How to Create a BIMI SVG Tiny P/S File (2026 Guide)

Brand Indicators for Message Identification (BIMI) displays your organization’s logo next to authenticated messages in supported email clients. To publish a BIMI record, you must provide a logo file that conforms to a restricted XML profile called SVG Tiny Portable/Secure (P/S).

This article explains the requirements of the SVG Tiny P/S profile, the elements you must remove from your source file, and the methods you can use to produce a compliant logo for your Verified Mark Certificate (VMC) application.

The Security Rationale Behind SVG Tiny P/S

The W3C defined the SVG Tiny P/S profile to eliminate the security risks of rendering vector graphics inside email clients [1]. Standard SVG supports scripting, external resource loading, and network requests. An email client that renders standard SVG exposes recipients to cross-site scripting (XSS) attacks and tracking pixels embedded in the message body.

SVG Tiny P/S removes all dynamic and external capabilities. The result is a static, self-contained file that describes geometry only.

The Forbidden Elements

The following elements cause W3C validation to fail. A Certificate Authority rejects any VMC application that includes them.

Element Type	Reason for Prohibition
<script> tags	Prevents JavaScript execution and XSS attacks
<image> tags	Prevents embedding raster graphics (PNG/JPG) which can obscure malicious code
data:image URIs	Prevents Base64-encoded bitmap embedding
xlink:href	Prevents external network requests (tracking pixels)
Relative dimensions	Prevents layout shifting; width and height attributes must be removed
External CSS	Prevents external stylesheet injection

The Mathematical Requirements

The AuthIndicators Working Group defines geometric constraints that ensure the logo renders correctly across email clients, including clients that apply circular, square, or rounded-square masks [2].

1. The 1:1 Aspect Ratio

The logo must be square. Set the viewBox attribute to a 1:1 coordinate space, for example viewBox="0 0 100 100". Remove the width and height attributes. The viewBox alone controls scaling.

2. Solid Background Fill

Transparent backgrounds are not permitted. Email clients switch between light and dark themes, and a transparent logo can become invisible on either background. Include a solid <rect> element that covers the entire viewBox.

3. Required Metadata

Declare conformance in the root <svg> element by setting version="1.2" and baseProfile="tiny-ps". Include a <title> element to meet accessibility requirements.

How to Generate a Compliant File

Standard design tools, including Adobe Illustrator and Figma, do not export directly to SVG Tiny P/S. You have two options: sanitize the file manually, or use a conversion tool.

The Manual Method

To sanitize an SVG export by hand, open the file in a text editor and complete the following steps:

1. Remove all forbidden tags listed in the previous table.
2. Convert CSS styling to inline presentation attributes.
3. Recalculate the viewBox to a 1:1 ratio.
4. Add the required version, baseProfile, and <title> metadata.
5. Validate the output against the W3C SVG Tiny 1.2 schema.

Expect multiple validation passes. Small errors in attribute names or namespace declarations cause validation to fail.

The Automated Method

A conversion tool such as makeBIMI performs each step programmatically:

1. Vectorization: If you upload a raster image (PNG or JPG), the tool traces the pixels into vector paths.
2. Sanitization: The tool removes <script>, <image>, and external reference tags.
3. Geometry enforcement: The tool applies a 1:1 bounding box and a solid background fill.
4. Validation: The tool validates the output against the W3C SVG Tiny P/S schema.

The SVG file is a prerequisite for the VMC application. After you produce a compliant file, continue with the [DMARC enforcement](/knowledge/bimi-dmarc-requirement) audit and submit the file to a supported Certificate Authority.

References

[1] W3C. “SVG Tiny 1.2 Portable/Secure.” World Wide Web Consortium, https://www.w3.org/TR/SVGTiny12/ [2] AuthIndicators Working Group. “BIMI SVG Logo Requirements.” BIMI Group, https://bimigroup.org/svg-logo-requirements/

See also: BIMI records

---

This SVG guide covers one layer of the deployment. The full technical sequence is explained in BIMI: how it works.