Open the product on a Monday morning and the first thing you should feel is nothing. Your logo sits where you expect it. The primary button is the colour your brand team argued about for a fortnight two years ago. The product’s name, in the corner, is the name your organisation actually calls it. Nothing announces itself, because nothing is borrowed. That absence — the small, unremarkable sense that this software belongs here — is the entire design goal, and it is much harder to earn than it sounds.
Borrowed-looking software gets treated as borrowed
Staff read an interface long before they read a policy. They form a judgement about whether a tool is theirs in the first few seconds, and they make it on colour, on the logo, on whether the words on screen sound like the words they use in the corridor. A compliance platform lives or dies on that judgement, because its whole job is to be believed. If the screen looks like a generic SaaS product wearing someone else’s branding badly, people extend that same suspicion to what it tells them. A gap flagged red gets a shrug. A green tick gets a second-guess. The distrust starts at the surface and seeps into the data.
So white-label theming is not decoration to us. It is the first and cheapest trust signal we can send, and getting it wrong is expensive in a way that never shows up in a bug tracker.
One product, recoloured at runtime
The naive way to give each organisation its own look is to ship each one a slightly different build. That path ends in a graveyard of forks, where a fix to one organisation’s login page has to be hand-carried to every other organisation. We refused it from the start.
Instead there is one codebase, and the look is driven by design tokens — CSS custom properties that stand in for every colour, every accent, the logo, the product name. When the app loads, it fetches the organisation’s branding from a configuration endpoint and resolves those tokens at runtime. No rebuild. No separate deployment. Change the configuration, reload, and the whole product is wearing new clothes.
Because it is tokens rather than a stylesheet bolted onto the buttons, the recolour is total. This is the part that matters to me as a designer. A theme that only reaches the obvious controls is worse than no theme at all, because the seams show — a branded header sitting above a stock-standard sidebar reads as a costume, and people notice costumes. When the sign-in page, the dashboard, the navigation and even the translucent overlays that dim the screen behind a modal all shift to the same palette together, there are no seams to notice. The eye never catches the product being anything other than the organisation’s own. That completeness is the difference between skinning and belonging.
Its own front door
Colour is only half of feeling at home; the address bar is the other half. Each organisation gets its own branded subdomain, and the TLS (Transport Layer Security) certificate for it is provisioned automatically, so the padlock and the name in the browser are theirs from the first visit. There is no shared, anonymous URL that quietly reveals everyone is really using the same tenant of the same platform.
The front door is also a boundary, and we treated it as one. A request to a subdomain the platform does not recognise is not met with a helpful error that hints at what exists behind it; it is redirected to the main marketing site’s 404 page. An unknown door does not rattle to tell you it is locked — it simply is not a door. Worth being precise here, because it is a design constraint people assume away: a branded subdomain is a front door, not a magic carpet. Signing in at one organisation’s door does not carry you into another organisation’s door as a single session.
Past skin-deep: when an organisation renames its own world
Colour makes a product feel like yours. Language makes it feel like it understands you — and that is where theming stops being cosmetic.
Every organisation carries its own dialect for its own structure, and those words are load-bearing. One place’s employees are another’s workers; one’s departments are another’s sections, crews, or units. When software insists on its own vocabulary, it quietly asks every user to translate on the fly, and every translation is a tiny tax on trust. So beyond colour and logo, an organisation can override the product’s vocabulary to match how it already describes itself — relabelling employee to Worker, department to Section — as a capability of the theme rather than a code change. The screens then speak the organisation’s language back to it, which is a far deeper kind of familiarity than a matching accent colour.
The same principle reaches into the components themselves. The product was built for Victorian local government, and some of its views carry that heritage — a location view rendered as a council map, for instance. An organisation outside that sector has no use for a map of councils, and showing it one would be the interface confessing it was built for someone else. So a non-government organisation sees a generic pin-marker location map instead, plotting its own sites on neutral ground. The map still does its job; it just stops speaking a dialect that isn’t yours.
The discipline behind one product feeling like many
There is a temptation, once you can theme this deeply, to treat each organisation’s look as a bespoke artefact. That is the trap. The whole value is that all of this — colours, logo, name, vocabulary, even which map renders — resolves from configuration over a single, shared product, so no organisation is ever fork-frozen out of the next improvement. One fix reaches every organisation at once, rather than one at a time. The illusion of many products has to sit on the reality of one, or it is not sustainable.
That runtime seam is the same seam the platform is built along elsewhere. Recolouring flows to every screen for the same reason data flows between them — because the modules share one connective layer rather than living as silos, so a change to the shared surface reaches all of them at once. The per-organisation boundary that gives each organisation its own front door is the visible edge of the deeper rule that data is kept on Australian ground and separated at the base, where one organisation’s data is invisible to another organisation’s users regardless of what the interface is wearing — an isolation the database itself enforces, with privileged platform and auditor roles as a deliberate cross-organisation exception. And the fact that a single platform can present itself as each customer’s own product is the design counterpart to the way it is one platform deliberately sold in pieces — one nervous system underneath, many faces on top.
One last note for honesty’s sake, because it is easy to mistake a demo for a deployment: every branded instance we show is synthetic. The colours are invented, the names are placeholders, the data is de-identified sample data assembled to exercise the theming, not a live customer’s window. What is real is the mechanism — that the product can wear any organisation’s identity, top to bottom, from a line of configuration and a reload. Getting to nothing announces itself is a lot of engineering in service of a feeling. I think the feeling is worth it.