Security Overview
Effective 16 August 2026 · Last updated 16 August 2026
How Zipper isolates workspaces and protects the control plane.
1. Multi-tenant isolation
Every workspace is a row-level tenant. Dashboard queries are scoped by membership. Edge configuration is compiled per zone. One workspace cannot read another workspace’s rules, logs, or Portcullis secrets.
2. Authentication
Control-plane auth is delegated to Supabase Auth (email/password, magic link, and optional OAuth). Sessions use rotating refresh tokens in first-party cookies. We never authorize from user-editable user_metadata.
3. Portcullis
Challenge tokens are HMAC-signed, single-use, and short-lived. Siteverify must be called from your backend — browser-only checks are not sufficient. Secrets are shown once and stored as hashes.
4. Disclosure
Report vulnerabilities to security@tinyzipper.com. Please allow a reasonable period before public disclosure. Do not test The Moat with uncoordinated floods.