White label means structure, not skin.

Software a distribution company runs its own business on, then delivers to its own labels and artists under its own brand and domain. The distributor keeps the client relationship, the catalogue, the contracts and the payouts. LabelLedger is built for distribution companies, never for individual artists. Every record belongs to a tenant, isolation is enforced by Postgres row level security rather than by application code, and the tenant's artists and labels arrive through portals carrying the tenant's brand. It is infrastructure. It never competes with its own customers.

No. Brand tokens are one of ten Studio panels. The other nine set the navigation model, the component language, page composition, which modules exist, the artist and label portals, the sign in door, the tenant vocabulary, outbound connections and inbound sources. Configuration is data, not code. It is versioned through Draft, Staging and Live, and every published version stays restorable with one click. The test is structural, not visual: three distributors running on LabelLedger operate products that feel like three different companies, on one codebase, with no per tenant fork.

Ask every vendor to put two of its own tenants side by side, then ask which differences are stored configuration and which required a code change or a separate fork. That one question separates a configurable operating system from a theme layer. Ask a second one about money: what happens to a statement line that turns out to be wrong after the statement is issued. In LabelLedger the period locks when the statement is issued, and the correction is a reversal insert. Nothing is edited and nothing is deleted.

Yes. One system covers the decision queue, catalog, release building, validation, delivery, money, roster, contracts, analytics, reach, protection, portals and settings, under one permission model and one audit log that records every state changing action with actor, action, entity, before and after. Storage, delivery pipeline and DSP contracts are swappable bindings, so a distributor runs on LabelLedger's infrastructure or its own. What LabelLedger does not do is deliver on its own authority: it prepares the release, records the provider handoff, authorises the payout, and never reports a release public or a payment settled without external evidence.

Artists and record labels. LabelLedger is sold to the company that distributes them, and an artist reaches it only through that company's portal, where the account holds no workspace membership at all. It is also not for a buyer who wants a storefront live in a week without deciding anything. The tenant chooses its navigation model, its modules, its vocabulary, its portals and its infrastructure, and those decisions are the product. LabelLedger is not a distributor and never competes with its own customers.

Two things, added together. The platform subscription starts at €499 a month for 5,000 active tracks and 5 admin seats, runs to €1,999 for 50,000 tracks and 30 seats, and continues into a custom enterprise tier. On top sits a service fee on net digital receipts: 8 percent falling to 5 percent by package on the Forward managed network, or 3 percent falling to 1.5 percent on partner direct DSP agreements. Artist and label portals are unlimited on every package. The initial term is 24 months, renewing every 12.

Through a delivery channel chosen per store. Each store is routed through LabelLedger's own pipeline relationship, through a collective channel, or through the tenant's own direct deal, so one release can ship to three stores on three different channels. The release is validated, packaged as DDEX ERN, and handed off. Acceptance requires a provider status evidence row, enforced by a database trigger. A target that succeeds records a handoff. It is never a claim that the release is public.

Yes. Storage is either first party or your own bucket on S3, R2, GCS, Backblaze or MinIO, and DSP routing is set per store. If your storage fails, the system falls back to first party automatically rather than dropping the delivery.

By refusing to mix them. Analytics is always scoped to exactly one currency and no conversion is ever applied. If your statements report in several, the screen says so and asks you to pick one instead of showing a total that would be wrong. 154 ISO 4217 codes are supported, with 0, 2 and 3 decimal exponents.

No. Whoever created or submitted a statement or a payout cannot approve it. Only the workspace owner can override that, only with a written reason, and the override is audited at high severity.

No. It authorises a payout, exports a payment instruction as CSV, and records the settlement once an operator confirms it happened outside the system, with an external reference that cannot be recorded twice.

Identity, navigation model, component language, page composition, module visibility, portals, the login door, vocabulary, and both outbound and inbound connections. What it cannot do is grant itself anything: navigation is resolved server side from permissions, and a stored config can only hide a module, never surface one.

There is no path to it. Portal accounts hold no workspace membership at all. Authorisation is relational, discovered from that account's own links, and runs in a context that never sets the operator tenant variable, so the isolation policies stay closed.