Zipper
ServicesPlansDocsSupport
Sign inCreate account

Start

  • Honest production
  • What is not Cloudflare or Neon scale
  • Getting started
  • Quickstart in ten minutes
  • What to use Zipper for
  • Plans and quotas
  • Migrate from Cloudflare
  • Migrate from Vercel
  • Auth, tokens, and SSO
  • Control plane API

Delivery

  • The Crown
  • The Drawbridge
  • The Gallery
  • The Archives
  • Video Delivery

Security

  • The Keep
  • Portcullis
  • The Moat
  • The Scepter
  • Visitor Queue
  • Palace Guard

Compute

  • Edge Functions
  • Site Hosting
  • Job Queues
  • Edge AI

Data

  • The Cellar

Identity & access

  • The Herald
  • The Vault
  • The Throne Room
  • Origin Connect
  • Emails

Observe

  • The Watchtower

Start

  • Honest production
  • What is not Cloudflare or Neon scale
  • Getting started
  • Quickstart in ten minutes
  • What to use Zipper for
  • Plans and quotas
  • Migrate from Cloudflare
  • Migrate from Vercel
  • Auth, tokens, and SSO
  • Control plane API

Delivery

  • The Crown
  • The Drawbridge
  • The Gallery
  • The Archives
  • Video Delivery

Security

  • The Keep
  • Portcullis
  • The Moat
  • The Scepter
  • Visitor Queue
  • Palace Guard

Compute

  • Edge Functions
  • Site Hosting
  • Job Queues
  • Edge AI

Data

  • The Cellar

Identity & access

  • The Herald
  • The Vault
  • The Throne Room
  • Origin Connect
  • Emails

Observe

  • The Watchtower

Start here

What is not Cloudflare or Neon scale

Named services map Cloudflare- and Neon-shaped jobs onto multi-layered Global Server nodes. This page is the substrate catalog: what those nodes do not run, will not fake, and could still ship without claiming Cloudflare or Neon scale.

This is honest production on multi-layered Global Server nodes: application-layer DDoS and WAF, in-process cache, DNS-JSON (not port 53), and image delivery (not transcoding). It is not anycast or a GPU LLM farm.

Not this substrate

7

Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.

Honest refusal

7

The analogue exists so you can map a skill. Zipper will not fake the missing machine.

More Global Server nodes

3

Another node can shrink the gap. It still will not become anycast.

Shippable here

3

Could land in the Zipper process without claiming Cloudflare or Neon scale.

Not this substrate

Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.

AnalogueZipper runsMissing scale

Anycast PoP map

cloudflare · network

Unicast Global Server nodes. Visitors who point A at tinyzipper.com land on that address.Hundreds of anycast interchanges, Anycast BGP, Maglev-style nearest PoP.

Magic Transit / L3–L4 absorb

cloudflare · network · moat

The Moat: per-IP HTTP request cap on Zipper that returns 429.Packet scrubbing, SYN-flood absorb, BGP advertisement of customer prefixes.

Workers V8 isolates

cloudflare · runtime · functions

Edge Functions: timed node:vm on Zipper, default 30ms CPU, 32 KiB source.V8 isolate farm, bindings (KV, D1, R2, Durable Objects), 30s+ wall time on paid.

Workers AI / GPU LLM farm

cloudflare · runtime · ai

Edge AI: zip-fast / zip-large / embed-v1 against the Zipper corpus on CPU.Rented GPUs, general chatbot, model garden.

Cloudflare Durable Objects / Neon / Supabase Realtime bus

Cloudflare + Neon · data · cellar

The Cellar emits SSE on the Zipper process for the requesting hatch.A global pub/sub, cross-region ordering, millions of concurrent sockets.

Neon storage/compute split

neon · data · cellar

Encrypted overlay rows in shared tables on the control-plane database.Safekeeper + pageserver, copy-on-write storage pages, scale-to-zero compute.

Spectrum (arbitrary TCP/UDP)

cloudflare · network

HTTP(S) on Zipper, media from object storage, Cellar wire on loopback 15432.Proxy Minecraft, SSH, or random TCP through an anycast edge.

Honest refusal

The analogue exists so you can map a skill. Zipper will not fake the missing machine.

AnalogueZipper runsMissing scale

Authoritative DNS on UDP/TCP 53

cloudflare · protocol · herald

The Herald stores records and answers DNS-JSON at GET /dns-query.Nameservers, registrar NS cutover, DNSSEC, AXFR.

Polish / Image Resizing / AVIF

cloudflare · media · gallery

The Gallery serves original bytes from Zipper object storage; The Crown may cache them.On-the-fly resize, format convert, EXIF strip.

Stream encode + adaptive HLS

cloudflare · media · video

Video Delivery stores and plays the file you PUT in Zipper object storage.Transcode ladder, DRM, captions pipeline, global ingest.

Pages Functions / SSR Node

cloudflare · runtime · hosting

Site Hosting builds git repos to static files. Next.js needs output: "export".Long-running Node origin, server components at the edge, `pages.dev`-scale isolation.

