Magic-link email (the default)
Enter your email, click the link, you are in. No password to phish, reuse, or leak in a breach dump. This is the default route for new accounts, and for most people it is the only one they ever need.
Account security
Your account, locked down at the identity layer
Server security protects the sites. Account security protects the keys to them. Every Zinn Digital® login runs on one standards-based identity system — passkeys and WebAuthn, TOTP two-factor, magic-link sign-in, SAML SSO for enterprise and agency teams — with granular roles, per-organisation API keys and an append-only audit log behind it. It is the same identity layer used by the operators running more than 100,000 PBN sites with us.
- 100,000+PBN sites hosted across every niche
- PasskeysWebAuthn sign-in, built in
- SAML SSOfor enterprise and agency accounts
- Audit-loggedevery privileged action
One identity, every surface
Most hosting accounts are a password in a database, bolted to a control panel. Ours is a dedicated identity system — Keycloak, speaking OIDC and SAML — that sits in front of everything: the customer dashboard, the staff admin console, this public site and knowledge base, and your support tickets. Sign in once and you are signed in across all of them.
Because it is built on open standards rather than a proprietary login, the identity layer is swappable in the same way every other component of the platform is. No part of your access model is trapped inside a vendor's product, and none of your team's authentication depends on us keeping one supplier. That is the same no-lock-in principle we apply to CDN accounts, DNS and payment providers.
Sign-in is localised, and the handoff from the site to the login screen carries your language with it — so a team spread across countries is not forced through an English-only login.
Sign in the way that suits your team
Four methods, all first-class, all configurable per person. Nobody is forced onto the weakest option because it is the only one on offer.
Passkeys / WebAuthn
Register a passkey — Touch ID, Face ID, Windows Hello, or a hardware key like a YubiKey — and sign in with no password at all. Passkeys are bound to the origin, so a lookalike login page cannot harvest one. The platform accepts ES256 and RS256 authenticators and prefers user verification.
Social login
Sign in with Google through a standard identity-provider connection, so an account inherits whatever controls your Google Workspace already enforces. Further providers connect the same way — nothing about it is a bespoke integration.
Email and password (fallback)
Kept for the people and scripts that need it, and held to a real policy: minimum twelve characters, never your username or email address, no reuse of your last three, hashed with Argon2. Email addresses are verified before an account becomes usable.
Two-factor and brute-force defence
Second factors are part of the identity system, not an add-on you buy or a plugin you install on your own site.
- TOTP two-factor via any standard authenticator app — six digits on a thirty-second period, the same scheme Google Authenticator, 1Password and Authy speak. It can be enforced by policy across an organisation rather than left to each person's good intentions.
- Passkeys can replace the password entirely rather than sitting on top of it, which removes the credential a phisher is trying to steal in the first place.
- Brute-force protection is on at the realm level: repeated failed attempts trigger an escalating wait, growing to fifteen minutes, so a credential-stuffing run stalls out instead of grinding through a wordlist. Lockouts are temporary by design — an attacker cannot lock a real customer out of their own account permanently.
- Signup email addresses are validated at registration through a ZeroBounce-backed adapter: undeliverable and invalid addresses are rejected, and disposable, role and abuse-flagged addresses are flagged. Fake or unreceivable emails do not get an account, which also feeds trial anti-abuse and fraud checks.
- Sessions are held on a short leash — access tokens are short-lived, idle sessions expire, and every session has a hard maximum lifetime, so a forgotten browser on a shared machine is not an open door tomorrow.
SAML SSO for enterprise and agency teams
If your organisation already runs an identity provider — Okta, Entra ID, Google Workspace, or anything else that speaks SAML — you connect it and your people sign in to Zinn Digital® with their existing corporate credentials. There is no second password for your team to manage, and no second offboarding checklist to forget.
That matters most at agency and reseller scale, where staff turnover is a genuine security event. When someone leaves and you disable them in your directory, you have disabled their route into your hosting too. Access follows employment, centrally, rather than being chased across a dozen SaaS tools.
SAML sits alongside everything else rather than replacing it: contractors can still be given a magic-link account inside a scoped role, while permanent staff come in through SSO. One organisation, one permission model, two front doors.
Roles that grant only what the job needs
Access is scoped to the organisation tree — reseller to client to site — and enforced in the database itself through row-level security, not just in the application. Cross-tenant access is not a policy we ask people to respect; it is a query that cannot return rows. Four customer roles cover the realistic split of duties.
Owner
Full control of the organisation and its sub-accounts: create child organisations, invite and remove members, assign roles, manage every site, run billing and invoicing, manage API keys, and read the audit log.
Billing Manager
Invoices, subscriptions, payment methods and the plan catalogue — and nothing else. Your finance person or accountant can settle an invoice without ever holding the ability to touch, suspend or delete a live site.
Developer
Sites and API access without billing control: view and provision sites, restart services, purge caches, manage API keys and work tickets. Deliberately no access to payment methods, invoicing or plan changes.
