White-label is not an add-on. Branding is a setting every product reads on every request, so the switch is the real behaviour, not a picture of it.
One account for the agency. It owns the brand, the domains, the billing and the people.
Each gets its own database, keys and mailboxes, and its own AI context. Nothing leaks between them.
Name, logo, accent colour, support address, footer. Every product and email reads it.
leads.youragency.com, app.youragency.com. One DNS record each; certificates are issued for you.
They sign in on your domain, to your brand, and see only their workspace.