Security overview
Invena Labs Limited (trading as invena)
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Company number 17237229
Registered in England and Wales
Last updated: 30 October 2026
Invena is in beta. This page summarises our security posture at a high level. It is not a certification or audit report.
For privacy and data handling, see our Privacy Policy. For third-party providers, see our Subprocessor register.
ICO: Invena Labs Limited is registered with the UK Information Commissioner’s Office (ZC219043) as a data controller / fee payer. That is a legal registration, not an ICO security certification. Verify on the ICO register.
Service scope
During beta, Invena provides:
- A beta web application at app.invena.app for organising and sharing household information within Spaces
- A governed API for authentication, permissions, and data access
- Legal and trust pages on this website
Signup is not open yet for new customers.
Infrastructure
| Area | Approach |
|---|---|
| Data storage | Supabase (PostgreSQL and private object storage) in West Europe (London) |
| Authentication | Supabase Auth; email confirmation required |
| API hosting | Railway, EU West (Amsterdam), one replica. The upload scanner runs in Amsterdam and is operated by Invena |
| Product app | Vercel (Next.js) |
| Website | Vercel (static Next.js pages) |
Data protection
| Layer | What we do today |
|---|---|
| In transit | HTTPS/TLS between your browser, our app, and our API |
| At rest | Encryption at rest through our cloud providers (Supabase, object storage) |
| Access control | Space-scoped roles (owner, editor, viewer); API enforces membership on every request |
| Sensitive actions | A full data export asks for an authenticator code, and the account needs an authenticator turned on. Connecting a mailbox also requires an authenticator. Opening a document in a Space asks for a code when an authenticator is already on the account. |
| Documents | Private storage. A download is sent through the Invena app after the API checks that you belong to the Space. Files are not published as a public link. |
| Sessions | Device list with revoke; inactivity auto-lock (default 30 min); single-session option (default on). Changing your password in the app, or turning on an authenticator, signs out other devices. A signed-in browser can keep working for about an hour after that. When you sign in through the Invena app on a browser we have not remembered, we email your account address. You can choose to remember that browser. |
Private content is encrypted and protected from routine internal access. Invena retains limited plaintext metadata required to operate the service, and authorised and logged access to permitted operational data is possible.
We do not currently offer end-to-end, client-side or zero-knowledge encryption — our service must read your data to organise entries, run intake, and generate exports. See our FAQ for the same limitation in plain language.
Technical controls (beta)
| Control | Status |
|---|---|
| Private storage buckets | Document storage is not public-by-default |
| Permission model | Space-scoped roles enforced by the API |
| Audit events | Operational audit trail; sensitive content excluded from logs where configured |
| Error monitoring | Sentry on the API with scrubbing configured |
| Uptime monitoring | External health checks on /health (when configured) |
| Malware scanning (uploads) | When our scanner is switched on, document, image and inbox-file uploads are checked before they are saved. If a check detects a problem or cannot be completed, the upload is not saved. The scanner is switched on as of 30 October 2026. We do not send these files to a separate scanning company. This statement covers customer uploads only; it does not cover an inbox item later filed to an Entry, which copies the already-checked file without another scan, or files and copies generated by Invena, including account exports and Entry handovers. If the scanner is switched off, uploads may be saved without this check. |
| Dependency monitoring | Automated dependency vulnerability monitoring |
Reporting a security concern
If you believe your account has been compromised, use the security contact.
If you have found a security issue in Invena, the vulnerability disclosure page explains what to include and what the report covers. We aim to acknowledge a report within 5 business days.
Please include enough detail for us to investigate. Do not include passwords or full document contents unless we ask you to.
Application-level encryption
We apply application-level encryption to certain sensitive Entry fields so those values are not casually readable in the database without our application key. This is not a claim that every field or legacy value is protected that way today, and it is not end-to-end or zero-knowledge encryption. The service must be able to decrypt data to organise Entries, run intake, and generate exports. Searchable metadata such as titles and Space names may be stored in a form we can use to operate the service.
Limitations (beta)
This is an early-access service. No online service can guarantee absolute security. We design for least privilege, auditability, and clear user control over who can access each Space.