Trust
Security you can operate
TideGuard is open-source software you deploy on your own edge account. Queue state and admission stay under your control; the waiting room does not insert a vendor session database between visitors and your origin.
Signed admission, limited lifetime
When a visitor is admitted, TideGuard issues a time-limited HMAC token. The protected surface can trust that token (cookie, Bearer, or query) without standing up a new session store on the origin. Tokens expire so capacity cannot leak past your admit policy after someone leaves the flow.
Strongly consistent queues at the edge
Authoritative join, wait, and admit state for a named queue lives in a Durable Object. That keeps FIFO order honest under concurrent joins. Configuration and branding can live in KV; the hot path does not depend on writing queue position there.
Explicit bypass, not hidden cuts
Staff skip the public line only through controls you turn on: an IP allowlist for fixed office ranges, or Pass queue for a smoke-test cookie in the operator browser. Temporary country block uses CF-IPCountry with a TTL for event windows; allowlist and Pass queue still override. It is a launch gate, not a substitute for a WAF.
You host it
Deploy on your Cloudflare account, set TOKEN_SECRET, and keep the repository. There is no TideGuard-operated waiting-room SaaS in the middle of the request path. Review the project security policy and report issues through GitHub.