diff --git a/CHANGELOG.md b/CHANGELOG.md
index e998b14..73fa512 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,19 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows
 
 ## [Unreleased]
 
+### Added
+- **Site Identity — an admin screen for the site's brand.** A new first-party `identity` module adds a
+  **Site Identity** screen (under Settings) that finally surfaces the site **name** + **tagline** for
+  editing, plus a **logo** and **favicon** (chosen from the Media Library or uploaded, via the platform
+  media picker) and the **social profile URLs**. Everything writes to the config tier (live-override,
+  no deploy) — and it's wired to what already consumes it: the **favicon** is emitted into the head
+  (`rel="icon"` + `apple-touch-icon`, a single high-res square the browser scales — no derivative
+  soup), the **logo** feeds `Organization.logo` and the **socials** feed `Organization.sameAs` in the
+  JSON-LD. The screen has its **own ACL resource**, so access is grantable on its own — the seam for
+  letting each org's admin manage its own identity in a multi-tenant install. Config is written at
+  GLOBAL scope for now (the single site, guest-visible), isolated in one `_scope()` method so the
+  future multi-site module can flip it to per-org.
+
 ## [0.16.0-beta] — 2026-07-17
 
 ### Added
diff --git a/modules/identity/Bootstrap.php b/modules/identity/Bootstrap.php
new file mode 100644
index 0000000..5e5a395
--- /dev/null
+++ b/modules/identity/Bootstrap.php
@@ -0,0 +1,37 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity module bootstrap.
+ *
+ * First-party "Site Identity" surface — the admin screen that sets the site name, tagline, logo,
+ * favicon, and social links, all stored in the config tier (live-override, no deploy). It is a
+ * module (not core) so it carries its own ACL resource and Settings entry; the values it writes
+ * are plain core config, consumed by the layout (favicon), TigerSEO (Organization logo + sameAs),
+ * and anywhere `tiger.site.*` is read.
+ *
+ * Extending Zend_Application_Module_Bootstrap gives the module its resource autoloader, so
+ * Identity_Service_* / Identity_Form_* / Identity_Plugin_* load by convention; controllers load via
+ * the registered module dir; configs/acl.ini + languages/ are picked up by the core globs.
+ */
+class Identity_Bootstrap extends Zend_Application_Module_Bootstrap
+{
+    /** Contribute the favicon to the head (config-driven; fail-open). High stackIndex = after routing. */
+    protected function _initFavicon()
+    {
+        Zend_Controller_Front::getInstance()->registerPlugin(new Identity_Plugin_Favicon(), 91);
+    }
+
+    /** List Site Identity under the admin Settings tree (ACL-gated to Identity_AdminController). */
+    protected function _initAdminSettings()
+    {
+        Tiger_Admin_Settings::register([
+            'key'      => 'identity',
+            'label'    => 'Site Identity',
+            'icon'     => 'fa-fingerprint',
+            'href'     => '/identity/admin',
+            'resource' => 'Identity_AdminController',
+            'order'    => 10,
+        ]);
+    }
+}
diff --git a/modules/identity/configs/acl.ini b/modules/identity/configs/acl.ini
new file mode 100644
index 0000000..c8d699b
--- /dev/null
+++ b/modules/identity/configs/acl.ini
@@ -0,0 +1,21 @@
+; Site Identity ACL — a dedicated resource for the screen + its /api service, so access is
+; grantable on its own (the seam for letting an org's admin manage that org's site identity in
+; a multi-tenant install). Deny-by-default: without these allows the screen and save are refused.
+[production]
+
+acl.resources.identity_admin_ctrl.resource = "Identity_AdminController"
+acl.resources.identity_svc.resource         = "Identity_Service_Identity"
+
+acl.rules.identity_admin_ctrl.role       = "admin"
+acl.rules.identity_admin_ctrl.resource   = "Identity_AdminController"
+acl.rules.identity_admin_ctrl.permission = "allow"
+
+acl.rules.identity_svc.role       = "admin"
+acl.rules.identity_svc.resource   = "Identity_Service_Identity"
+acl.rules.identity_svc.permission = "allow"
+
+[staging : production]
+
+[testing : production]
+
+[development : production]
diff --git a/modules/identity/controllers/AdminController.php b/modules/identity/controllers/AdminController.php
new file mode 100644
index 0000000..a7d2f49
--- /dev/null
+++ b/modules/identity/controllers/AdminController.php
@@ -0,0 +1,56 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity_AdminController — the Site Identity screen (site name, tagline, logo, favicon, social
+ * links). Its own controller (and ACL resource), so access is grantable independently of the rest
+ * of the admin — the seam that lets a multi-tenant install hand each org's admin the keys to its
+ * own site identity. Thin per ADMIN.md: it renders the form pre-filled from the live config; the
+ * save is an /api call (Identity_Service_Identity).
