MemberDex
A white-label, multi-tenant member directory platform. Native iOS and Android apps, one admin console, one branded experience per organization. Built end-to-end — iOS, Android, web, backend, billing, ops.
A white-label, multi-tenant member directory platform. Native iOS and Android apps, one admin console, one branded experience per organization. Built end-to-end — iOS, Android, web, backend, billing, ops.
MemberDex started in a treatment room. My PT, Ashley Katzenback (DPT, CMTPT), mentioned in passing that managing the business-networking groups she belongs to was harder than it ought to be — every member's contact info tangled into the same iPhone Contacts list as every plumber, every friend, every old colleague. Hard to find anyone in the group when she needed to. Hard to keep current as people came and went. Three days later I sent her a prototype of MemberDex v0.1. Off we went.
What grew from that conversation is a single white-label SaaS for the same kind of community problem at scale — business-networking groups, chambers of commerce, trade associations, HOAs, and country clubs. Members get a branded native app — iOS and Android — with their org's logo and color palette, a searchable directory, and an optional in-app news feed and community home page. Admins get a web console for member lifecycle, custom fields, billing, audit, engagement insights, and one-click backup. Each platform ships a single binary that picks the right org at runtime.
It's a small, sharp full-stack project: native Swift 6 and Kotlin 2.1 clients, React 19 admin SPA, Go backend with embedded SQLite, Stripe billing, Caddy + Hetzner ops. Built solo, end-to-end, and deliberately portable.
The Android client is now on Google Play — Kotlin 2.1 (K2) and Jetpack Compose with Material 3, talking to the same Go API over a certificate-pinned Retrofit/OkHttp stack. Same product, native idioms on each platform — hardware-backed biometric unlock, auth tokens sealed in the Android Keystore.
Row-level org isolation. One App Store binary serves every community. Super-admin can browse cross-org for support without leaving the app.
Logo upload with live preview, accent palette, community page editing, category chips. The app feels native to each organization.
Standard fields out of the box, or per-org custom field sets — chambers track different things than HOAs. Drag-and-drop reorder, bulk apply.
CSV import with drag-and-drop preview before commit. Invite tracking, last-login visibility, soft deactivation, tombstone messaging for removed users.
Phishing-resistant WebAuthn passkeys and enterprise SSO (OIDC + SAML) for the admin console, HIBP breach check on signup, per-account TOTP 2FA, JWT access + DB-backed refresh with atomic rotation, rate limiting, public-key cert pinning in release builds.
Login, invite, admin, backup, restore, and billing events recorded per-org. Searchable, exportable, retained.
One-click archive download, atomic restore upload. Org admins control their own data.
Tiered subscriptions, setup fees, invoice items, webhooks. Self-service plan selection. Billing-aware feature gating.
Member rosters cached on device. Tap-to-call, tap-to-email, tap-to-map work without a connection. No tracking, no third-party SDKs.
Optional in-app announcements with an unread badge, plus a community home page pinning links to meetings, events, and forms. Toggle on per org.
See who's active and who's gone quiet, so admins can nurture a community instead of guessing. Retention email tooling built on the same signals.
Keep vendors and sponsors in the directory without counting them against the member ceiling. Shared team notes add private context on a member, visible to admins only.
Single-box production shape: one Hetzner VPS running Caddy as the TLS-terminating reverse proxy, the Go API
(memberdexd) as a static binary, and SQLite (WAL mode) as the database. The admin SPA builds to
static assets and is served same-origin behind Caddy — no CORS, no auth split-brain. The marketing site lives
separately on Cloudflare Pages.
async/await, URLSession — no third-party HTTP libsAPIPinningDelegateminSdk 26 · targetSdk 35 · JDK 21BiometricPrompt unlock · Coil 3 imagerygolang-jwt, bcrypt, uuidstripe-go/v82assembleDebug + unit testsverify_local.sh gatedeploy_production.sh with safety checksAPIPinningDelegateWhenPasscodeSetThisDeviceOnlyTwo authentication tracks landed for the admin console. WebAuthn/FIDO2 passkeys give phishing-resistant, passwordless and usernameless sign-in — discoverable credentials with user-verification required, so Face ID / Touch ID / Windows Hello / a hardware key just works and the authenticator picks the account. The private key never leaves the device's secure element; each stored credential carries a signature counter, and a counter regression (a cloned authenticator's tell) is refused and audited. The ceremony lives in an isolated Go package so only this product links the WebAuthn dependency — the same seam used for SSO. Enterprise SSO covers OIDC (Okta, Entra, Google Workspace, Auth0) and SAML 2.0, configured per organization against a verified email domain with just-in-time admin provisioning that can never escalate a role. Both are strictly additive — password and TOTP stay live, so a lost device or a misconfigured IdP never locks anyone out.
A founder fills a form and the backend provisions a pending org plus an admin account with a set-password email — they can brand the space and import members while pending, and a single operator approval unlocks member invites, billing, and the trial. Closed the last fully-manual step in onboarding.
Per-org toggle-on features: an in-app news feed with unread badges, a pinned community home page, and engagement insights that surface active vs. dormant members — with retention-email tooling built on the same signals.
Native Kotlin 2.1 / Jetpack Compose client (Material 3, multi-module Gradle, version catalog) against the same Go API — certificate-pinned Retrofit/OkHttp transport, AES-256/GCM auth tokens sealed in the Android Keystore, hardware-bound biometric unlock, and TOTP 2FA. Built to parity with the iOS app, native idioms throughout.
iOS appearance setting (Light/Dark/System), splash scheme polish, cert pinning verification, App Store rejection log management. Pre-1.0 launch maturity work.
Systematic hardening across auth, transport, and public surface. Per-account TOTP 2FA with brute-force lockout. JWT parser pinned to HS256 (no algorithm confusion). iOS public-key pinning via APIPinningDelegate + Keychain tightened to WhenPasscodeSetThisDeviceOnly. HTTP security headers, Origin guard, returnURL allowlist. Public inbound forms get Cloudflare Turnstile + honeypot + 32 KiB body cap + per-IP / daily / dedup rate limits + disposable-email + link-density + botnet-template heuristics — backed by trusted-proxy CIDRs for accurate XFF, and a bounded rate-limiter map so attackers can't grow memory. Audit log on every privileged action. Privacy, Terms, and Subprocessors page rewritten for current best practices.
Admin can drop a CSV, see a row-by-row preview, reorder/map fields, then commit. Same drag-and-drop pattern used for field reordering.
Effective-price detail, plan tier overrides, setup-fee management. Self-service plan selection from the org admin side.
Soft-delete pattern for org logos with restore/permanent-delete affordances. Live brand preview during upload.