Security overview for IT teams
Studies of a datacenter's power supply are sensitive. This page is written for the IT and security staff who review Nine Firm before their organization uses it. It describes, factually, how the service works today, what it stores, what it connects to, and what we have not yet done. Each statement can be checked; the last sections say how.
At a glance
| Question | Answer |
|---|---|
| What it is | A web application at app.ninefirm.com that simulates the reliability of a datacenter's power supply. An offline single-file edition is also available (see below). |
| Where it runs | Application and analyses: Fly.io, Virginia (United States). Database: Neon managed PostgreSQL on AWS us-east-2 (Ohio, United States). |
| Sign-in | WorkOS (hosted sign-in). Invitation or access code only; there is no open sign-up. Single sign-on and multi-factor authentication are supported by the provider. |
| Passwords | We never store your password. |
| Third-party scripts, trackers, analytics | None, in the app or on this website. |
| Your data sent to others for processing | None, except to Anthropic for the optional AI assistant, which is off unless an administrator of your organization turns it on. |
| Certifications and audits | None yet (no SOC 2, ISO 27001 or independent penetration test). See "What we have not done yet". |
| Security contact | contact@ninefirm.com |
How it works
- Your browser loads one page from
app.ninefirm.com. The page contains the user interface only; the simulation engine is not sent to the browser. - When you run an analysis, the browser sends the study to our server, the server runs the simulation and returns the result. Progress is streamed back over the same HTTPS connection (server-sent events).
- Saved projects, run records and the organization's shared library are stored in the database. Every request is tied to a signed-in person and their organization, and every database query is limited to that organization: another organization cannot list, open or run your projects. Automated tests check this isolation.
- This website (
ninefirm.com) is a separate static site. It holds no customer data; its demo-request form sends the email address you type to the application server.
Network: what to allow
| Address | Used for |
|---|---|
app.ninefirm.com (HTTPS, port 443) | The application, its API and run progress. Run progress and AI answers use long-lived streaming responses: a proxy that buffers responses will delay progress updates. |
api.workos.com and an authkit.app address | The WorkOS sign-in pages you are sent to when you sign in, and back from when you sign out. |
| Email from WorkOS | Invitations and sign-in verification codes are sent by WorkOS on our behalf. If your mail filter holds them, allow WorkOS as a sender. |
ninefirm.com | This website (optional). |
The application page cannot contact any other address: its Content-Security-Policy allows connections only to its own origin (connect-src 'self').
Service providers (sub-processors)
| Provider | What it does | Where |
|---|---|---|
| Fly.io | Runs the application and the analyses | United States (Virginia) |
| Neon | Database: accounts, projects, run records, shared library, audit log | United States (AWS us-east-2) |
| WorkOS | Sign-in, organization membership, invitation and verification emails | United States |
| Anthropic | Answers questions about a run, only for organizations that turn on AI assistance | United States |
| Netlify | Hosts this website (no customer data) | Global network |
| GoDaddy | Domain name and DNS | United States |
What we store
| Data | Contents |
|---|---|
| Accounts | Name, work email, organization and role (owner, admin, member or viewer), and the sign-in provider's identifiers |
| Projects | The studies you save (inputs, scenarios, version history, notes), compressed |
| Run records | For each analysis: who started it, when, the analysis type, the full inputs and the full result, so any result can be reproduced |
| Shared library | Outage data, load shapes and wind and solar profiles that members publish to their organization, with every version |
| Audit log | Who did what and when (for example saving a project, publishing to the library, inviting a person) |
| AI log (only if AI assistance is on) | Each question, its answer, the outcome and token counts |
| Access codes | A one-way hash of each code (never the code), its role, limits and use count |
| Demo requests | The email address entered on this website |
| Server logs | Each request's time, address, path, status and duration; request bodies are not logged |
We do not store passwords or payment details. Saved projects can be deleted by an admin or owner of their organization. Run records are kept so results stay reproducible; there is no automatic deletion yet. Deletion on request is described in the privacy notice.