+ */
+class Identity_AdminController extends Tiger_Controller_Admin_Action
+{
+    /**
+     * Admin shell (layout) comes from the base; keep the explicit init cascade.
+     *
+     * @return void
+     */
+    public function init()
+    {
+        parent::init();
+    }
+
+    /**
+     * Render the Site Identity form, pre-filled from the live config. The two media references
+     * (logo, favicon) are passed to the view separately — the picker field renders their inputs.
+     *
+     * @return void
+     */
+    public function indexAction()
+    {
+        $tiger  = Zend_Registry::get('Zend_Config')->get('tiger');
+        $site   = $tiger ? $tiger->get('site') : null;
+        $social = ($tiger && $tiger->get('seo')) ? $tiger->get('seo')->get('social') : null;
+
+        $g = static function ($node, $key, $default = '') {
+            return ($node && (string) $node->get($key) !== '') ? (string) $node->get($key) : $default;
+        };
+
+        $form = new Identity_Form_Identity();
+        $form->populate([
+            'site_name'        => $g($site, 'name', 'Tiger'),
+            'tagline'          => $g($site, 'tagline'),
+            'social_twitter'   => $g($social, 'twitter'),
+            'social_facebook'  => $g($social, 'facebook'),
+            'social_instagram' => $g($social, 'instagram'),
+            'social_linkedin'  => $g($social, 'linkedin'),
+            'social_youtube'   => $g($social, 'youtube'),
+            'social_github'    => $g($social, 'github'),
+        ]);
+
+        $this->view->title    = 'Site Identity — Tiger Admin';
+        $this->view->form     = $form;
+        $this->view->logoId   = $g($site, 'logo');
+        $this->view->faviconId = $g($site, 'favicon');
+    }
+}
diff --git a/modules/identity/forms/Identity.php b/modules/identity/forms/Identity.php
new file mode 100644
index 0000000..1f33cab
--- /dev/null
+++ b/modules/identity/forms/Identity.php
@@ -0,0 +1,55 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity_Form_Identity — the Site Identity form: the site's name + tagline and its social
+ * profile URLs (which feed Organization.sameAs in the JSON-LD). The logo + favicon are NOT
+ * declared here — they're media references rendered in the view via the media-picker field
+ * helper (their hidden inputs post with the form and the service reads them from $params).
+ * Social URLs are optional and lightly validated (a URL when present); nothing is required
+ * but the name.
+ *
+ * @api
+ */
+class Identity_Form_Identity extends Tiger_Form
+{
+    /**
+     * Declare the form's elements.
+     *
+     * @return array the element schema
+     */
+    protected function elements(): array
+    {
+        // Optional social URLs: ZF1 ships no URI validator, so a lenient http(s) regex — and because
+        // the field isn't required, Zend_Form only runs it when a value is actually present.
+        $url = static function () {
+            return [
+                'required'   => false,
+                'filters'    => ['StringTrim'],
+                'validators' => [['Regex', false, ['pattern' => '#^https?://.+#i']]],
+                'attribs'    => ['class' => 'form-control', 'placeholder' => 'https://…'],
+            ];
+        };
+
+        return [
+            ['text', 'site_name', [
+                'required'   => true,
+                'filters'    => ['StringTrim'],
+                'validators' => [['StringLength', false, [1, 191]]],
+                'attribs'    => ['class' => 'form-control', 'placeholder' => $this->_t('identity.field.site_name')],
+            ]],
+            ['text', 'tagline', [
+                'required'   => false,
+                'filters'    => ['StringTrim'],
+                'validators' => [['StringLength', false, [0, 191]]],
+                'attribs'    => ['class' => 'form-control', 'placeholder' => $this->_t('identity.field.tagline')],
+            ]],
+            ['text', 'social_twitter',   $url()],
+            ['text', 'social_facebook',  $url()],
+            ['text', 'social_instagram', $url()],
+            ['text', 'social_linkedin',  $url()],
+            ['text', 'social_youtube',   $url()],
+            ['text', 'social_github',    $url()],
+        ];
+    }
+}
diff --git a/modules/identity/languages/en/identity.php b/modules/identity/languages/en/identity.php
new file mode 100644
index 0000000..5c978f7
--- /dev/null
+++ b/modules/identity/languages/en/identity.php
@@ -0,0 +1,12 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity module — English strings. Semantic, owner-prefixed keys (identity.*). Loaded on top of
+ * core strings by the translate cascade; API response messages resolve these in the caller's locale.
