Choose the right artwork

Use the brand mark approved for inbox display, not a screenshot or a raster image wrapped inside SVG. Plan a square viewBox and enough clear space for providers that crop to circles or rounded squares. Fine text and hairline details can disappear at mailbox-avatar sizes, so test the design near 20–24 CSS pixels as well as at large size.

Decide on a solid background where appropriate. Transparent artwork can look different in light and dark interfaces. A designer should own visual changes; technical conversion is not permission to alter a protected mark.

Produce the Portable/Secure profile

Current BIMI Group guidance requires SVG Tiny P/S. The root needs the expected Tiny profile/version and a square viewBox. Include a meaningful title; a description can improve accessibility in tools that expose it.

Remove scripts, animation, external links, external resources, embedded raster images, and other content outside the restricted profile. Convert text to paths when required by the approved workflow so display does not depend on remote fonts. Keep the file compact; BIMI Group guidance recommends no more than 32 kilobytes.

Do not hand-edit an unfamiliar SVG in production without validation. Use the BIMI Group’s maintained conversion/validation resources or another reviewed local pipeline, then inspect the resulting XML for unexpected references.

Validate safely

Run the file through a local profile validator with network access disabled. Parse XML with external entities disabled. Confirm MIME handling separately from file contents. Render it in a sandbox at several sizes and against light and dark backgrounds. Compare the visual result with the approved mark.

Store a checksum and versioned source so certificate requests and DNS records can be tied to the exact image. If a mark certificate embeds or identifies an image, changing the hosted logo may require a new certificate; do not assume that visually similar files are interchangeable.

Host a stable candidate

Publish the reviewed file at a stable HTTPS URL with Content-Type: image/svg+xml, no authentication, and no geo/IP or bot rule that blocks mailbox-provider retrieval. Avoid redirect chains. Fetch it from a controlled external vantage point and verify bytes against the approved checksum.

The SVG stage is complete when profile validation, security review, small-size visual review, brand approval, and hosted retrieval all refer to the same file. A browser rendering the image is not sufficient evidence of BIMI compatibility.