White-label add-on

The White-label add-on removes every visible Certivus branding cue from the surfaces your team and clients see. It's a single monthly retainer that unlocks five customisations on the Settings → Integrations page.

What you get

Customisation	What changes	Where your clients / team see it
Portal domain	Your team logs in at `portal.your-firm.co.uk` instead of `app.certivus.com`	Browser bar, every day
Sending email domain	Outbound emails come from `compliance@your-firm.co.uk` instead of the Certivus default	Every email your clients receive
Verification link domain	KYC links land on `verify.your-firm.co.uk/verify/…` instead of `app.certivus.com/verify/…`	The link your client clicks to start verification
WhatsApp Business number	Outbound WhatsApp comes from your firm's own WhatsApp Business number, not the Certivus default	Every WhatsApp your client receives
Branded portal theme	Logo, colours, and login screen use your brand	Already configured in Settings → Branding

All five are independent — you can turn any of them on or leave them off. Most firms start with portal domain + sending email, then add verify and WhatsApp later.

Who can configure this

Your firm must be subscribed to the White-label add-on. If you see a paywall card instead of the four setup cards, contact us to enable it.
Within your firm: only firm-owners and managers can register or remove domains. Other roles see the cards as read-only.

Order to set them up

You can do these in any order, but the path of least surprise:

Portal domain first — it doesn't affect anything client-facing yet, so you can test it without risk. Once verified, your team starts logging in at your domain.
Sending email domain second — this is what your clients notice first. Required for Gmail / Yahoo bulk-sender compliance if you send to more than a few hundred unique addresses a month.
Verification link domain third — visible to every end-client clicking a KYC link. The brand-trust win is significant; the technical setup is identical to the portal domain.
WhatsApp number last — requires a separate Meta Business Account and WhatsApp Business Account, which has its own onboarding timeline outside of Certivus.

How sign-in works on your portal domain

Most white-label SaaS products either need you to bring your own SSO provider, or maintain a per-firm allowlist on the auth side. We don't.

When a staff member signs in on portal.your-firm.co.uk, the OAuth dance (including Rajoka ID and password resets) bounces through app.certivus.com for half a second to complete the auth handshake, then lands them back on your domain with a working session. No per-firm setup on Supabase Auth or Rajoka ID — adding firms is a zero-touch operation for our team.

You'll see this flicker for a fraction of a second during sign-in. It's normal.

DNS basics

Three of the four customisations (portal, sending, verify domains) require DNS records at your domain registrar. Each card shows you exactly what to add:

TXT records prove you own the domain. We give you a one-time token; you paste it as a TXT record value at a specific hostname (e.g. _certivus-verify.portal.your-firm.co.uk).
CNAME records route traffic to our hosting (Vercel). For subdomains (recommended), the value is cname.vercel-dns.com. For apex domains, use an A record to 76.76.21.21 instead.

DNS propagation usually takes 5–30 minutes but can be a few hours in the worst case. We don't lock anything — you can click Verify repeatedly until it succeeds.

After verification we provision an SSL certificate automatically (Let's Encrypt via Vercel). No action required from you.

Mid-month removal

You can detach any of the four customisations at any time. The bundle entitlement stays on for the month; you just stop using those particular features.

If you remove your portal domain, staff currently signed in on it stay signed in until their session expires. New logins happen on app.certivus.com.

If you remove your sending email domain, new outbound emails go from the Certivus default; in-flight messages already in the Resend queue still come from your address.

If you remove your verify link domain, new KYC links go to app.certivus.com/verify/…; in-flight links already sent to clients still work on your domain until they expire (default 7 days).

If you remove your WhatsApp number, new WhatsApp messages come from the Certivus default WhatsApp Business Account; the link to that number is broken immediately at our end.

Portal domain (portal.your-firm.co.uk) — setup walkthrough
Sending email domain — DNS records + DMARC primer
Verification link domain — what your clients see
WhatsApp Business setup (Expediusly) — getting a WhatsApp Business Account approved