+ */
+return [
+    'identity.saved'            => 'Site identity saved.',
+    'identity.field.site_name'  => 'e.g. Acme, Inc.',
+    'identity.field.tagline'    => 'A short line under the name',
+];
diff --git a/modules/identity/plugins/Favicon.php b/modules/identity/plugins/Favicon.php
new file mode 100644
index 0000000..fb34747
--- /dev/null
+++ b/modules/identity/plugins/Favicon.php
@@ -0,0 +1,89 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity_Plugin_Favicon — contributes the site favicon to the head registry. The favicon is core
+ * site identity (config `tiger.site.favicon`, a media id), not SEO, but like the SEO head tags it
+ * rides TigerZF's headLink registry so the layout renders it with no theme edit. A single high-res
+ * square source is emitted as both `rel="icon"` (browsers downscale it for every tab size) and
+ * `rel="apple-touch-icon"` (iOS) — the modern, derivative-free approach. Fail-open: a missing or
+ * unresolvable favicon simply emits nothing (the browser falls back to /favicon.ico if present).
+ */
+class Identity_Plugin_Favicon extends Zend_Controller_Plugin_Abstract
+{
+    /** Emit-once latch — the favicon is the same on every dispatch (incl. forwards). */
+    private static $_done = false;
+
+    /**
+     * @param  Zend_Controller_Request_Abstract $request
+     * @return void
+     */
+    public function preDispatch(Zend_Controller_Request_Abstract $request)
+    {
+        if (self::$_done) {
+            return;
+        }
+        self::$_done = true;
+
+        try {
+            $id = self::_config('site.favicon');
+            if ($id === '') {
+                return;
+            }
+            $url = self::_mediaUrl($id, $request);
+            if ($url === '') {
+                return;
+            }
+            $view = self::_view();
+            $view->headLink(['rel' => 'icon', 'href' => $url]);
+            $view->headLink(['rel' => 'apple-touch-icon', 'href' => $url]);
+        } catch (Throwable $e) {
+            // fail-open — the favicon must never break a request
+        }
+    }
+
+    /** Resolve a media id to an absolute (or root-relative) URL, or '' when unresolvable. */
+    private static function _mediaUrl($id, $request)
+    {
+        if (!class_exists('Tiger_Model_Media')) {
+            return '';
+        }
+        $model = new Tiger_Model_Media();
+        $row   = $model->findById($id);
+        if (!$row) {
+            return '';
+        }
+        $url = (string) $model->url($row->toArray());
+        if ($url !== '' && !preg_match('#^https?://#i', $url) && strpos($url, '/') !== 0) {
+            $url = '/' . ltrim($url, '/');   // keep it root-relative if the adapter returned a bare path
+        }
+        return $url;
+    }
+
+    /** A Zend_View to reach the head helpers (shares the process-wide placeholder registry). */
+    private static function _view()
+    {
+        if (Zend_Registry::isRegistered('Zend_View')) {
+            $v = Zend_Registry::get('Zend_View');
+            if ($v instanceof Zend_View_Interface) {
+                return $v;
+            }
+        }
+        return new Zend_View();
+    }
+
+    /** Read a `tiger.<dotKey>` config value with a default. */
+    private static function _config($dotKey, $default = '')
+    {
+        if (!Zend_Registry::isRegistered('Zend_Config')) {
+            return $default;
+        }
+        $node = Zend_Registry::get('Zend_Config')->get('tiger');
+        foreach (explode('.', $dotKey) as $seg) {
+            if (!($node instanceof Zend_Config)) { return $default; }
+            $node = $node->get($seg);
+            if ($node === null) { return $default; }
+        }
+        return is_scalar($node) ? (string) $node : $default;
+    }
+}
diff --git a/modules/identity/services/Identity.php b/modules/identity/services/Identity.php
new file mode 100644
index 0000000..ccb7243
--- /dev/null
+++ b/modules/identity/services/Identity.php
@@ -0,0 +1,90 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Identity_Service_Identity — the /api service behind the Site Identity screen. Validates the
+ * form, then writes the identity to the config tier (the live-override store, no deploy):
+ * the site name/tagline, the logo + favicon media references, and the social profile URLs
+ * that feed Organization.sameAs in the JSON-LD.
+ *
+ * Scope: writes at GLOBAL scope for now — the single site's identity, visible to guests on
+ * public pages (anonymous requests only receive GLOBAL config, by design; core stays
+ * multi-site-unaware). The scope lives in one place (`_scope()`) so the future multi-site
+ * module, which resolves the acting org per domain and loads that org's config for guests,
+ * can flip identity to per-org scoping without touching the rest of this service.
