Security on proven infrastructure
ZORALI is built on a modern, managed stack: Next.js for the application and Supabase for data and authentication. That means the foundational security work, patched servers, managed databases, hardened auth services, is handled by infrastructure designed for it, and the ZORALI team builds on top with strict access controls.
- Next.js application on managed hosting infrastructure
- Supabase provides the database and authentication layer
- Managed patching and hardening at the infrastructure level
- No servers for you to secure, that work is ours
Authentication you can trust
Sign-in runs through Supabase Auth, a dedicated authentication service, not a homegrown password system. You can sign in with email or with Google, sessions are managed with secure tokens, and passwords are hashed by the auth service rather than stored in readable form anywhere in ZORALI's systems.
- Authentication handled by Supabase Auth, not custom code
- Email sign-in plus Google OAuth options
- Passwords are hashed by the auth service, never stored in readable form
- Sessions managed with secure, expiring tokens
Your data stays yours: row-level security
Your sites, pages, and account records live in a managed Postgres database with row-level security policies enforced at the database level. In practice, that means the database itself refuses to return another user's rows to your account, isolation is not just application logic, it is a guarantee enforced where the data lives.
- Row-level security policies enforced at the database level
- Your account can only read and write its own sites and records
- Isolation guaranteed by the database, not just the app code
- Unpublished drafts are private to your account until you publish
Encryption in transit and at rest
All traffic between your browser and ZORALI is encrypted with HTTPS, every page, every dashboard, every published site. Data at rest sits on managed, encrypted infrastructure. Together, that means your work is protected both while it moves and while it is stored.
- HTTPS everywhere: the builder, your dashboard, and your published sites
- TLS encryption on all traffic between you and ZORALI
- Data at rest encrypted on managed infrastructure
- Custom domains on paid plans are served over HTTPS too
Your part and ours
Security is shared: we protect the platform, you protect your account. Use a unique password or sign in with Google, keep your account email current so you can recover access, and never share your login. If you spot a vulnerability or suspect your account was compromised, tell us right away through support, we investigate every credible report.
- Use a unique password, or sign in with Google for one less credential to manage
- Keep your account email current so recovery works when you need it
- Never share your login, collaborators get their own accounts
- Report vulnerabilities or suspicious activity to support promptly
