Your own (sub)domain

Every installation runs at its own address. That can be a subdomain of the MSP, like rollout.company.com, or a subdomain of ours, like company.rollout365.com. Both are equally secure; the difference is who manages the DNS.

Choose your address

	Subdomain of the MSP	Subdomain of ours
Example	`rollout.acme.com`	`acme.rollout365.com`
DNS	The MSP creates one CNAME record	We create the record
Advantage	Employees and clients see their own IT partner's domain	No dependency on the client's DNS; live right away
HTTPS certificate	Automatic	Automatic

Why this is secure

Installations share no cookies or sessions. Rollout sets no cookies on the parent domain, and a sign-in session belongs to exactly one address. Even with every MSP on *.rollout365.com, one can't reach another's session.

What happens when someone opens your address

1
rollout.acme.com
employee opens the booking link
2
DNS: CNAME
points to Vercel
3
Vercel
knows this project's domain
4
HTTPS certificate
automatic, always valid
5
Rollout
with the MSP's branding

Connect the domain

Add the domain in Vercel
Project → Settings → Domains → Add → rollout.acme.com. Vercel shows which record is needed.
Create the CNAME record
At the domain's DNS provider (for a subdomain of the MSP, the MSP does this):
Type Name Value
CNAME rollout the value Vercel shows
After a few minutes Vercel shows Valid Configuration and the certificate is there.
Update APP_URL and deploy
APP_URL=https://rollout.acme.com (no trailing slash) and redeploy. Links in emails, the client portal and the consent flow always use this address.
Supabase: where sign-in may return to
Authentication → URL Configuration:
- Site URL: https://rollout.acme.com
- Redirect URLs: https://rollout.acme.com/auth/callback
Entra: where clients return after consent
Rollout – Readiness → Authentication → Web → Redirect URIs: https://rollout.acme.com/toestemming

Type	Name	Value
`CNAME`	`rollout`	the value Vercel shows

Checklist per domain

Everything must use the same address, or sign-in or the client connection fails.

Where	Setting
Vercel → Domains	Domain added and Valid Configuration
Vercel → variables	`APP_URL=https://<domain>`, then redeployed
Supabase → URL Configuration	Site URL and Redirect URL `https://<domain>/auth/callback`
Entra → Rollout – Readiness	Redirect URI `https://<domain>/toestemming`
Check	`/api/ready` returns `"ready": true`; sign-in works; a booking link works in a private window

Links always point to the fixed address

Rollout never builds links from the address someone used to open the site, always from APP_URL. So nobody can point them at another domain with a forged Host header.

Changing the domain

Add the new domain and run through the checklist. Only remove the old address once everything works. Invitations already sent contain the old address: keep the old domain redirecting for a while (Vercel → Domains → Redirect to), or resend the invitations.

Retiring a domain

An MSP leaves, or the address changes for good? Remove the domain from Vercel and have the CNAME record deleted. A record left pointing at a project that no longer exists is something others may try to take over (subdomain takeover).

Self-hosting

Running Rollout on your own server? Then Caddy takes care of the certificate. You can also put administration on a separate, internal-only address. See Self-hosting.