+ *
+ * @api
+ */
+class Identity_Service_Identity extends Tiger_Service_Service
+{
+    /** The config keys this screen owns — form field name => dot-notation config key. */
+    const KEYS = [
+        'site_name'        => 'tiger.site.name',
+        'tagline'          => 'tiger.site.tagline',
+        'social_twitter'   => 'tiger.seo.social.twitter',
+        'social_facebook'  => 'tiger.seo.social.facebook',
+        'social_instagram' => 'tiger.seo.social.instagram',
+        'social_linkedin'  => 'tiger.seo.social.linkedin',
+        'social_youtube'   => 'tiger.seo.social.youtube',
+        'social_github'    => 'tiger.seo.social.github',
+    ];
+
+    /**
+     * Save the site identity: validate, then persist every field to the config store.
+     *
+     * @param  array $params the posted form values (+ logo_media_id / favicon_media_id)
+     * @return void
+     */
+    public function save(array $params): void
+    {
+        if (!$this->_isAdmin()) {
+            $this->_error('core.api.error.not_allowed');
+            return;
+        }
+
+        $form = new Identity_Form_Identity();
+        if (!$form->isValid($params)) {
+            $this->_formErrors($form);
+            return;
+        }
+        $v = $form->getValues();
+
+        // Media references ride outside the form (the picker owns their hidden inputs); accept a
+        // media_id (36-char UUID) or empty to clear. Anything else is ignored — never trusted raw.
+        $logo    = self::_mediaId($params['logo_media_id']    ?? '');
+        $favicon = self::_mediaId($params['favicon_media_id'] ?? '');
+
+        try {
+            $this->_transaction(function () use ($v, $logo, $favicon) {
+                $cfg   = new Tiger_Model_Config();
+                [$scope, $scopeId] = $this->_scope();
+                foreach (self::KEYS as $field => $key) {
+                    $cfg->set($scope, $scopeId, $key, trim((string) ($v[$field] ?? '')));
+                }
+                $cfg->set($scope, $scopeId, 'tiger.site.logo',    $logo);
+                $cfg->set($scope, $scopeId, 'tiger.site.favicon', $favicon);
+            });
+            $this->_success([], 'identity.saved');
+        } catch (Throwable $e) {
+            $this->_error(APPLICATION_ENV !== 'production' ? $e->getMessage() : 'core.api.error.general');
+        }
+    }
+
+    /**
+     * The config scope for identity writes. GLOBAL today (the single site, guest-visible). The
+     * multi-site module overrides this to (SCOPE_ORG, <domain's org>).
+     *
+     * @return array [scope, scopeId]
+     */
+    protected function _scope()
+    {
+        return [Tiger_Model_Config::SCOPE_GLOBAL, ''];
+    }
+
+    /** A value that looks like a media UUID, else '' (clears the reference). */
+    private static function _mediaId($v)
+    {
+        $v = trim((string) $v);
+        return preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $v) ? $v : '';
+    }
+}
diff --git a/modules/identity/views/scripts/admin/index.phtml b/modules/identity/views/scripts/admin/index.phtml
new file mode 100644
index 0000000..1bf3b40
--- /dev/null
+++ b/modules/identity/views/scripts/admin/index.phtml
@@ -0,0 +1,124 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * Site Identity — the site's name, tagline, logo, favicon, and social links. ViewHelper-only form
+ * (the view owns markup); logo + favicon use the platform media picker (Choose from the Media
+ * Library or upload). Saving is an /api call to Identity_Service_Identity; the JSON response drives
+ * the feedback. Semantic Bootstrap only — no bespoke CSS (keeps it reskinnable), per ADMIN.md.
