Docs
Every service, explained.
Zipper (TinyZipper) is Spatial Regal Technology’s Cloudflare-shaped edge at tinyzipper.com. honest production on multi-layered Global Server nodes: application-layer DDoS and WAF, in-process cache, DNS-JSON (not port 53), and image delivery (not transcoding), Edge Functions, Site Hosting, Portcullis, Palace Guard, Zipper Mail (transactional email + webmail), Zipper Pilot, The Armory, and The Cellar (world’s first sealed Postgres) — 31 named services, priced per workspace, not per domain. Start with getting started, then jump to the service you need. Each page has use cases and a working API example.
Type a Cloudflare product or a Zipper service name.
Start
Honest production
What Zipper actually runs: multi-layered Global Server nodes, application-layer DDoS and WAF, in-process cache, DNS-JSON, and original-byte image delivery.
What is not Cloudflare or Neon scale
Named services map Cloudflare- and Neon-shaped jobs onto multi-layered Global Server nodes. This page is the substrate catalog: what those nodes do not run, will not fake, and could still ship without claiming Cloudflare or Neon scale.
Cloudflare in front of Zipper
Optional rented anycast for a website: orange-cloud the web hostname, Zipper stays the origin. Grey-cloud The Cellar. Zipper stays the origin on Global Server nodes.
Getting started
Create a Zipper account, add a hostname, point DNS, and put The Crown in front of origin — the simple Cloudflare alternative path.
Quickstart in ten minutes
The shortest path from signup to a proxied hostname and a working Portcullis widget.
What to use Zipper for
Practical use cases: SaaS apps, media sites, internal tools, and launches — a cheaper Cloudflare alternative for real workloads.
Plans and quotas
What each Zipper plan includes. Every plan has all named services; quotas and extras (SSO, log push, dedicated IPs) scale with the plan.
Migrate from Cloudflare
Move DNS, CDN, WAF, Workers, Pages, Turnstile, Tunnel, Email Routing, and Waiting Room to Zipper without a dual-running tax.
Migrate from Vercel
Move Next.js (and other) projects from Vercel to Zipper Site Hosting: git deploys, preview URLs, env vars, redirects, and instant rollback — on the same workspace bill as CDN and WAF.
Auth, tokens, and SSO
How Zipper workspace login, API tokens, Portcullis, SSO, and SCIM fit together.
Control plane API
Bearer tokens, idempotency, plan limits, and every v1 endpoint for Zipper — the Cloudflare API alternative for CDN, WAF, functions, and mail.
Using The Armory
How to use Zipper’s warrant mesh: create an app, sign someone in, spend a write cartridge, mint the next one. Spent warrants, hatch-bound sessions, musters, kit, and the roll — not a JWT farm.
Delivery
The Crown
The Crown remembers recent pages and files in Zipper’s own process. If a visitor asks for something we already have, they get it from memory. If not, Zipper fetches it from your site (or from object storage) and keeps a copy for a while. This is in-process cache on multi-layered Global Server nodes. This is a Cloudflare Cloudflare CDN / Caching alternative included on every Zipper plan.
The Drawbridge
The Drawbridge is a list of your origin servers. Zipper checks they answer. If one is sick, traffic goes to the others. You can weight them and keep a visitor on the same origin. This is a Cloudflare Cloudflare Load Balancing alternative included on every Zipper plan.
The Gallery
The Gallery stores the image you uploaded and sends those same bytes. The Crown may cache them. You can block other sites from hotlinking. Zipper does not resize, convert to AVIF/WebP, strip EXIF, or transcode. This is a Cloudflare Cloudflare Images (delivery only — not Polish) alternative included on every Zipper plan.
The Archives
The Archives keep files for your workspace. Metadata lives on Zipper; bytes sit in object storage. Every object is AES-256-GCM. You can give a time-limited signed URL, and you can purge a path from The Crown’s cache. Encryption cannot be turned off. This is a Cloudflare Cloudflare R2 + cache purge alternative included on every Zipper plan.
Video Delivery
Video Delivery stores the file you PUT and plays those bytes. Playback links can expire. The file is AES-256-GCM. Zipper does not encode, transcode, watermark, or build adaptive HLS. This is a Cloudflare Cloudflare Stream (storage + play — not encode) alternative included on every Zipper plan.
