Most agencies hit the same wall: clients ask for software the agency cannot staff. White-label development, a partner builds it, you sell it under your brand, is how design studios, marketing agencies, and IT consultancies turn that wall into a product line. This is the operating playbook: contracts, margins, process, and the failure modes that sink it.
What is white-label software development?
White-label development means a partner firm builds software that your agency sells under its own brand. The client contracts with you; the partner's engineers deliver under your processes and, in the fully invisible variant, your domain. You own the relationship and the margin; the partner supplies delivery capacity you do not carry on payroll.
It sits between two models you already know:
- ▸Referral: you pass the client to another firm for a fee, no delivery risk, no recurring revenue, no control.
- ▸Staff augmentation: the client knowingly rents engineers through you, you are a broker, and the margin prices accordingly.
White-label keeps the client, the invoice, and the accountability with you. Respect that last word: every defect ships under your logo, so the partner's engineering quality becomes your reputation the day the contract is signed.
How does the delivery model actually work?
Two models dominate. Project-based: you sell a scoped build and the partner delivers it end-to-end under your project manager. Dedicated team: you rent named engineers monthly and resell their capacity. Most agencies start project-based, then convert clients to dedicated teams once monthly spend stabilizes around two to three engineers.
A weekly rhythm that works:
- ▸Your PM owns the client roadmap and acceptance; the partner's tech lead owns estimation and technical decisions, blurring this line causes most delivery friction.
- ▸Shared tooling from day one: a single Jira or Linear board, a Slack Connect channel, CI visible to both sides.
- ▸The repository lives in your GitHub organization or the client's, never the partner's.
- ▸The partner cuts a weekly demo; you replay it to the client with your branding on every artifact.
- ▸A written escalation path, agreed before the first sprint slips rather than during it.
The commercial shape, fixed scope versus monthly capacity, follows the same trade-offs as any outsourced build, which we walked through in Fixed Price vs Time and Materials: Which Contract Saves You Money?.
Who owns the IP, the code, and the client relationship?
Put all three in writing before the first sprint. The master agreement should assign IP to your agency on payment, explicit assignment language, not just work-for-hire wording, which does not automatically cover independent contractors in many EU jurisdictions. The repository lives in your organization from day one, and non-solicitation keeps the partner away from your client.
The clauses that matter most in practice:
- ▸IP assignment on payment, covering code, designs, and documentation, with moral-rights waivers where local law allows them.
- ▸An open-source inventory: the partner cannot assign what it does not own, so require a dependency and license list, an SBOM, with each release.
- ▸Non-solicitation and non-circumvention, typically 12 to 24 months, running in both directions.
- ▸A GDPR Article 28 data-processing agreement whenever the partner touches personal data, which also makes them a subprocessor you must disclose to your client, whatever the branding says.
If the repository sits in your org and invoices are current, code escrow is usually unnecessary theater.
What margin can an agency realistically make?
Senior nearshore rates from Tunisia typically land between 25 and 45 EUR per hour; Western European clients commonly pay agencies 80 to 130 EUR per hour for comparable profiles. After PM overhead, QA, sales cost, and rework buffers, realistic gross margin typically settles at 30 to 50 percent, not the 3x the raw arithmetic suggests.
Where the spread actually goes:
- ▸Your PM and QA layer: budget 15 to 25 percent of delivery hours; skipping it is how white-label reputations die.
- ▸Bench and ramp: engineers between projects and onboarding weeks are your cost in dedicated-team models unless the contract says otherwise.
- ▸Rework and warranty: fixed-price scope misses come out of your margin, not the partner's.
- ▸Sales and account management: the entire client-facing layer the partner never sees.
Price outcomes and your process, not marked-up hours, agencies that publish nearshore-level rates end up competing with their own partner. The full comparison across sourcing models is in Nearshore vs Offshore vs In-House: A Real Cost and Risk Breakdown.
How invisible should the partner be to your client?
