05.08 Login Screen Branding
Replace the SimpleRisk logo and tagline with your own, and publish a system use notice on the login screen. The logo carries through to the top bar, the upgrade page, and the questionnaire pages your external respondents see. Configured on Settings > Preferences > System; requires the Customization Extra.
Requires: Customization Extra
The three branding fields render on Settings > Preferences > System whether or not the Extra is active, but they are read-only without it — marked with a Locked badge and a link to the Extra's page on simplerisk.com. Without the Extra, SimpleRisk ignores any values already stored and shows its own logo and tagline.
Why this matters
Two different problems land on the same screen, and it helps to keep them apart.
One is recognition. Your users reach SimpleRisk through a bookmark, an SSO tile, or a link in an email, and the page that greets them says SimpleRisk. Internally that's fine. It's less fine when the people signing in are contractors, auditors, or the third parties you've asked to complete a vendor questionnaire — for them the screen is unfamiliar software at an unfamiliar address, and a logo they recognize is what tells them they are in the right place. It is a weak anti-phishing signal too: a login page carrying your organization's mark is one more thing an attacker has to reproduce.
The other is compliance, and it's the reason this feature exists in the shape it does. NIST 800-53 AC-8 (System Use Notification) requires that a system display a notification message before granting access — the "this is a private system, use is monitored" text you have seen on government and defense systems. CMMC carries an equivalent, DISA STIGs are specific about the wording, and plenty of internal policies require it whether or not a framework does. If you operate SimpleRisk under any of those, the login screen is where that notice has to appear, and until now there was nowhere to put it.
Worth setting expectations up front: this is branding, not white-labelling. Your logo replaces SimpleRisk's on the screens below, but the product still identifies itself as SimpleRisk in the page title, the help menu, and the footer. If you're looking to resell SimpleRisk under your own name, this isn't that feature.
What the three fields do
All three live under Login screen branding on Settings > Preferences > System.
Custom logo replaces the SimpleRisk wordmark. Upload a PNG, JPG, GIF, or WebP up to 1 MB and 2000x2000 pixels. It is displayed at up to 260x64, so supply roughly 520x128 if you want it sharp on high-density screens.
One thing to get right before you upload: the top bar and the login panel are dark charcoal. Most logos arrive from a brand team as dark ink on a transparent or white background, and one of those uploaded here is close to invisible. Use the light or reversed variant your brand guidelines almost certainly include.
Login tagline replaces the line under the wordmark on the login panel. One short line reads best — the panel sizes the type to fit, but a paragraph pasted here will end up small enough to be ignored.
System use notice is the AC-8 field. It appears on the login screen underneath the tagline, before anyone signs in. It accepts limited formatting through a small editor: bold, italic, underline, bulleted and numbered lists, and three text sizes.
Links and images aren't available, and it's worth knowing why rather than filing it as a missing feature. This text renders on a page that unauthenticated visitors can reach. A link there sits on your genuine login URL wrapped in your genuine branding, which is a considerably better phishing lure than any email; an image is a network request fired at every visitor before they have identified themselves. If your notice needs to point at a full acceptable-use policy, name where it lives rather than linking to it: "The full policy is on the intranet under Security > Acceptable Use."
Where the branding appears
Login screen
- Logo: Yes
- Tagline: Yes
- Notice: Yes
Password reset and forced password change
- Logo: Yes
- Tagline: Yes
- Notice: Yes
Multi-factor prompt and enrollment
- Logo: Yes
- Tagline: Yes
- Notice: Yes
Top bar, after signing in
- Logo: Yes
- Tagline: —
- Notice: —
Database upgrade page
- Logo: Yes
- Tagline: —
- Notice: —
Public questionnaires and shared results
- Logo: Yes
- Tagline: —
- Notice: —
Healthcheck page
- Logo: Yes
- Tagline: —
- Notice: —
The questionnaire rows are the ones administrators tend to overlook, and they may matter most. When you send a vendor assessment to a third party, the page they open carries your logo — which is the audience least likely to recognize SimpleRisk's.
Setting it up
- Confirm the Customization Extra is active. The Settings hub has a Customization Extra tile that shows its state; if the branding fields carry a Locked badge, it is not active.
- Go to Settings > Preferences, and stay on the System tab.
- Scroll to Login screen branding.
- For the logo, click Choose File and pick your image. Nothing uploads yet.
- Type your tagline, if you want one.
- Write the system use notice in the editor. Use the size control for emphasis rather than pasting formatted text from Word, which brings markup that gets stripped on save.
- Click Update.
- Sign out and look at the login screen. Don't skip this: the editor previews the notice on a dark background so you can judge contrast, but the panel is the only place you see the real result.
To undo any of it, clear the field. An empty field means "use the SimpleRisk default", so clearing the tagline restores SimpleRisk's, and ticking Remove the logo restores the SimpleRisk wordmark. An empty notice shows no notice at all. This is also why activating the Extra changes nothing visible until you configure something.
What happens when the Extra lapses
If Customization is deactivated — a licence that expires, an Extra switched off during troubleshooting — all three revert to the SimpleRisk defaults. The values stay in the database and come back when the Extra is reactivated, but they stop rendering in the meantime.
Plan for this if you are using the notice to satisfy AC-8. A lapsed licence silently removes a control your assessor believes is in place, and nothing warns you. If SimpleRisk is in scope for a framework that requires a system use notification, put the Customization Extra's renewal on the same calendar as the rest of your evidence review.
Common pitfalls
Uploading a dark logo. The most common one, and it looks like a bug: the top bar goes blank. Check whether your file is dark-on-transparent before assuming something's broken.
Expecting SVG to work. SimpleRisk accepts PNG, JPG, GIF, and WebP, and refuses SVG. An SVG can carry executable script, and one served from your own domain would run with your users' session. A crisper logo isn't worth that. Export a PNG at twice the display size instead.
Pasting a formatted notice. Copying from Word or a wiki brings a payload of markup that gets stripped when you save, and what you get back can be missing structure you thought you had. Paste as plain text, then apply bold and lists in the editor.
Treating the editor's toolbar as the rule. The toolbar shows what you can add; the server decides what gets stored. Paste content containing links or images and they'll be gone after saving. That's by design, not an editor bug.
Assuming a large logo gets scaled for you. The image is stored exactly as uploaded and constrained by the display, so an oversized file is downloaded in full by every visitor to your login page and then shrunk. Export it near the display size.