The Barbican CDN
The Barbican CDN is the first gate in front of every site Zipper hosts: before a request reaches the app, the gate checks whether it already holds a copy that is safe to reuse. Build assets are stored with the freshness Zipper already gave them — the gate never invents a lifetime. Private or no-store responses are never stored, signed-in sessions and live connections walk straight past the gate, and every response carries an X-Cache-Status header (HIT, MISS, or BYPASS) so you can see what happened. It sits at the edge of the Zipper network on this node — not a far-flung network of points of presence. When the gate is unsure, it fetches the origin instead of guessing. This is a Cloudflare CDN edge cache alternative included on every Zipper plan.
Security
The Keep
The Keep looks at HTTP requests on Zipper. It blocks common attacks (SQL injection, script tricks, odd protocols) and your own rules. Your origin only sees what passes. This is an application-layer WAF, not a packet filter. This is a Cloudflare Cloudflare WAF alternative included on every Zipper plan.
Portcullis
Portcullis is Zipper’s own human check. Visitors see a short widget. Zipper looks at the browser, does a small puzzle, and hands your page a one-time token. You send that token to Siteverify. It is not a third-party CAPTCHA network. This is a Cloudflare Cloudflare Turnstile alternative included on every Zipper plan.
The Moat
The Moat is application-layer DDoS on Zipper. If one IP sends too many HTTP requests, Zipper answers 429. It does not swallow raw network packets. This is a Cloudflare Cloudflare DDoS (HTTP only — not Magic Transit) alternative included on every Zipper plan.
The Scepter
The Scepter sits in front of your APIs. It counts requests, checks a token, and can refuse a body that does not match a schema. Use it with Portcullis on login so password guessing is slower. This is a Cloudflare Cloudflare API Shield / Rate Limiting alternative included on every Zipper plan.
Visitor Queue
Visitor Queue holds people on a waiting page when a path is over its limit. They see an estimated wait. Signed-in teammates can skip the line. This is a Cloudflare Cloudflare Waiting Room alternative included on every Zipper plan.
Palace Guard
Palace Guard is Zipper’s antivirus and data-loss cordon at the gate. Eighteen engines inspect uploads and stored objects while they are still in flight — never detonating the sample. The classic layers match known malware hashes, EICAR, a Zipper canary, web-shell names, filename tricks, MIME polyglots, SVG/PDF/GIF smuggle, and ZIP headers without opening a bomb. The flagship layers add a Shannon-entropy sweep for packed or encrypted payloads, steganography detection for data stowed past a JPEG EOI / PNG IEND / GIF trailer, homoglyph detection for mixed-script filenames that spoof a trusted name, CVE exploit bodies (Log4Shell, Shellshock, Struts OGNL, Spring4Shell), and a secret scanner that surfaces leaked AWS, GitHub, Slack, Stripe, and Google keys plus PEM private keys and JWTs. Bad Gallery, Archives, Video, Site Hosting HTML, inbound mail, and function source are held. Quarantined hashes stay held when served. You can watch the scan on the dashboard. This is a Cloudflare edge file antivirus alternative included on every Zipper plan.
Compute
Edge Functions
Edge Functions run your JavaScript in a secure sandbox on Zipper with up to 60 seconds wall-clock time and 10 seconds CPU. Use Web APIs (fetch, crypto, TextEncoder, structuredClone), import npm packages, handle WebSocket connections, stream responses, and run on a schedule with cron. Environment bindings give you access to KV, R2, D1, and Queues — the same API surface as Cloudflare Workers, plus Supabase-style database access through The Cellar. Supports fetch(), scheduled(), email(), and queue() handlers. Not a toy — production-grade serverless at the edge. This is a Cloudflare Cloudflare Workers alternative included on every Zipper plan.
Site Hosting
Site Hosting connects a git repo. Zipper builds it — static files or an SSR Node origin — gives each branch a preview URL, and lets you roll back to an earlier deploy. Secrets sit encrypted. Pair Edge Functions for rewrites and cron. Attach your own domain when you are ready. This is a Cloudflare Cloudflare Pages / Vercel alternative included on every Zipper plan.
