# Branding (white-label)

> Show your organization's name, logo and colour in the panel instead of Zefily — for agencies whose clients use the panel.

On plans with **Logo and colors** (Business and above), the panel can carry your brand instead of Zefily's. Everyone who works in your organization — your team and the clients you invite — sees it.

## Set your brand

Owners and admins open **Settings → Branding**:

| Setting | What it changes |
| --- | --- |
| Name | The name next to the logo in the sidebar and in the browser tab, in place of Zefily |
| Logo | A square PNG, JPEG or WebP image (up to 256 KB, 1024 × 1024 pixels) in the sidebar. Without one, the first letter of the name is shown |
| Accent colour | Buttons, links and highlights in both light and dark themes; text on it switches between dark and white to stay readable |

**Save branding** applies it at once. **Back to Zefily** removes it. SVG logos are not accepted because they can carry scripts.

## Your own panel domain

On plans with **Full white-label** (Agency), the panel can live at your own address, such as `panel.youragency.com`, with its own HTTPS certificate. Its sign-in page shows your name, logo and colour.

1. Under **Settings → Branding → Custom panel domain**, enter the name and **Add domain**.
2. At your DNS provider, add the two records the panel shows:
   - a **CNAME** from your name to the target shown (or, where a CNAME is not possible such as a domain's root, an **A** record to the address shown),
   - a **TXT** record at `_zefily.<your name>` with the value shown — it proves the domain is yours.
3. The page walks you through it in four steps and shows each record's state (**found** or **not found yet**). While it is open it checks every 30 seconds; **Check DNS** checks right away. When both records are found the domain is **Verified**. On Cloudflare, set the CNAME to **DNS only** (grey cloud): a proxied record hides where it points and the certificate cannot be issued.
4. Open `https://<your name>`. The certificate is issued automatically on the first visit (Let's Encrypt, renewed on its own) — the first page can take up to a minute.

There is no public sign-up on your domain (and no GitHub or Google sign-in): invite people under **Settings → Team**. Keep both records in place: if they are removed, the domain stops being verified at the next check. An organization has one custom domain; **Remove domain** releases it.

Passkeys are bound to the main Zefily address, which keeps them safe from look-alike sites. On your domain, **Approve with passkey** (and creating the approval passkey) opens a small window on the main address for that one step: confirm with Face ID, Touch ID or your security key, the window closes and the panel updates — no second sign-in. **Sign in with a passkey** works the same way: the window signs you in on the main address and hands your domain a one-time code that is valid for 60 seconds, only for that domain, and only for people of the organization that owns it (or its clients). Passwords and two-factor codes work on your domain directly. See [Approvals and passkeys](/docs/approvals).

## Client organizations (resellers)

On the **Agency** plan you can give each client their own organization under **Settings → Clients**: **Create client** with its name. Each client has its own servers, sites, team, backups and audit log, and:

- uses **your plan** (its limits and features) — the client never buys a plan; when it reaches a limit, it is asked to contact you,
- can be given **less** than your plan: under **Settings → Clients**, set its maximum servers, sites and team seats (for example one server only, so the client manages that server but cannot add another); empty fields use your plan's value,
- shows **your brand**,
- has no **Billing**, **Branding**, **Clients**, **Single sign-on** or **Feature requests** pages: you bill, brand and support your clients,
- does not see the Zefily support desk (unless Zefily opens it to clients); its own team, API tokens, notifications, status pages and recipes are available,
- cannot create clients of its own.

Your clients' servers, sites, apps, deploys, terminals, files, databases and backups are never limited by this: they use the panel fully.

You become the client's owner: **Open** switches into it (or use the organization switcher), then invite the client's people under **Settings → Team** with a limited role — **Developer** to work on sites, **Viewer** to look only. If your plan stops including reselling, clients fall back to their own plan.

## On your own domain

On your panel domain nobody sees **Billing**, the Zefily **Support** desk or **Feature requests** — not even your own team. Use the main Zefily address for your subscription and for contacting Zefily.

## What stays

- If your plan no longer includes branding, the panel shows Zefily again; your settings are kept and come back when you upgrade.
- Emails about your organization (alerts, deploys, invitations) carry your name as the sender name and in their header and footer; they are still sent from Zefily's address so they pass SPF and DKIM. Your own sender domain and agent branding are coming later.

Invite your clients with a limited role (**Developer** or **Viewer**) under **Settings → Team** — see [Team and roles](/docs/team-and-roles).

---
Source: https://zefily.com/docs/branding