Skip to content
ZevAuth
Start free Sign in

For security and compliance

Auth you can answer questions about.

Isolation you can point at, an audit log with real volume, and controls that default to safe.

Start free
The ZevAuth authentication log with a column of events, outcomes, and the device and location each came from
RLS
forced row-level isolation, per tenant, at the database
100%
of sign-ins, lockouts and revocations, logged
0
user data fetched from a host we do not run

Isolation

A wall, not a filter.

Every environment is a separate tenant with forced row-level security. One app cannot read another’s users even through a bug, because the isolation is a database rule, not a query somebody has to remember.

  • Forced row-level security
  • Separate keys and issuer per environment
  • A token for one fails against another
Per-environment issuer and JWKS URL on the ZevAuth API keys screen

The record

A log that answers questions.

Every sign-in, failure, lockout and revocation is recorded with the account, the outcome, and the device and location it came from, and kept so you can go back to it.

  • Who, where and why, per event
  • Kept and paginated, not truncated
  • Webhooks for anything you watch
The authentication log with events, outcomes and locations

Defaults

Safe unless you loosen it.

Lockout after a threshold you choose. Bot protection on the flows that need it. Passwords found in a known breach refused where they are set. You turn things down, not up.

  • Lockout at a number you set
  • Breached passwords refused
  • Bot challenge on sign-up and sign-in
The attack protection settings

Documentation that answers the next question.

Written for the moment you are stuck, not for a tour.

Sessions and tokens What is in a session and how it is signed. Verifying tokens Check a token on your own server. Webhooks Every event, signed and retried.

Frequently asked questions

What security and compliance ask before they start.

How are tenants isolated?

Every environment is a separate tenant with forced row-level security at the database, so one app cannot read another’s users even through a bug.

Is there an audit trail?

Every sign-in, lockout and revocation is logged with the account, outcome, device and location, kept and paginated rather than truncated.

Where does user data live?

In an isolated tenant you can point at, with uploads in storage you control. Nothing about a user is fetched from a host we do not run.

Next, in the product.

Sessions and devicesSessions your users can see and end.Attack protectionLockout, bot defence, breached passwords.WebhooksEvery event, delivered and retried.

Read it as.

DevelopersDrop-in components, or the raw API. Your call.Founders and productShip auth this week. Do not build it.AgentsA surface that describes itself.

Start with a project and a key.

Free to build and to ship. Test and production both cost nothing today. Generous limits, no card, and no surprise bill.

Start free Read the docs