Not row-level filtering. Not shared tables with a tenant_id column. Real separation.
Typical DAM Architecture
✗ Shared database with row-level tenant filtering
✗ One bug can leak data between tenants
✗ Shared storage with path-based separation
✗ Noisy neighbor performance issues
ZDAM Architecture
✓ Dedicated database per tenant
✓ Completely separate schemas, migrations, connections
✓ Per-tenant storage buckets with namespace isolation
✓ Request-level tenant validation in middleware
Every tenant gets their own dedicated database. Independent schemas, independent migrations, independent connection pools. A query in one tenant cannot physically access another's data.
Separate S3 buckets per tenant with namespace isolation. Presigned URLs scoped to the tenant's bucket. Files never route through the application server.
Tenant suspension with progressive enforcement: read-only access, then locked, then deletion warning. Admin impersonation with full audit logging for support.
From password auth to enterprise SSO, flexible authentication that meets your security posture.
SAML 2.0 with automatic metadata parsing: paste a URL or raw XML. OIDC with PKCE flow for modern identity providers. Works with Okta, Azure AD, OneLogin, Google Workspace, Auth0, Keycloak, and any standards-compliant IdP.
Just-in-Time user provisioning creates accounts on first SSO login with configurable default roles. Email domain routing directs users to the correct SSO connection.
TOTP with backup codes. Tenant-level enforcement policies: require MFA for all users, admin-only, or optional. Super-admin MFA enrollment.
Scoped API keys with SHA-256 hashing. Keys inherit a subset of the creator's permissions. Expiry dates, rotation policies, and last-used tracking.
Tenant-level policies for password requirements, session timeouts, and MFA enforcement. Portal SSO and magic link authentication for visitors.
Headless authentication for the Adobe Creative Cloud plugin and other environments without a browser. 60-second TTL tokens stored in DragonflyDB.
Defense in depth from the credential layer to the HTTP header.
HTTP Security Headers
CSP
Strict policy
HSTS
1-year preload
X-Frame-Options
DENY
X-Content-Type
nosniff
Referrer-Policy
strict-origin
Permissions-Policy
Restrictive
CORP
cross-origin
X-XSS-Protection
Enabled
50+ granular permissions across 10 categories. Five system roles with hierarchical groups.
Full administrative control. Manages users, roles, and tenant settings.
Content governance. Manages approvals, workflows, and permissions.
Distribution focus. Manages portals, shares, and analytics.
Content production. Uploads, edits metadata, manages versions.
Read-only access. Browse, search, and download approved assets.
50+ individual permissions with per-role, per-group, and per-resource granularity. Hierarchical groups with manager designations.
Every action logged. Every access tracked. Export-ready for auditors.
Auth attempts, authorization failures, all deletions, sensitive operations. Request-level tracking with IP, user agent, user ID, and tenant ID correlation.
Full tenant data export worker for data portability. All asset data, metadata, permissions, sharing records, and audit logs in a single export.
Real-time WebSocket activity streams. Folder-level audit logs with user attribution. Asset modification history and access patterns.
HMAC-SHA256 signed webhook delivery for external integrations. Delivery history, retry logs, and configurable event filters.
Download grant management tracks who downloaded what with which watermark. Integrity reporting verifies watermark enforcement compliance.
Prometheus metrics endpoint with IP allowlist and basic auth. Grafana-compatible dashboards. Structured logging with request correlation IDs.
Built on accessible primitives. Tested with automated tooling. Designed for inclusive use.
40+ ARIA attributes across the component library. Live regions for dynamic updates. Alert roles for error states. Proper label associations for all forms.
Every feature accessible via keyboard. Command palette (Cmd+K) for quick navigation. Focus trapping in modals with restoration on close. Logical tab order.
Semantic roles on all interactive elements. Screen reader announcements for state changes. Built on Radix UI primitives for WAI-ARIA compliance out of the box.
WCAG AA minimum 4.5:1 contrast ratio. HSL-based CSS variables for consistent contrast in light and dark modes. Font weight increased in dark theme for readability.
@axe-core/playwright in the E2E test suite for automated accessibility auditing. @testing-library/react for accessible component-level testing.
Mobile-first with 6 breakpoints. Touch-friendly interactions. Reduced motion support. PWA installability on any device.
Our team is happy to walk through ZDAM's security architecture, discuss compliance requirements, or share our detailed security documentation.