Security

Sign-in

n1099 uses emailed magic links instead of passwords. Each link is single-use, tied to the email it was sent to, and expires after 20 minutes. Sessions are signed tokens stored in a secure, HTTP-only, same-site cookie. Signing out invalidates the session. Because there are no passwords, there is no password database to protect, and a password leaked elsewhere cannot be replayed against n1099. Protect the inbox you sign in with; that inbox is your key.

Tenant isolation

A pilot account and an owner organization are separate tenants. Every read and write on the pilot side is scoped to the signed-in pilot; every read and write on the owner side is scoped to the signed-in organization. There is no query path that returns another tenant’s record by id alone. Public access to an invoice exists only through its share token, and only while the link is unexpired and unrevoked. Our automated tests include cross-tenant authorization checks that must pass before any release.

Invoice links

• Each link contains a long random token (not a sequential id) that resolves to exactly one invoice.
• Links expire (default 180 days) and can be revoked by the pilot at any time.
• Opening a link is logged with time and IP, visible to the pilot as “Viewed”.
• Link endpoints are rate-limited to slow enumeration attempts, which the token length already makes impractical.

Encryption

All traffic is served over TLS; plain HTTP is redirected. Data at rest, including the database, backups and object storage for receipts and PDFs, is encrypted by the hosting provider’s managed storage. Files are stored under tenant-prefixed keys and are never served from a public path: every download goes through a route handler that checks who you are and what you are allowed to see.

Audit log

Meaningful changes (invoice sent, revised, voided; payment recorded; link revoked; roster invitation accepted; account deleted) are written to an append-only audit log with the actor, the resource, the time and a before/after summary. Pilots see the history on each invoice. Staff access to customer data is logged the same way.

Infrastructure

• Application and PostgreSQL database hosted on Control Plane in the United States, in managed, isolated workloads.
• Transactional email through Resend, with SPF, DKIM and DMARC configured for n1099.com so receiving mail systems can authenticate mail from n1099.com.
• Secrets are injected at runtime from a secrets manager, never committed to source.
• Security headers on every response: content-type sniffing disabled, framing denied, strict referrer policy, restricted permissions policy.
• Rate limiting on sign-in, invoice links and email-sending endpoints.

Backups and recovery

The database is backed up daily with point-in-time recovery, and backups are retained for 30 days. Object storage is versioned. We test restoring from backup before launch and on a regular schedule after. We design for high availability and keep nightly backups; this is an engineering target, not an uptime guarantee, and the Terms do not include an SLA.

Development practices

• All money is stored as integer cents and money calculations are covered by tests, including partial payments and credits, including partial payments and credits.
• Input is validated on the server for every mutation, regardless of what the browser sends.
• User content is escaped in every email and page we render.
• Dependencies are pinned and reviewed; the application runs with minimal privileges.

What we do not do

We do not store passwords, card numbers, bank account numbers or government identifiers. We do not move money. We do not integrate with flight-tracking data. The less we hold, the less there is to protect.

Responsible disclosure

If you believe you have found a vulnerability, email security@n1099.com with enough detail for us to reproduce it. Please do not access other people’s data beyond what is needed to demonstrate the issue, do not run denial-of-service tests, and give us a reasonable window to fix before publishing. We will acknowledge within two business days, keep you updated, and credit you by name if you want. We will not pursue legal action against researchers who follow these guidelines in good faith.

Questions

Anything about this page: security@n1099.com. For how we handle personal data, see the privacy policy.