
Next: templatise your onboarding so standing up client N+1 is a checklist, not a project — that repeatability is what turns white-labelling from a clever setup into a scalable line of business.
Reselling someone else's SaaS means paying a tax on every client forever and owning none of the relationship. White-labelling a self-hosted platform inverts it: brand both frontends through CSS variables and email identity, isolate clients per-instance or by tenancy, model the agency/client/end-user tiers with real access levels, and bill under your own name through the subscription engine — with no platform cut, so the margin is yours. The cost is that you run it. Because it's self-hosted and source-available under BSL 1.1 (free for commercial use while annual VBWD-attributable sales stay under the value of 6.7 BTC per year), the clients, the billing relationship, and the data are yours to keep — which is the entire difference between reselling a product and renting one.
Building an agency platform? See the plugins, the white-label and RBAC details in the docs, and the ownership economics in pricing.