Docs
Every service, explained.
Zipper (TinyZipper) is Spatial Regal Technology’s software platform at tinyzipper.com — Cloudflare-shaped edge, not the clothing fastener; honest production on Zipper’s global edge network: application-layer DDoS and WAF, in-process cache, DNS-JSON (not port 53), and image delivery (not transcoding), Edge Functions, The Stage, Portcullis, Palace Guard, Zipper Mail (transactional email + webmail), Zipper Pilot, The Armory, and The Cellar (world’s first sealed Postgres) — 34 named services, priced per workspace, not per domain. Start with getting started, then jump to the service you need. Each page has use cases and a working API example.
Type a Cloudflare product or a Zipper service name.
Start
Honest production
What Zipper actually runs: the global edge network, application-layer DDoS and WAF, in-process cache, DNS-JSON, and original-byte image delivery.
What is not Cloudflare or Neon scale
Named services map Cloudflare- and Neon-shaped jobs onto the global edge network. This page is the substrate catalog: what that edge does not run, will not fake, and could still ship without claiming Cloudflare or Neon scale.
Cloudflare in front of Zipper
Optional rented anycast for a website: orange-cloud the web hostname, Zipper stays the origin. Grey-cloud The Cellar. Zipper stays the origin on its global edge network.
Getting started
Create a Zipper account, add a hostname, point DNS, and put The Crown in front of origin — the simple Cloudflare alternative path.
Quickstart in ten minutes
The shortest path from signup to a proxied hostname and a working Portcullis widget.
What to use Zipper for
Practical use cases: SaaS apps, media sites, internal tools, and launches — a cheaper Cloudflare alternative for real workloads.
Plans and quotas
What each Zipper plan includes. Every plan has all named services; quotas and extras (SSO, log push, dedicated IPs) scale with the plan.
Migrate from Cloudflare
Move DNS, CDN, WAF, Workers, Pages, Turnstile, Tunnel, Email Routing, and Waiting Room to Zipper without a dual-running tax.
Migrate from Vercel
Move Next.js (and other) projects from Vercel to Zipper The Stage: git deploys, preview URLs, env vars, redirects, and instant rollback — on the same workspace bill as CDN and WAF.
Auth, tokens, and SSO
How Zipper workspace login, API tokens, Portcullis, SSO, and SCIM fit together.
Control plane API
Bearer tokens, idempotency, plan limits, and every v1 endpoint for Zipper — the Cloudflare API alternative for CDN, WAF, functions, and mail.
Using The Armory
How to use Zipper’s warrant mesh: create an app, sign someone in, spend a write cartridge, mint the next one. Spent warrants, hatch-bound sessions, musters, kit, and the roll — not a JWT farm.
Delivery
The Crown
The Crown remembers recent pages and files in Zipper’s own process. If a visitor asks for something we already have, they get it from memory. If not, Zipper fetches it from your site (or from object storage) and keeps a copy for a while. This is in-process cache on Zipper’s global edge network. This is a Cloudflare Cloudflare CDN / Caching alternative included on every Zipper plan.
The Drawbridge
The Drawbridge is a list of your origin servers. Zipper checks they answer. If one is sick, traffic goes to the others. You can weight them and keep a visitor on the same origin. This is a Cloudflare Cloudflare Load Balancing alternative included on every Zipper plan.
The Gallery
The Gallery stores the image you uploaded and sends those same bytes. The Crown may cache them. You can block other sites from hotlinking. Zipper does not resize, convert to AVIF/WebP, strip EXIF, or transcode. This is a Cloudflare Cloudflare Images (delivery only — not Polish) alternative included on every Zipper plan.
The Archives
The Archives keep files for your workspace. Metadata lives on Zipper; bytes sit in object storage. Every object is AES-256-GCM. You can give a time-limited signed URL, and you can purge a path from The Crown’s cache. Encryption cannot be turned off. This is a Cloudflare Cloudflare R2 + cache purge alternative included on every Zipper plan.
Video Delivery
Video Delivery stores the file you PUT and plays those bytes. Playback links can expire. The file is AES-256-GCM. Zipper does not encode, transcode, watermark, or build adaptive HLS. This is a Cloudflare Cloudflare Stream (storage + play — not encode) alternative included on every Zipper plan.
The Barbican CDN
The Barbican CDN is the first gate in front of every site Zipper hosts: before a request reaches the app, the gate checks whether it already holds a copy that is safe to reuse. Build assets are stored with the freshness Zipper already gave them — the gate never invents a lifetime. Private or no-store responses are never stored, signed-in sessions and live connections walk straight past the gate, and every response carries an X-Cache-Status header (HIT, MISS, or BYPASS) so you can see what happened. It sits at the edge of the Zipper network on this node — not a far-flung network of points of presence. When the gate is unsure, it fetches the origin instead of guessing. This is a Cloudflare CDN edge cache alternative included on every Zipper plan.