+ */
+$form = $this->form;
+$el   = function ($name) use ($form) { return $form->getElement($name); };
+$va   = $this->themeAssets;
+?>
+<div class="d-flex align-items-center justify-content-between mb-4">
+    <div>
+        <h1 class="h3 mb-1">Site Identity</h1>
+        <p class="text-body-secondary mb-0">Your site's name, logo, favicon, and social profiles — the brand that appears in browser tabs, search results, and social shares.</p>
+    </div>
+    <div class="text-nowrap">
+        <button type="button" id="identity-save" class="btn btn-primary"><i class="fa-solid fa-floppy-disk me-2"></i>Save</button>
+    </div>
+</div>
+
+<div id="identity-feedback"></div>
+
+<form id="identity-form" onsubmit="return false;" novalidate>
+    <?= $el('_csrf') ?>
+    <div class="row g-4">
+
+        <div class="col-lg-7">
+            <div class="card h-100">
+                <div class="card-header fw-semibold"><i class="fa-solid fa-fingerprint me-2"></i>Identity</div>
+                <div class="card-body">
+                    <div class="mb-3">
+                        <label class="form-label" for="<?= $this->escape($el('site_name')->getId()) ?>">Site name</label>
+                        <?= $el('site_name') ?>
+                        <div class="form-text">Shown in the site header and browser tab, and used as the default page title and brand name in search results.</div>
+                    </div>
+                    <div class="mb-0">
+                        <label class="form-label" for="<?= $this->escape($el('tagline')->getId()) ?>">Tagline</label>
+                        <?= $el('tagline') ?>
+                        <div class="form-text">A short line describing the site (optional).</div>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <div class="col-lg-5">
+            <div class="card h-100">
+                <div class="card-header fw-semibold"><i class="fa-solid fa-image me-2"></i>Logo &amp; favicon</div>
+                <div class="card-body">
+                    <div class="mb-4">
+                        <?= $this->mediaField('logo_media_id', $this->logoId, ['kind' => 'image', 'label' => 'Logo']) ?>
+                        <div class="form-text">Used for your brand in search results (Organization schema) and available to themes.</div>
+                    </div>
+                    <div class="mb-0">
+                        <?= $this->mediaField('favicon_media_id', $this->faviconId, ['kind' => 'image', 'label' => 'Favicon']) ?>
+                        <div class="form-text">The little icon in the browser tab. Use a <strong>square</strong> image — 512&times;512 or larger is ideal; the browser scales it down to every size it needs.</div>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <div class="col-12">
+            <div class="card">
+                <div class="card-header fw-semibold"><i class="fa-solid fa-share-nodes me-2"></i>Social profiles</div>
+                <div class="card-body">
+                    <p class="text-body-secondary small mb-3">Full URLs to your official profiles. These are published as your brand's verified links (schema.org <code>sameAs</code>) — leave any blank.</p>
+                    <div class="row g-3">
+                        <?php
+                        $socials = [
+                            'social_twitter'   => ['X / Twitter', 'fa-x-twitter'],
+                            'social_facebook'  => ['Facebook',    'fa-facebook'],
+                            'social_instagram' => ['Instagram',   'fa-instagram'],
+                            'social_linkedin'  => ['LinkedIn',    'fa-linkedin'],
+                            'social_youtube'   => ['YouTube',     'fa-youtube'],
+                            'social_github'    => ['GitHub',      'fa-github'],
+                        ];
+                        foreach ($socials as $name => $meta): ?>
+                            <div class="col-md-6">
+                                <label class="form-label" for="<?= $this->escape($el($name)->getId()) ?>"><i class="fa-brands <?= $meta[1] ?> me-2 text-body-secondary"></i><?= $this->escape($meta[0]) ?></label>
+                                <?= $el($name) ?>
+                            </div>
+                        <?php endforeach; ?>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+    </div>
+</form>
+
+<script src="<?= $this->asset($va . '/js/tiger.media-picker.js') ?>"></script>
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+    var form = document.getElementById('identity-form');
+    var fb   = document.getElementById('identity-feedback');
+
+    document.getElementById('identity-save').addEventListener('click', function () {
+        var btn = this;
+        fb.innerHTML = '';
+        form.querySelectorAll('.is-invalid').forEach(function (e) { e.classList.remove('is-invalid'); });
+        var fd = new URLSearchParams(new FormData(form));
+        fd.set('module', 'identity'); fd.set('service', 'identity'); fd.set('method', 'save');
+        TigerButton.run(btn, function () {
+            return fetch('/api', { method: 'POST', headers: { 'X-Requested-With': 'XMLHttpRequest' }, body: fd })
+                .then(function (r) { return r.json().catch(function () { return {}; }); });
+        })
+            .then(function (res) {
+                if (res && res.result === 1) { TigerDOM.notify(fb, 'Site identity saved.', { type: 'success' }); return; }
+                if (res && res.form) {
+                    Object.keys(res.form).forEach(function (field) {
+                        var input = form.querySelector('[name="' + field + '"]');
+                        if (input) { input.classList.add('is-invalid'); }
+                    });
+                }
+                var msgs = (res && res.messages) || [];
+                if (msgs.length) { msgs.forEach(function (m) { TigerDOM.notify(fb, m.message, { type: m.class, replace: false }); }); }
+                else { TigerDOM.notify(fb, 'Please fix the highlighted fields.', { type: 'error' }); }
+            })
+            .catch(function () { TigerDOM.notify(fb, 'Network error — please try again.', { type: 'error' }); });
+    });
+});
+</script>