Reusable until revoked
Each six-character code belongs to one encrypted recipient email and can be disabled instantly by an authorized API client.
- Cryptographic code hashing
- Optional client-supplied codes
- One-time full-code response
01 Product features
The essential controls for code-led business access.
Focused capabilities for teams that want a clean public handoff without operating a document repository.
Open with a code →
02 Detail
Built around a smaller access surface.
Recipient data stays server-side
Public responses use masked email values. The database stores encrypted recipient content plus keyed lookup hashes.
- AES-256-GCM at rest
- Separate encryption keys
- No PII in access logs
Signed upstream exchange
Timestamped HMAC payloads carry an encrypted legacy UID to the dedicated Zulde identity at the shared service.
- Fresh nonce per request
- Short timeout
- Exact destination validation
Layered throttling
Per-network and per-code rate buckets slow automated guessing while keeping the public response deliberately non-specific.
- Rolling windows
- Temporary locks
- Retry-After guidance
Scoped client access
API secrets are high-entropy, stored as hashes, shown only when created, and restricted to create, read, or revoke operations.
- Bearer or X-API-Key
- Per-client scopes
- Last-use timestamp
Useful without over-collecting
Events capture validation and handoff outcomes with request IDs and hashed network identifiers.
- No destination URL
- No encrypted UID
- No recipient address