Choose deliberately between three levels: fully white-label, where partner engineers use your email domain and appear as your team; disclosed subcontracting, where the client knows a delivery partner exists but contracts only with you; and hybrid. Fully invisible is workable; disclosed is more durable, and most mature agencies lose nothing by it.
Operational reality at each level:
- ▸Fully white-label: accounts on your domain, your Slack workspace, your document templates, agreed meeting norms. With Tunisia at zero to one hour offset from CET, the timezone never gives the game away.
- ▸Two hard limits on invisibility: if the partner processes personal data, GDPR requires disclosing them as a subprocessor in your DPA; and many enterprise MSAs, especially with DORA or NIS2 flow-down clauses, require subcontractor disclosure and audit rights. Verify before promising an invisibility you cannot legally keep.
- ▸Disclosed: one sentence in your proposal, our extended engineering team, with your accountability unchanged, and no awkward unmasking when a client engineer reads a commit author's email address.
What should the contract cover beyond IP?
The white-label MSA should also fix response and bugfix SLAs, a warranty window of typically 30 to 90 days after acceptance, rate-lock duration, replacement terms for underperforming engineers, liability caps, a security and data-protection annex, and exit obligations: documentation, credential handover, and a paid knowledge-transfer period.
Details worth negotiating explicitly:
- ▸Acceptance criteria per statement of work, so the warranty clock starts from a known, tested state.
- ▸A written change-request procedure, scope drift absorbed informally is the single biggest margin killer.
- ▸Key-person terms: named leads, notice before rotation, interview rights on replacements.
- ▸Security requirements: MFA on all accounts, access revoked on offboarding, background checks where the client's sector demands them, and professional indemnity insurance.
- ▸Governing law and venue both sides can realistically litigate in; nearshore partners with EU-registered entities simplify this considerably.
How do you vet a white-label partner?
Run a paid pilot of two to four weeks on real but low-risk tickets before any long-term commitment. Score code-review quality, pull-request cadence, communication latency, and how the team handles an ambiguous specification. Ask for engineering artifacts, CI pipelines, testing norms, security practices, not a wall of client logos.
Red flags worth acting on:
- ▸No senior engineer appears in calls until you escalate.
- ▸Rates far below the market band, someone is subsidizing that, usually quality.
- ▸Reluctance to work in your repository and tooling, or to hand over CI configuration.
- ▸A polished process deck with no real artifacts behind it.
The due-diligence fundamentals, legal setup, talent depth, and Tunisia's compliance posture as a delivery base, are covered in Nearshoring to Europe from Tunisia: The Complete Guide, and the evaluation questions mirror what any buyer should ask in The Non-Technical Founder's Guide to Hiring a Development Partner.
What are the common failure modes?
Three patterns kill white-label arrangements. Selling faster than the partner can staff, then absorbing the quality miss under your own brand. Cutting your QA and acceptance layer to protect margin. And running without a bench agreement, so continuity breaks between projects and every new build starts from zero context.
Mitigations that hold up:
- ▸Share a rolling capacity forecast quarterly; treat the partner's hiring pipeline as part of your sales pipeline.
- ▸Keep an acceptance gate you run yourself, even half a day of exploratory testing per release catches what sprint demos hide.
- ▸Use retainers to hold core engineers between projects; continuity is what your client is actually paying a premium for.
- ▸Verify the partner's own security posture before white-labeling anything regulated, their supply chain becomes yours the moment you resell it.
The process patterns that make distributed EU-North Africa teams ship predictably are documented in The Operating Model Behind EU-North Africa Nearshore Teams That Ship.
How TuniCyberLabs helps
TuniCyberLabs runs white-label delivery for European agencies from Tunisia, with an Estonian HQ and Cyprus operations for clean EU contracting. IP assignment on payment is our default paper, GDPR subprocessor documentation comes ready for your DPA, and delivery is CET-aligned with security review built into the pipeline. Quoting a project you cannot staff? Talk to us about white-label capacity.