Job Queues
Job Queues take webhooks, mail, and retries off the page request. Zipper retries failed jobs. Poison messages go to a dead-letter queue. Payloads are AES-256-GCM and cannot sit in plaintext. This is a Cloudflare Cloudflare Queues alternative included on every Zipper plan.
Edge AI
Edge AI answers from Zipper’s own help text (zip-fast, zip-large) and can embed text (embed-v1). It is the same engine as Zipper AI on Support. It is not a rented GPU and not a general chatbot. This is a Cloudflare Cloudflare Workers AI alternative included on every Zipper plan.
Zipper Wire
Zipper Wire is Zipper’s AI automation control plane. Publish a wire (workflow), attach a manual, schedule, or webhook trigger, and run linear steps: map, branch, grounded AI, HTTP (SSRF-guarded), Function invoke, Job enqueue, email draft, delay, and human approval. Wire orchestrates; it does not replace Job Queues, Edge Functions, Edge AI, Pilot bots, or The Cellar. Runs, step logs, and approvals stay on this process with Palace RBAC and Watchtower audit. Not Zapier’s global farm, not Temporal’s multi-service cluster, and not Cellar’s PGWire adapter. Included on every Zipper plan.
Zipper Forms
Zipper Forms is a form builder on the Zipper suite. Create forms with short text, email, dropdown, rating, file upload, and more. Publish with a slug, share the link, and collect responses. Wire integrations trigger automations, Mail sends notifications, and Drive stores uploads. Not Typeform's hosted SaaS, not Google Forms on someone else's cloud. Included on every Zipper plan.
Database
The Cellar
The Cellar is a sealed database for your app. You get a connection string, REST, live updates, and an import hatch. Paste a phpMyAdmin SQL dump (or CSV / JSON) and Zipper turns those tables into chambers. Browse and edit rows in Studio. Mint, revoke, and regenerate capability seals. Narrow a seal per user with scoped sessions (POST /session — tables and operations only). Every request runs under a 7.5s server budget with Server-Timing, and the official Cellar client retries 429/503 with Retry-After — no more client-side timeout hangs. Encryption and row rules stay on. SQL is Zipper’s dialect — it never hits the host Postgres parser. It is not Amazon RDS, not stock MySQL, and not a second Supabase. Live updates run on this Zipper process, not a world bus. Included on every Zipper plan.
The Armory
The Armory is Zipper’s warrant mesh for iOS, Android, and the web. You mint a hatch-bound session, then a warrant that names a rack. A write warrant is a spent cartridge — reuse returns 409. Musters hold sealed documents with revisions — every document is sealed at rest under its own per-muster key (za1), and shredding a muster destroys that key forever: the ciphertext husk remains as tamper-evident proof and a zd.… destruction receipt proves it. Vault seals (zv.…) link into an append-only notary chain. Kit is cordoned by Palace Guard, including JSON bodies. The roll is real SSE on this node: writes publish put/patch/unput. Rotate anon and service keys from the dashboard anytime. Twenty Docker racks isolate duties. Requests run under a 7.5s server budget with Server-Timing, and reads never pay for a vault re-seal. An official client (ArmoryClient) ships with cartridge-safe retries. This is not Firebase, not Appwrite Cloud, not FCM/APNs, and not Kubernetes. Without Docker the same twenty racks run in-process and still fail closed. Included on every Zipper plan.
The Mint
The Mint is The Cellar with an append-only ledger riding along in the same transaction: every accepted write posts a new assay entry, and each entry carries the fingerprint of the one before it — so an edited row breaks the chain and shows up immediately. Replay a table to any timestamp (AS-OF), export an incident window for an auditor, and ask for a signed receipt proving a row existed exactly as it was at a moment. Spend-once cartridge warrants from The Armory post one ledger entry and then expire, so a bulk import cannot quietly rewrite history. SQL, REST, live hatch, Studio, encryption, and row rules stay exactly as they are in The Cellar. Not a blockchain — no tokens, no mining, no public network: it is a signed ledger on your own database. Not Cloud SQL with separate audit logs bolted on the side — the ledger is part of the transaction, not a file that can go missing. Not a replacement for The Armory’s documents and crypto-shredding, and more than a plain Cellar once you need to prove your history. Included on every Zipper plan.