Email Routing + outbound SMTP

cloudflare · ops · email

Emails stores inbound messages and routes mailbox / webhook / function. AES-256-GCM at rest.Outbound send, DKIM on the wire, a mail transfer agent.

Stock Postgres :5432

neon · data · cellar

DATABASE_URL talks to Zipper’s sealed-query PGWire adapter (127.0.0.1:15432).Host Postgres parser, Postgres roles, extensions, superuser.

Detonation sandbox / full AV engine

cloudflare · runtime · guard

Palace Guard: public hashes, EICAR, canary, web-shell names, MIME polyglots, ZIP headers — no inflate.Emulation sandbox, signature cloud, exploding zip bombs safely at hyperscale.

More Global Server nodes

Another node can shrink the gap. It still will not become anycast.

AnalogueZipper runsMissing scale

PoP CDN cache

cloudflare · ops · crown

The Crown: in-process Map on Zipper, 800 objects, TTL + SWR, gzip/brotli.Disk/SSD cache in every city, cache that survives process restart, regional purge.

Geo / latency load balancing

cloudflare · network · drawbridge

The Drawbridge health-checks origin pools across Global Server nodes.Steer by continent, steering via anycast, pool diversity across 300 cities.

R2 global replication

cloudflare · data · archives

The Archives: objects in Zipper object storage, metadata on the control plane, AES-256-GCM, HMAC URLs.Multi-region copies, public buckets with CF-scale egress, S3-complete API.

Shippable here

Could land in the Zipper process without claiming Cloudflare or Neon scale.

AnalogueZipper runsMissing scale

Persistent edge cache

cloudflare · ops · crown

Crown entries live in the Node process and drop on deploy or crash.Warm cache across restarts.

HTTP/3 / QUIC at the edge

cloudflare · protocol · vault

nginx terminates HTTP/2 in front of Zipper.QUIC to the visitor, UDP 443 anycast.

Full SQL surface (windows, extensions, pgvector…)

neon · data · cellar

Restricted Cellar dialect: tables, policies, seals, REST, RPC, snapshots.Arbitrary SQL, contrib extensions, stored procedures on the host.

Shape we already match

These jobs exist in production on Zipper. They are still not Cloudflare or Neon scale.

  • WAF HTTP rules

    The Keep evaluates managed and custom expressions before origin. It is application-layer, which is also what Moat does not pretend about packets.

  • Turnstile Siteverify JSON

    Portcullis is first-party: widget, proof-of-work, one-time token, POST /api/portcullis/v1/siteverify. Sensitive Zipper actions use it.

  • API rate limits

    The Scepter caps public APIs on Zipper. Pair with Portcullis on login. This is not Cloudflare API Shield ML.

  • Access identity proxy

    The Throne Room puts HMAC cookies in front of a private origin. The origin should not also have a public A record.

  • cloudflared outbound Tunnel

    Origin Connect dials Zipper outbound. No inbound hole. The connector is not an anycast pair.

  • Waiting Room

    Visitor Queue parks excess sessions on Zipper when a path exceeds its budget. Included, not a separate SKU.

  • Queues

    Job Queues are durable rows with AES-256-GCM payloads. At-least-once, dead-letter, not a global mesh.

  • HTTP analytics

    Watchtower is workspace-scoped request / WAF / Moat / Portcullis telemetry. Log push is a plan entitlement, not a SIEM product.

  • (none at Cloudflare)

    Palace Guard is Zipper’s edge antivirus. Cloudflare has no analogue; the gap is detonation, not existence.

How to use the catalog

A site that needs Magic Transit

You are absorbing volumetric L3 and also want Portcullis + workspace billing.

  1. Keep packet absorb where it lives. Zipper Moat will not take the NIC.
  2. Point web hostnames at tinyzipper.com for Keep, Crown, and Portcullis on HTTP.
  3. Do not change nameservers expecting The Herald to speak port 53.

An app that needs Neon's pageserver

You want copy-on-write storage clones and stock Postgres, plus Zipper's hatch.

  1. Use Neon or RDS for the engine that must be Postgres.
  2. Use The Cellar when the point is sealed queries, capability seals, and fail-closed Origin.
  3. Do not send tenant SQL expecting it to hit host Postgres. It will not.

Next: Getting started · All docs · Create a free account

Zipper

Honest production on multi-layered Global Server nodes: application-layer DDoS and WAF, in-process cache, DNS-JSON, and image delivery. A Spatial Regal Technology platform by Spatial Regal Digital Ltd.

Product

  • Services
  • Pricing
  • Docs
  • Honest production
  • Scale gaps
  • vs Cloudflare
  • Cloudflare alternative
  • Workers alternative
  • Turnstile alternative
  • Create account
  • Support

Services

  • The Crown
  • The Keep
  • Portcullis
  • The Moat
  • The Herald
  • The Vault
  • The Scepter
  • The Watchtower

Legal

  • Terms
  • Privacy
  • Cookies
  • AUP
  • DPA
  • Security
  • Subprocessors
  • Billing
  • DMCA

© 2026 Spatial Regal Digital Ltd. Zipper is part of Spatial Regal Technology.

Powered by Spatial Regal · tinyzipper.com