Security Overview

1. Multi-tenant isolation

Every workspace is a row-level tenant. Dashboard queries are scoped by membership. Edge configuration is compiled per zone. One workspace cannot read another workspace’s rules, logs, or Portcullis secrets.

2. Authentication

Control-plane auth runs on Zipper’s hosted auth service (email/password, magic link, and optional OAuth). Sessions use rotating refresh tokens in first-party cookies. We never authorize from user-editable user_metadata.

3. Portcullis

Challenge tokens are HMAC-signed, single-use, and short-lived. Siteverify must be called from your backend — browser-only checks are not sufficient. Widget secrets are stored encrypted at rest, shown only to workspace operators in the dashboard, and can be rolled at any time.

4. Vulnerability and incident reporting

Where the EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to software we make available in the EU, we follow its reporting duties, which have applied since 11 September 2026: actively exploited vulnerabilities and severe incidents are reported once through ENISA's Single Reporting Platform — an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days for a vulnerability or one month for an incident. The CRA's main product-security requirements apply from 11 December 2027.

In Ghana we cooperate with the Cyber Security Authority and the national CERT under the Cybersecurity Act, 2020 (Act 1038) — the Authority began full enforcement of its licensing and accreditation rules on 31 January 2026 — and personal data breaches are notified to the Data Protection Commission within 72 hours where Act 843 applies.

5. Disclosure

Report vulnerabilities to security@tinyzipper.com. Please allow a reasonable period before public disclosure. Do not test The Moat with uncoordinated floods.