SECURITY
N1 is early access. This page describes protections that exist today, along with important limits we will not hide behind vague claims.
Each account has an immutable server-generated identity. Private dashboard and MCP requests enter a transaction-scoped data boundary for that account, without a user-supplied tenant selector or fallback to another account’s records.
Passwords and generated connector client secrets are stored as bcrypt hashes. Email verification and password-reset tokens are random, time limited, and stored only as hashes.
ChatGPT connections use authorization code flow with PKCE and explicit consent. Preference, memory, and nutrition permissions are separate scopes. Access tokens are short lived and refresh tokens rotate.
Account mutations require CSRF tokens and reject foreign origins. Session cookies are Secure, HttpOnly, and SameSite=Lax. Production traffic is served over HTTPS.
Writes use stable operation identities, conflict checks, source wording, and append-only revisions. An uncertain response can be retried without silently creating a different operation.
The owner can view account metadata and enable or disable access. The administration UI does not provide a way to browse another account’s personal evidence.
N1 is not zero-knowledge or end-to-end encrypted storage. Connected context is returned to ChatGPT when an approved N1 tool is used. The service has not claimed an external security certification, penetration-test report, or bug-bounty programme. Two-factor authentication is not available in the current release.
Email support@projectnightone.com with the subject beginning [Security]. Include the affected URL, impact, and safe reproduction steps. Please do not access another person’s data, disrupt the service, or send a live password, OAuth secret, access token, or private record content.