The Reliquary
The Reliquary keeps documents as sealed text: every field is encrypted on your side before it reaches Zipper, under its own per-document key that is wrapped by your workspace key (AES-256-GCM). Queries still work because rows are found by blind equality tokens — a keyed fingerprint of the value, never the value itself — and range lookups bucket the token so a search stays coarse. A custodian seal lets a named, logged, time-boxed key open a record when you must, and key rotation runs in the background, resealing old keys as it passes. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution. Honest limits, stated plainly: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns — and zero-knowledge is a direction, not a promise. Not SQL Server Always Encrypted, not a confidential-compute cluster, and not a secrets vault — this is your document store with the operator locked out of the contents. Included on every Zipper plan.
Support
Identity & access
The Herald
The Herald is where you keep hostname records. Apps look them up with GET /dns-query (JSON). Zipper does not listen on UDP/TCP 53, does not publish nameservers, and does not sign DNSSEC. This is a Cloudflare Cloudflare DNS-over-HTTPS JSON (not authoritative :53) alternative included on every Zipper plan.
The Vault
The Vault gets a certificate for each hostname, renews it, and keeps the private key off the tenant dashboard. You can also upload your own certificate. This is a Cloudflare Cloudflare SSL/TLS alternative included on every Zipper plan.
The Throne Room
The Throne Room puts a Zipper sign-in in front of an internal app. Only people in your workspace (with MFA if you require it) get through. The origin stays off the public internet. This is a Cloudflare Cloudflare Access (Zero Trust) alternative included on every Zipper plan.
Origin Connect
Origin Connect runs a small program on your server that dials Zipper. Zipper never needs an inbound hole. The Throne Room can then require sign-in. No public IP on the origin. This is a Cloudflare Cloudflare Tunnel alternative included on every Zipper plan.
Zipper Mail
Zipper Mail (also called Zipper Email) is transactional email on Zipper’s own MTA. Add a domain, publish SPF (include:_spf.tinyzipper.com), DKIM, and DMARC, verify DNS, then send with POST /api/v1/email/send (all plans) or SMTP at smtp.tinyzipper.com:587 on Starter+. Messages are DKIM-signed on this Global Server node and relayed by Postfix. Attachments, batch, schedule, tags, webhooks, and one-click unsubscribe are built in. Inbound stores encrypted messages and routes to mailbox, webhook, or function. Webmail at mail.tinyzipper.com. Not a marketing blast tool — batches cap at 50 recipients per message. This is a Cloudflare Transactional ESP + inbound routing alternative included on every Zipper plan.
The Chancery
The Chancery is identity and access for your Zipper workspace, built on Palace RBAC rather than bolted on beside it. Resources sit in a simple hierarchy — workspace → project → service — and every request is judged by an explicit policy: who (a teammate, a key, an app) may do what (a console action or an API verb) to which resource, under which conditions (project, hostname, time window, or a required MFA claim). Deny always beats allow. Write a change, run it in the simulator against the last twenty-four hours of real audit events to see what it would have blocked or allowed, then publish with one click; policy history keeps the trail and rollback is one action. Ask the plain question — “who can reach The Cellar?” — and get the answer as a list. Honest limits, stated plainly: this is workspace policy, not an identity provider — no SAML or OIDC single sign-on, no directory sync, no organization-wide MFA mandate. It answers “what may happen here,” not “who are you.” Included on every Zipper plan.
The Safe-Conduct
The Safe-Conduct hands out privilege the way a gate hands out passes: temporarily. Write down what you need, why, and for how long (with a ticket if your workspace requires one). A named approver who is not you clears it — one approver by default, two if you require it. You then get a time-boxed pass that grants exactly the resources you asked for, revokes itself when the window ends, and records everything it touched in the audit trail: who asked, who approved, what opened, when it closed. If a project is on fire, break-glass requests still work — they just carry an automatic review after the fact. Honest limits, stated plainly: this is not a privileged access management product — no credential vaulting, no recorded sessions, no proxy in front of your SSH. It is a documented, expiring grant on top of Palace roles, not a standing admin key with a polite label. Included on every Zipper plan.
Observe