MemberDex
A white-label, multi-tenant member directory platform. One iOS app, one admin console, one branded experience per organization. Built end-to-end — iOS, web, backend, billing, ops.
A white-label, multi-tenant member directory platform. One iOS app, one admin console, one branded experience per organization. Built end-to-end — iOS, web, backend, billing, ops.
MemberDex started in a treatment room. My PT, Ashley Katzenback (DPT, CMTPT), mentioned in passing that managing the business-networking groups she belongs to was harder than it ought to be — every member's contact info tangled into the same iPhone Contacts list as every plumber, every friend, every old colleague. Hard to find anyone in the group when she needed to. Hard to keep current as people came and went. Three days later I sent her a prototype of MemberDex v0.1. Off we went.
What grew from that conversation is a single white-label SaaS for the same kind of community problem at scale — HOAs, faith groups, chambers of commerce, professional networks. Members get a branded native iOS app with their org's logo and color palette. Admins get a web console for member lifecycle, custom fields, billing, audit, and one-click backup. Everything runs from one App Store binary that picks the right org at runtime.
It's a small, sharp full-stack project: native Swift 6 client, React 19 admin SPA, Go backend with embedded SQLite, Stripe billing, Caddy + Hetzner ops. Built solo, end-to-end, and deliberately portable.
Row-level org isolation. One App Store binary serves every community. Super-admin can browse cross-org for support without leaving the app.
Logo upload with live preview, accent palette, community page editing, category chips. The app feels native to each organization.
Standard fields out of the box, or per-org custom field sets — chambers track different things than HOAs. Drag-and-drop reorder, bulk apply.
CSV import with drag-and-drop preview before commit. Invite tracking, last-login visibility, soft deactivation, tombstone messaging for removed users.
Email + password with HIBP breach check on signup, per-account TOTP 2FA, JWT access + DB-backed refresh with atomic rotation, rate limiting, public-key cert pinning in release builds.
Login, invite, admin, backup, restore, and billing events recorded per-org. Searchable, exportable, retained.
One-click archive download, atomic restore upload. Org admins control their own data.
Tiered subscriptions, setup fees, invoice items, webhooks. Self-service plan selection. Billing-aware feature gating.
Member rosters cached on device. Tap-to-call, tap-to-email, tap-to-map work without a connection. No tracking, no third-party SDKs.
Single-box production shape: one Hetzner VPS running Caddy as the TLS-terminating reverse proxy, the Go API
(memberdexd) as a static binary, and SQLite (WAL mode) as the database. The admin SPA builds to
static assets and is served same-origin behind Caddy — no CORS, no auth split-brain. The marketing site lives
separately on Cloudflare Pages.
async/await, URLSession — no third-party HTTP libsAPIPinningDelegategolang-jwt, bcrypt, uuidstripe-go/v82verify_local.sh gatedeploy_production.sh with safety checksAPIPinningDelegateWhenPasscodeSetThisDeviceOnlyiOS appearance setting (Light/Dark/System), splash scheme polish, cert pinning verification, App Store rejection log management. Pre-1.0 launch maturity work.
Systematic hardening across auth, transport, and public surface. Per-account TOTP 2FA with brute-force lockout. JWT parser pinned to HS256 (no algorithm confusion). iOS public-key pinning via APIPinningDelegate + Keychain tightened to WhenPasscodeSetThisDeviceOnly. HTTP security headers, Origin guard, returnURL allowlist. Public inbound forms get Cloudflare Turnstile + honeypot + 32 KiB body cap + per-IP / daily / dedup rate limits + disposable-email + link-density + botnet-template heuristics — backed by trusted-proxy CIDRs for accurate XFF, and a bounded rate-limiter map so attackers can't grow memory. Audit log on every privileged action. Privacy, Terms, and Subprocessors page rewritten for current best practices.
Admin can drop a CSV, see a row-by-row preview, reorder/map fields, then commit. Same drag-and-drop pattern used for field reordering.
Effective-price detail, plan tier overrides, setup-fee management. Self-service plan selection from the org admin side.
Soft-delete pattern for org logos with restore/permanent-delete affordances. Live brand preview during upload.