Security Overview

Effective 16 August 2026 · Last updated 16 August 2026

How Zipper isolates workspaces and protects the control plane.

1. Multi-tenant isolation

Every workspace is a row-level tenant. Dashboard queries are scoped by membership. Edge configuration is compiled per zone. One workspace cannot read another workspace’s rules, logs, or Portcullis secrets.

2. Authentication

Control-plane auth is delegated to Supabase Auth (email/password, magic link, and optional OAuth). Sessions use rotating refresh tokens in first-party cookies. We never authorize from user-editable user_metadata.

3. Portcullis

Challenge tokens are HMAC-signed, single-use, and short-lived. Siteverify must be called from your backend — browser-only checks are not sufficient. Widget secrets are stored encrypted at rest, shown only to workspace operators in the dashboard, and can be rolled at any time.

4. Disclosure

Report vulnerabilities to security@tinyzipper.com. Please allow a reasonable period before public disclosure. Do not test The Moat with uncoordinated floods.