Read-only
View-only across the organisation — sites, billing, plans, tickets, translation status and the audit log. The right role for an auditor, a client who wants visibility, or a new starter in their first week.
API keys, tokens and AI connections
The dashboard is one way in. The API, the CLI, the Terraform provider and the MCP server are others — and they are held to the same access model, because an unscoped key is a bypass of every role you just configured.
Keys belong to the organisation
An API key is issued to an organisation, not to an individual person, and carries its own scopes. Treat it as shared credential material: name it for its purpose, give it the narrowest scopes that work, and rotate it when the person who created it moves on.
Only a hash is ever stored
The raw key is shown to you once, at creation. What we keep is a SHA-256 hash and a short prefix for lookup. We cannot show you a key again, and a database compromise does not hand an attacker working credentials.
Scoped, revocable, observable
Every key carries granular scopes tied to the same permission catalogue the roles use, records when it was last used, and can be revoked outright the moment it looks wrong. Separate sandbox keys exercise the API with no real billing or provisioning behind them.
AI tools connect under the same rules
The MCP server lets any MCP-capable agent manage your hosting — and it authenticates through OAuth 2.1, scoped to your organisation and its RBAC permissions, with per-tool revocable tokens, confirmation on destructive actions, spend caps and full audit logging. Connecting an AI assistant does not mean handing it the keys to everything.
The audit log, and access to it
Every privileged action writes an append-only record — who did it, what they did, what they did it to, the supporting evidence, and the source IP address, with a timestamp. It is not a debugging convenience; it is the evidence trail.
- Owner and read-only roles can read the audit log directly, so accountability inside your organisation does not require raising a support ticket with us.
- Staff access to your account is governed by the same machinery: our people sit in departments with per-module, per-action permissions, so a support agent sees tickets and basic remediation, not your billing configuration or your fleet.
- Sensitive and destructive staff actions can require step-up authentication or two-person approval before they execute.
- IP allowlisting is available per organisation for teams that want access narrowed to known networks on top of everything else.
- The same audit trail, least-privilege model and per-tenant isolation are what feed our SOC 2 and ISO 27001 roadmap — the evidence is being produced from day one, rather than reconstructed later.
FAQ
Do I have to use a password at all?
No — and we would rather you did not. Magic-link email sign-in is the default, and you can register a passkey (Touch ID, Face ID, Windows Hello or a hardware key) and sign in with no password ever set. Email and password remains available as a fallback, held to a twelve-character minimum, no reuse of your last three, and Argon2 hashing.
Can I make two-factor authentication mandatory for my team?
TOTP two-factor is built into the identity layer and can be enforced by policy across an organisation rather than left to each member to opt into. Passkeys are the stronger option where your team's devices support them, since they remove the password an attacker would be phishing for.
Someone on my team only handles invoices. Can I stop them touching sites?
Yes. The Billing Manager role grants invoices, subscriptions, payment methods and the plan catalogue, and nothing else — no ability to view, provision, restart, suspend or delete a site. The reverse also holds: the Developer role manages sites and API access with no billing control at all. Roles are assigned per organisation, so holding a role in one organisation grants nothing in another.
What happens if one of our API keys leaks?
Revoke it from the dashboard and it stops working immediately. The damage window is bounded by what that key could do in the first place, which is why keys carry granular scopes and record a last-used timestamp — narrow scopes and a visible usage trail are what turn a leak into a contained incident rather than a full account compromise. Note that keys are issued to the organisation rather than to an individual, so treat them as shared credentials and rotate them when people move on. Only a hash of the key is stored on our side, so a leak from our database does not produce a working credential.
Can I see who did what in my account?
Yes. Every privileged action is written to an append-only audit log with the actor, the action, the target, supporting evidence, the source IP and a timestamp. Owner and read-only roles can read it directly. Staff actions on your account are logged in the same trail, and sensitive or destructive staff actions can require step-up authentication or two-person approval first.
We already use Okta / Entra ID. Can our team sign in with that?
Yes — SAML SSO is supported for enterprise and agency accounts, so your people authenticate with existing corporate credentials and offboarding in your directory removes their access here too. You can mix approaches: SSO for permanent staff, scoped magic-link accounts for contractors, all inside the same permission model.
I'm moving from your V1 platform. Does my old password come across?
No — passwords are deliberately not migrated. Your account is imported without one, and on first sign-in you either use magic-link or set a fresh password under the current policy. Porting old password hashes would carry old weaknesses into a new system, so we do not.
How do I try this without handing over card details?
The Footprint-Free trial is seven days, card-free, and covers up to five sites. You get the full identity layer during the trial — passkeys, two-factor, roles, API keys and the audit log are not gated behind a paid plan.
Related
Set up your account properly in the first five minutes
Register a passkey, invite your team into the right roles, and issue a scoped API key — all on a card-free 7-day trial with no card details required.
Start free