Zipper
ServicesPlansDocsSupport
Sign inCreate account
← Legal index

Security Overview

Effective 16 August 2026 · Last updated 16 August 2026

How Zipper isolates workspaces and protects the control plane.

1. Multi-tenant isolation

Every workspace is a row-level tenant. Dashboard queries are scoped by membership. Edge configuration is compiled per zone. One workspace cannot read another workspace’s rules, logs, or Portcullis secrets.

2. Authentication

Control-plane auth is delegated to Supabase Auth (email/password, magic link, and optional OAuth). Sessions use rotating refresh tokens in first-party cookies. We never authorize from user-editable user_metadata.

3. Portcullis

Challenge tokens are HMAC-signed, single-use, and short-lived. Siteverify must be called from your backend — browser-only checks are not sufficient. Secrets are shown once and stored as hashes.

4. Disclosure

Report vulnerabilities to security@tinyzipper.com. Please allow a reasonable period before public disclosure. Do not test The Moat with uncoordinated floods.

Zipper

An affordable Cloudflare alternative: CDN, WAF, edge compute, and bot checks. A Spatial Regal Technology platform by Spatial Regal Digital Ltd.

Product

  • Services
  • Pricing
  • Docs
  • vs Cloudflare
  • Cloudflare alternative
  • Workers alternative
  • Turnstile alternative
  • Create account
  • Support

Services

  • The Crown
  • The Keep
  • Portcullis
  • The Moat
  • The Herald
  • The Vault
  • The Scepter
  • The Watchtower

Legal

  • Terms
  • Privacy
  • Cookies
  • AUP
  • DPA
  • Security
  • Subprocessors
  • Billing
  • DMCA

© 2026 Spatial Regal Digital Ltd. Zipper is part of Spatial Regal Technology.

Powered by Spatial Regal · tinyzipper.com