The Lookout
The Lookout checks your sites from Zipper’s edge on a schedule you set: does the page answer, how fast, and is the HTTPS certificate still valid and far from expiring. Every probe records status, latency, and the certificate’s remaining life, so you get a history rather than a single ping. It warns you well before a certificate runs out and raises an alert the moment a site stops answering, with the outage length once it recovers. Results stay inside your workspace. This is reachability and certificate watching for your own sites — not a global synthetic-testing network and not a status page you have to build yourself. Included on every Zipper plan.
Security
The Keep
The Keep looks at HTTP requests on Zipper. It blocks common attacks (SQL injection, script tricks, odd protocols) and your own rules. Your origin only sees what passes. This is an application-layer WAF, not a packet filter. This is a Cloudflare Cloudflare WAF alternative included on every Zipper plan.
Portcullis
Portcullis is Zipper’s own human check. Visitors see a short widget. Zipper looks at the browser, does a small puzzle, and hands your page a one-time token. You send that token to Siteverify. It is not a third-party CAPTCHA network. This is a Cloudflare Cloudflare Turnstile alternative included on every Zipper plan.
The Moat
The Moat is application-layer DDoS on Zipper. If one IP sends too many HTTP requests, Zipper answers 429. It does not swallow raw network packets. This is a Cloudflare Cloudflare DDoS (HTTP only — not Magic Transit) alternative included on every Zipper plan.
The Scepter
The Scepter sits in front of your APIs. It counts requests, checks a token, and can refuse a body that does not match a schema. Use it with Portcullis on login so password guessing is slower. This is a Cloudflare Cloudflare API Shield / Rate Limiting alternative included on every Zipper plan.
Visitor Queue
Visitor Queue is Zipper’s waiting room — it sits in front of your site on protected paths. When a path runs over its limit, extra visitors land on a holding page carrying your own brand: headline, message, accent colour, logo, their position in line, and an estimated wait. An admissions-per-minute cap paces the door so the origin sees a trickle instead of a stampede. A bot screen guards the line: real browsers queue normally, automation must solve a one-second proof-of-work, and hostile traffic — scanners, exploit probes, failed proofs — is held in a penalty box for a cool-off window. Signed-in teammates can skip the line. This is a Cloudflare Cloudflare Waiting Room alternative included on every Zipper plan.
Palace Guard
Palace Guard is Zipper’s antivirus and data-loss cordon at the gate. Eighteen engines inspect uploads and stored objects while they are still in flight — never detonating the sample. The classic layers match known malware hashes, EICAR, a Zipper canary, web-shell names, filename tricks, MIME polyglots, SVG/PDF/GIF smuggle, and ZIP headers without opening a bomb. The flagship layers add a Shannon-entropy sweep for packed or encrypted payloads, steganography detection for data stowed past a JPEG EOI / PNG IEND / GIF trailer, homoglyph detection for mixed-script filenames that spoof a trusted name, CVE exploit bodies (Log4Shell, Shellshock, Struts OGNL, Spring4Shell), and a secret scanner that surfaces leaked AWS, GitHub, Slack, Stripe, and Google keys plus PEM private keys and JWTs. Bad Gallery, Archives, Video, The Stage HTML, inbound mail, and function source are held. Quarantined hashes stay held when served. You can watch the scan on the dashboard. This is a Cloudflare edge file antivirus alternative included on every Zipper plan.
Compute
Edge Functions
Edge Functions run your JavaScript in a secure sandbox on Zipper with up to 60 seconds wall-clock time and 10 seconds CPU. Use Web APIs (fetch, crypto, TextEncoder, structuredClone), import npm packages, handle WebSocket connections, stream responses, and run on a schedule with cron. Bindings give your function KV, R2, D1, and Queues with the same call shapes Cloudflare Workers uses — backed by Zipper's own stores — plus Supabase-style database access through The Cellar. Supports fetch(), scheduled(), email(), and queue() handlers. Not a toy — production-grade serverless at the edge. This is a Cloudflare Cloudflare Workers alternative included on every Zipper plan.
The Stage
The Stage connects a git repo. Zipper builds it — static files or an SSR Node origin — puts the production branch up on your domain, gives every other branch its own stage with a preview URL, and lets you roll back to an earlier deploy. Secrets sit encrypted. Pair Edge Functions for rewrites and cron. Attach your own domain when you are ready. This is a Cloudflare Cloudflare Pages / Vercel alternative included on every Zipper plan.
Job Queues
Job Queues take webhooks, mail, and retries off the page request. Zipper retries failed jobs. Poison messages go to a dead-letter queue. Payloads are AES-256-GCM and cannot sit in plaintext. This is a Cloudflare Cloudflare Queues alternative included on every Zipper plan.
