Your clients' accounts, kept like keys.
Indably holds sign-ins to the accounts your brands live on. It's built by the team behind Xee Security, who test other companies' systems for a living, and it's held to the same standard.
- Network sign-ins
- Every network token is encrypted at rest, never shown, never written to logs, and never put in a web address. Disconnect an account and its token is erased at once.
- Signing in
- Passkeys (your fingerprint, face or device PIN) or a password checked against known breaches, plus an authenticator app for a second step.
- Who can do what
- Four roles, set per brand. Every brand's data is kept apart from every other's, checked on every request.
- Activity log
- Every change, with who made it and when, kept for three years and visible to Owners and Managers.
- Payments
- Cards are typed on PayFast's page. Indably never sees a card number.
- Your media
- Location and camera details are removed from photos when you upload them. Networks fetch media through short-lived signed links.
- The web app
- A strict content security policy with no third-party scripts, and protection against forged requests on every form.
- Where it runs
- Hosted in South Africa. Personal information is handled in line with POPIA; the privacy notice lists what is kept and for how long.
Found something?
If you think you've found a security problem in Indably, email security@indably.com. We'll answer within two working days and keep you posted until it's fixed.
Next week, planned by Friday.
Every feature switched on from the first day. No card until you decide to stay.