White-Label Client Portal Your Clients Meet Your Firm. Nothing Else.
“White label” usually means a logo slot. Pental means it literally: every surface a client can see, from the address bar to the report on their desk, carries your identity and only yours, from a single tester: your own domain, email sent from your own mail server, and your clients' data in a database you own.
Your own team sets it up from Settings, with no developer and no code.
What Is a White-Label Client Portal?
A white-label client portal is a secure website through which a firm’s clients receive their work, presented entirely under the firm’s own name. Nothing on it points to the software vendor behind it, so to a client it reads as part of the firm’s own service, in the same way as the reports the firm already sends.
Product demo
See Four Firms on One Product, in the Demo
This is in the demo as “Your Brand”, from 5:08, with the rest of the platform a chapter away.
- 5:08 · Your Brand
- 5:29 · Your Report Templates and Files
- 6:04 · Your Fields and Prompts
- 6:22 · Your Report’s Sections and Methodology
- 6:49 · Your Own AI and Your Files
- +5 more
The Address Bar Says You.
Your portal runs at portal.yourfirm.com, or any hostname you own. The first thing a client checks before typing credentials is the domain, and the domain is yours.
A Sign-in Page That Could Only Be Yours.
The sign-in page is the most security-conscious moment a client has with your firm. It renders with your logo, your colours and your background, on your domain, so nothing about it teaches clients to trust an unfamiliar name.
- Your compositionLogo, colours, background and wording are yours to set, for the sign-in page specifically as well as the application behind it.
- Sign-in options, your policyEmail and password with a mandatory second factor by default, Google and Microsoft SSO if you want them, or emailed one-time codes if your policy prefers passwordless.
- Both themesLight and dark render from your palette, so the page is on-brand whichever the client's system prefers.
The same page, three firms
Calderwood Security What their client signs in toDemonstration portals. The four firms are invented; every screen is the real software.
Inside, It Still Says You.
Branding that stops at the login page is a costume. The application itself runs on your design tokens, for your team and your clients alike.
Email from Your Address, Through Your Infrastructure.
Portal invitations, credential requests and report releases all arrive from you@yourfirm.com, sent through your own relay. Not a lookalike sender, and not a shared pool that shapes your deliverability.
Documents That Are Literally Yours.
The report is the artefact your client keeps, forwards and files. It renders from the Word template you already send, so it is not similar to your report, it is your report.
- Your own document templatesYour report and your attestation letter each render from the DOCX you send today, with your cover page, styles, headers and appendices untouched.
- Mapped onceUpload the document you send today and the platform maps its placeholders, tables and sections to live data. Nobody hand-assembles a report again.
- Deterministic outputThe same engagement produces the same file every time. Two reports a quarter apart differ only in their findings, which is exactly what a returning client expects.
- Named your wayGenerated files follow your naming convention, so what lands in the client's inbox already matches their filing.
Every Surface Says Your Firm, and Only Your Firm.
White-labelling is complete when every surface carries your firm alone: the corner of every screen, the footer, the email signature and every page your clients reach.
A client should be able to complete an entire engagement, hand over credentials, read the findings as they are released, take the report to their board and request a retest, without ever encountering evidence that your platform was not built in-house. If a surface fails that test, it is a bug.
Where your branding, colours and templates are stored, and why we could not leak them if we wanted to, is covered on the ownership page
Questions About White-Labelling.
Yes. Point a domain or subdomain you own at the portal and TLS is issued automatically. Pental holds only the domain routing that sends requests to your portal. The clients, findings and reports behind it live in your own database, where Pental cannot read them.
Yes. Single sign-on runs under your own Google or Microsoft application rather than one belonging to Pental. Multi-factor authentication is still required for everyone who signs in, clients included, using an authenticator app or a passkey.
Your own. Connect a Microsoft 365, Google Workspace or Zoho mailbox, or any SMTP server, and every email the portal sends to a client comes from your firm’s address rather than from a shared sending service.
Clients see what you have released to them and nothing else. They can read their findings, download their reports, track remediation and request retests. When a test is being set up they can also hand over credentials through the portal rather than by email.
Put Your Name on It Today.
Domain, colours and email are set from the portal in about five minutes, and your own report template goes in whenever it suits you. Free trial, no card required, full white-labelling from the first minute.