Edge AI
Edge AI answers from Zipper’s own help text (zip-fast, zip-large) and can embed text (embed-v1). It is the same engine as Zipper AI on Support. It is not a rented GPU and not a general chatbot. This is a Cloudflare Cloudflare Workers AI alternative included on every Zipper plan.
Zipper Wire
Zipper Wire is Zipper’s AI automation control plane. Publish a wire (workflow), attach a manual, schedule, or webhook trigger, and run linear steps: map, branch, grounded AI, HTTP (SSRF-guarded), Function invoke, Job enqueue, email draft, delay, and human approval. Wire orchestrates; it does not replace Job Queues, Edge Functions, Edge AI, Pilot bots, or The Cellar. Runs, step logs, and approvals stay on this process with Palace RBAC and Watchtower audit. Not Zapier’s global farm, not Temporal’s multi-service cluster, and not Cellar’s PGWire adapter. Included on every Zipper plan.
Zipper Forms
Zipper Forms is a form builder on the Zipper suite. Create forms with short text, email, dropdown, rating, file upload, and more. Publish with a slug, share the link, and collect responses. Wire integrations trigger automations, Mail sends notifications, and Drive stores uploads. Not Typeform's hosted SaaS, not Google Forms on someone else's cloud. Included on every Zipper plan.
Database
The Cellar
The Cellar is a sealed database for your app. You get a connection string, REST, live updates, and an import hatch. Paste a phpMyAdmin SQL dump (or CSV / JSON) and Zipper turns those tables into chambers. Browse and edit rows in Studio. Mint, revoke, and regenerate capability seals. Narrow a seal per user with scoped sessions (POST /session — tables and operations only). Every request runs under a 7.5s server budget with Server-Timing, and the official Cellar client retries 429/503 with Retry-After — no more client-side timeout hangs. Encryption and row rules stay on. SQL is Zipper’s dialect — it never hits the host Postgres parser. It is not Amazon RDS, not stock MySQL, and not a second Supabase. Live updates run on this Zipper process, not a world bus. Included on every Zipper plan.
The Armory
The Armory is Zipper’s warrant mesh for iOS, Android, and the web. You mint a hatch-bound session, then a warrant that names a rack. A write warrant is a spent cartridge — reuse returns 409. Musters hold sealed documents with revisions — every document is sealed at rest under its own per-muster key (za1), and shredding a muster destroys that key forever: the ciphertext husk remains as tamper-evident proof and a zd.… destruction receipt proves it. Vault seals (zv.…) link into an append-only notary chain. Kit is cordoned by Palace Guard, including JSON bodies. The roll is real SSE: writes publish put/patch/unput. Rotate anon and service keys from the dashboard anytime. Isolated runtimes keep each duty separate. Requests run under a 7.5s server budget with Server-Timing, and reads never pay for a vault re-seal. An official client (ArmoryClient) ships with cartridge-safe retries. This is not Firebase, not Appwrite Cloud, not FCM/APNs, and not Kubernetes. Without Docker the same twenty racks run in-process and still fail closed. Included on every Zipper plan.
The Mint
The Mint is The Cellar with an append-only ledger riding along in the same transaction: every accepted write posts a new assay entry, and each entry carries the fingerprint of the one before it — so an edited row breaks the chain and shows up immediately. Replay a table to any timestamp (AS-OF), export an incident window for an auditor, and ask for a signed receipt proving a row existed exactly as it was at a moment. Spend-once cartridge warrants from The Armory post one ledger entry and then expire, so a bulk import cannot quietly rewrite history. SQL, REST, live hatch, Studio, encryption, and row rules stay exactly as they are in The Cellar. Not a blockchain — no tokens, no mining, no public network: it is a signed ledger on your own database. Not Cloud SQL with separate audit logs bolted on the side — the ledger is part of the transaction, not a file that can go missing. Not a replacement for The Armory’s documents and crypto-shredding, and more than a plain Cellar once you need to prove your history. Included on every Zipper plan.
The Reliquary
The Reliquary keeps documents as sealed text: every field is encrypted on your side before it reaches Zipper, under its own per-document key that is wrapped by your workspace key (AES-256-GCM). Queries still work because rows are found by blind equality tokens — a keyed fingerprint of the value, never the value itself — and range lookups bucket the token so a search stays coarse. A custodian seal lets a named, logged, time-boxed key open a record when you must, and key rotation runs in the background, resealing old keys as it passes. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution. Honest limits, stated plainly: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns — and zero-knowledge is a direction, not a promise. Not SQL Server Always Encrypted, not a confidential-compute cluster, and not a secrets vault — this is your document store with the operator locked out of the contents. Included on every Zipper plan.