Access and identity
- Sign-in is handled by a specialist identity provider (WorkOS). We never store your password. If you create an account with an access code, your password passes through our server once, only to be handed to the provider; it is not written to our database or logs.
- Single sign-on with your own identity provider (SAML or OpenID Connect) can be set up for your organization through WorkOS; ask us. Multi-factor authentication is supported by the provider; it is not switched on by default today.
- Accounts are created only by invitation from an administrator or with an access code we issue; an access code can be limited to your email domain, a number of uses and an expiry date, and can be revoked.
- Roles: viewers can open projects and results; members can also save, run analyses and publish to the shared library; admins can also invite people, revoke invitations, issue access codes (never with the owner role) and turn AI assistance on or off; owners can also invite admins and owners. Removing a person from an organization is done by us on request today.
- Your session is kept in a sealed (encrypted) cookie,
wos-session, marked HttpOnly, Secure and SameSite=Lax, so scripts in a page cannot read it. A second cookie,wos-state, lives for ten minutes during sign-in only. Signing out ends the session at the provider too.
Data in transit and at rest
- All traffic uses HTTPS with HTTP Strict Transport Security (one year, including subdomains); plain HTTP is redirected to HTTPS.
- The connection from our server to the database is encrypted: Neon requires TLS for every connection.
- Data is stored in a managed PostgreSQL service in the United States, whose provider documents encryption of stored data.
- Secrets (keys, passwords) are kept in the hosting provider's secret store, never in the code.
Application protections
- A strict Content-Security-Policy: scripts run only if their exact content is listed by hash (no inline or third-party scripts), the page may connect only to its own origin, may not be framed by another site, and may not load plug-ins.
- Other headers on every response:
X-Content-Type-Options: nosniff,X-Frame-Options: DENY,Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that turns off the camera, microphone, location and payment features, andCross-Origin-Opener-Policy: same-origin. - Requests are size-limited and checked before any computation. Each organization has limits on concurrent runs and on simulated years per run, and every run has a time limit, so one customer cannot starve the service. Public forms (access-code sign-up and demo requests) are limited per address per hour.
- Automated tests cover sign-in, organization isolation, roles, request limits and the correctness of results against analytical checks and the IEEE Reliability Test System.
AI assistance (optional, off by default)
Analyses run on our servers; your inputs are not sent to any third party for processing. The one exception is the optional AI assistant: if an administrator turns it on, a question about a finished run sends that question, that run's inputs and results, and the app's help text to Anthropic, and nothing else. The assistant has no tools and cannot change data. Each question is logged in your organization's AI log and limited per person and per organization. An administrator can turn it off again at any time.
Operations
- The hosting platform health-checks the service and restarts it if it stops responding. We do not yet have around-the-clock alerting.
- Backups and recovery are provided through our database service; we will confirm the current retention window on request.
Offline edition
For organizations that cannot send studies to an outside service, a licensed single-file edition runs entirely inside the browser on your own computer: nothing to install, no administrator rights, and no network connections. Its built-in Content-Security-Policy blocks every connection (connect-src 'none'), so it cannot send data anywhere. It covers a subset of the web application's analyses and comes with a one-page note for your IT team that explains how to check this.
Check it yourself
- Security headers: run
curl -sI https://app.ninefirm.com/and compare the headers with this page. - Connections: open the app with your browser's developer tools on the Network tab; after sign-in, every request goes to
app.ninefirm.com. - Cookies: the browser's storage panel shows only the cookies named above.
- Offline edition: open it with the network disconnected, or watch the Network tab, and run an analysis; there are no requests.
What we have not done yet
Nine Firm is in a pilot. We have not yet had an independent audit or penetration test, and we do not yet hold certifications such as SOC 2 or ISO 27001. Sign-in uses the provider's address rather than our own domain, and multi-factor authentication is not required by default. We will tell you when that changes, and we are glad to answer security questionnaires and discuss your requirements before you put sensitive studies into the service.
Reporting a problem
If you believe you have found a vulnerability or a data exposure, write to contact@ninefirm.com. We will acknowledge your message promptly, investigate, and tell affected customers without undue delay if their data is involved.