Your invoice history is pulled live from Stripe every time you load the page — nothing is cached or stored locally, so what you see always reflects your actual billing records.
Only the account owner or a team member with the Billing role can reach your invoices. Visiting the page any other way sends you back to your dashboard — and the same check happens independently on the actual PDF link itself, not just the page you get there from. Requesting a PDF directly without billing access is refused too, not just hidden behind the page you'd normally click through.
If your account has more than one subscription on record — including ones you've since changed or canceled — you'll see a selector at the top of the page to switch between them. This isn't limited to your current active subscription; it's there specifically so you can still pull historical invoices from a plan you're no longer on.
Each invoice row has two actions: one opens the PDF in a new tab, the other downloads it. Both go through the exact same link, with only a small difference in the URL — the download link adds one extra parameter that tells the server to send the file as an attachment instead of something your browser can open in place.
Both links point to a page on our own server, not directly to Stripe. Stripe always serves its invoice PDFs as a forced download, which would mean the "view" link couldn't actually open the file in a new tab. Our server fetches the PDF from Stripe and passes it through, which is what lets the view option actually work as a preview instead of downloading every time.
Before serving a PDF, the request looks up that invoice directly from Stripe and confirms it actually belongs to your account's Stripe customer record — it doesn't just trust the invoice ID in the link. A mismatched or tampered invoice ID is refused rather than served.