The Coffer
The Coffer holds short key-and-value pairs — feature flags, settings, counters, session fragments — in memory so reads and writes come back in milliseconds. It answers over a REST API and is also bound into Edge Functions, which means your app and your edge code always read the same values with no extra plumbing. Feature flags are built in: turn a feature on for everyone, for a fixed share of visitors, or for one workspace, and change it without a deploy. Values are scoped to your workspace and namespace, so one tenant never reads another’s keys. This is a small, fast coordination store for flags and hot counters — not a replacement for The Cellar when you need queries, relations, or durable documents. This is a Cloudflare Workers KV alternative included on every Zipper plan.
Support
Identity & access
The Herald
The Herald is where you keep hostname records. Apps look them up with GET /dns-query (JSON). Zipper does not listen on UDP/TCP 53, does not publish nameservers, and does not sign DNSSEC. This is a Cloudflare Cloudflare DNS-over-HTTPS JSON (not authoritative :53) alternative included on every Zipper plan.
The Vault
The Vault gets a certificate for each hostname, renews it, and keeps the private key off the tenant dashboard. You can also upload your own certificate. This is a Cloudflare Cloudflare SSL/TLS alternative included on every Zipper plan.
The Throne Room
The Throne Room puts a Zipper sign-in in front of an internal app. Only people in your workspace (with MFA if you require it) get through. The origin stays off the public internet. This is a Cloudflare Cloudflare Access (Zero Trust) alternative included on every Zipper plan.
Origin Connect
Origin Connect runs a small program on your server that dials Zipper. Zipper never needs an inbound hole. The Throne Room can then require sign-in. No public IP on the origin. This is a Cloudflare Cloudflare Tunnel alternative included on every Zipper plan.
Zipper Mail
Zipper Mail (also called Zipper Email) is transactional email from Zipper. Add a domain, publish SPF (include:_spf.tinyzipper.com), DKIM, and DMARC, verify DNS, then send with POST /api/v1/email/send (all plans) or SMTP at smtp.tinyzipper.com:587 on Starter+. Messages are DKIM-signed and relayed across Zipper’s global edge network. Attachments, batch, schedule, tags, webhooks, and one-click unsubscribe are built in. Inbound stores encrypted messages and routes to mailbox, webhook, or function. Webmail at mail.tinyzipper.com. Not a marketing blast tool — batches cap at 50 recipients per message. This is a Cloudflare Transactional ESP + inbound routing alternative included on every Zipper plan.
The Chancery
The Chancery is identity and access for your Zipper workspace, built on Palace RBAC rather than bolted on beside it. Resources sit in a simple hierarchy — workspace → project → service — and every request is judged by an explicit policy: who (a teammate, a key, an app) may do what (a console action or an API verb) to which resource, under which conditions (project, hostname, time window, or a required MFA claim). Deny always beats allow. Write a change, run it in the simulator against the last twenty-four hours of real audit events to see what it would have blocked or allowed, then publish with one click; policy history keeps the trail and rollback is one action. Ask the plain question — “who can reach The Cellar?” — and get the answer as a list. Honest limits, stated plainly: this is workspace policy, not an identity provider — no SAML or OIDC single sign-on, no directory sync, no organization-wide MFA mandate. It answers “what may happen here,” not “who are you.” Included on every Zipper plan.
The Safe-Conduct
The Safe-Conduct hands out privilege the way a gate hands out passes: temporarily. Write down what you need, why, and for how long (with a ticket if your workspace requires one). A named approver who is not you clears it — one approver by default, two if you require it. You then get a time-boxed pass that grants exactly the resources you asked for, revokes itself when the window ends, and records everything it touched in the audit trail: who asked, who approved, what opened, when it closed. If a project is on fire, break-glass requests still work — they just carry an automatic review after the fact. Honest limits, stated plainly: this is not a privileged access management product — no credential vaulting, no recorded sessions, no proxy in front of your SSH. It is a documented, expiring grant on top of Palace roles, not a standing admin key with a polite label. Included on every Zipper plan.
Observe
The Watchtower
The Watchtower is your log book. You see who hit Zipper, what The Keep blocked, cache hits, and Portcullis results. Other workspaces cannot see yours. This is a Cloudflare Cloudflare Analytics / Logpush alternative included on every Zipper plan.
The Chronicle
The Chronicle records page views for the sites Zipper hosts, right where the page is served, so counting never adds a round trip. You see visits over time, the pages people actually read, where they came from, and which device class they used — kept for your workspace alone. It sets no tracking cookies, follows nobody to other sites, and never shares a visitor identity. Events roll up into daily totals so history stays cheap to read, and you can drop raw events entirely and keep counts only. This is first-party analytics on your own hosting, not a third-party tracker with a script tag. Included on every Zipper plan.