Branding

Branding lets an MSSP white-label the Surface console for its customers. You define one organization default brand - name, logo, colors, and support contact - and it applies to every managed tenant. Individual tenants can then override any subset of those fields, so a customer who insists on their own logo can have it without disturbing the rest of your fleet.

The page lives at Manage > Branding in the organization sidebar. Branding is purely cosmetic: it never changes detection, policies, or data handling.

Screenshot

[SCREENSHOT PLACEHOLDER: The Branding page showing the "Organization default" card with all seven brand fields filled in, above the "Per-tenant overrides" card listing several tenants.]

How it works

Branding resolves in three layers, merged field by field:

1. Built-in Surface brand - what everyone sees when nothing is configured.
2. Organization default - your MSSP brand, applied to all managed tenants.
3. Per-tenant override - individual fields a tenant replaces.

An empty field always inherits from the layer below. If a tenant override sets only Display name, that tenant gets its own name with your organization's logo and colors; if a field is empty everywhere, the built-in Surface value is used. Leaving every field empty simply means "use the Surface brand".

Field-wise merging in practice

Merging happens per field, never per profile - a tenant override does not have to repeat fields it is happy to inherit:

Field	Organization default	Tenant override	What the tenant sees
Display name	Acme Security Portal	Globex Security	Globex Security
Logo URL	https://cdn.acme.../logo.svg	(empty)	Acme logo
Primary color	#0A3D62	(empty)	#0A3D62
Support email	(empty)	(empty)	Surface default

Clearing a previously set override field and saving restores inheritance for that field only.

Where branding appears

• Sign-in page - resolved before anyone logs in, based on the address used to reach the console. The first label of the host name (for example globex in globex.example-mssp.com) is matched against your tenant identifiers first, then your organization identifier. A tenant match shows the org default merged with that tenant's override; an org match shows the org default. No match, or any lookup problem, quietly falls back to the Surface brand - branding can never break the login page.
• Dashboard sidebar - the signed-in dashboard shows the resolved logo and display name in place of the Surface logo.

The logo and display name are the most visible brand elements today. The remaining fields (favicon, colors, support contact) are stored as part of the brand profile with the same inheritance rules.

Safety rules

• Logo URL, Favicon URL, and Support URL must be https:// URLs. Anything else is rejected when saving, and even a stored value is re-checked when rendered - a non-https logo silently falls back to the Surface logo rather than loading.
• Colors must be six-digit hex values in #RRGGBB form.
• Support email must be a valid email address.
• Only the cosmetic fields listed below are ever exposed on the public sign-in page - nothing else about your organization or tenants is revealed to a visitor who has not signed in.

Using the page

Only an organization owner can save branding changes.

Before you start, have ready:

• Your logo (and optionally favicon) hosted at a stable, publicly reachable https:// URL - images are loaded by your users' browsers, not proxied by Surface.
• Your brand colors as six-digit hex values.
• The support email and support portal URL you want surfaced to tenant users.

Organization default

The Organization default card ("The default brand for every managed tenant. Tenants may override individual fields below.") has these fields:

Field	Rules
Display name	Free text, up to 128 characters. Shown on the sign-in page and sidebar.
Logo URL (https)	https:// image URL. Host the image somewhere reliable and publicly reachable.
Favicon URL (https)	https:// image URL.
Primary color (#RRGGBB)	Hex color, e.g. #8646F4.
Accent color (#RRGGBB)	Hex color, e.g. #a76ff5.
Support email	Valid email address for your help desk.
Support URL (https)	https:// link to your support portal.

Invalid values show an inline error ("Must be an https:// URL", "Must be #RRGGBB") and disable saving. Select Save default to apply.

Per-tenant overrides

The Per-tenant overrides card lists every managed tenant. Select Edit override on a tenant row to expand the same field set for that tenant:

• Fill in only the fields the tenant should replace. "Empty fields inherit the org default."
• To remove an override, clear the field and save - it returns to inheriting.
• Select Save override to apply.

Screenshot

[SCREENSHOT PLACEHOLDER: A tenant row expanded under "Per-tenant overrides" with only Display name and Logo URL filled in, illustrating partial override with the other fields left blank.]

Branded sign-in addresses

Pre-login branding is keyed off the address your users type. To give each tenant a branded sign-in page, serve the console on a host name whose first label matches that tenant's identifier (its slug, visible to your Surface provider), for example globex.acme-mssp.example for the tenant globex. A host whose first label matches your organization identifier instead shows the org default brand. Plain IP addresses carry no identifier and always show the fallback brand.

Permissions and audit

• Viewing the page requires an organization admin account; saving either the default or an override requires the organization owner role.
• Every save is recorded as org_branding.update in the organization Audit Log.
• The pre-login brand endpoint is intentionally anonymous (the sign-in page has no session yet), which is why it only ever serves the cosmetic fields listed above and returns the neutral Surface brand for anything it cannot match.

Screenshot

[SCREENSHOT PLACEHOLDER: A tenant's sign-in page showing the resolved white-label brand - custom logo and display name - before any user has logged in.]

Worked example: one MSSP brand, one customer exception

Acme MSSP manages three tenants. Two are happy with the Acme brand; Globex wants its own identity on the sign-in page.

1. On Manage > Branding, in Organization default, set:
   • Display name: Acme Security Portal
   • Logo URL (https): https://cdn.acme-mssp.com/brand/logo.svg
   • Primary color (#RRGGBB): #0A3D62
   • Support email: soc@acme-mssp.com
2. Select Save default. All three tenants now see the Acme logo and name on their sign-in pages and sidebars.
3. Under Per-tenant overrides, select Edit override on the Globex row and set:
   • Display name: Globex Security
   • Logo URL (https): https://brand.globex.com/security-logo.png
4. Select Save override.

Users reaching the console at globex.acme-mssp.example now see the Globex logo and name before they sign in, while every unset Globex field - colors, favicon, support contact - still inherits from Acme's default. The other two tenants are untouched.

Video

[VIDEO PLACEHOLDER: Set the organization default brand, save, open a tenant sign-in page to show the new brand, then add a per-tenant override and reload to show the merged result.]

Troubleshooting and FAQ

My logo does not appear. Check that the URL starts with https:// and is reachable from your users' browsers (it is loaded client-side). A URL that fails to load, or is not https, falls back to the Surface logo.

Can I preview a brand before saving? There is no built-in preview. Branding is cosmetic and instantly reversible, so the practical approach is to save and open the relevant sign-in page in a private browser window.

How quickly do changes appear? The sign-in page picks up the new brand on its next load. Signed-in dashboards cache the resolved brand briefly, so allow a few minutes or reload the page.

The sign-in page shows the Surface brand instead of mine. Pre-login branding is resolved from the console address. The first part of the host name must match a tenant identifier or your organization identifier - if your users reach the console through a generic address, no brand can be matched and the default is shown.

Does the org console itself pick up my brand? Yes, through the same mechanism: when the console is reached via an address whose first label matches your organization identifier, the org default brand is shown.

Can a tenant admin change their own branding? No. Branding for managed tenants is controlled from this organization page, and only an organization owner can save changes.

Does branding affect the browser extension or alerts? No. It only skins the web console (sign-in page and dashboard). Alert content, detection behavior, and organization policies are unaffected.

Are logo images uploaded to Surface? No. Logos and favicons are referenced by URL only and loaded directly by the browser, so you keep full control of the asset - and full responsibility for keeping the URL alive.

Is there an approval or review step? No, changes apply as soon as they are saved. Every branding change is recorded in the organization Audit Log.