Security overview
Invena Labs Limited (trading as invena)
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Company number 17237229
Registered in England and Wales
Last updated: 7 September 2026
Invena is in private beta. This page summarises our security posture at a high level. It is not a certification or audit report.
For privacy and data handling, see our Privacy Policy. For third-party providers, see our Subprocessor register.
ICO: Invena Labs Limited is registered with the UK Information Commissioner’s Office (ZC219043) as a data controller / fee payer. That is a legal registration, not an ICO security certification. Verify on the ICO register.
Service scope
During private beta, Invena provides:
- A beta web application at app.invena.app (invitation-only) for organising and sharing household information within Spaces
- A governed API for authentication, permissions, and data access
- Legal and trust pages on this website
Access to new accounts is invitation-only. Public self-service sign-up is disabled.
Infrastructure
| Area | Approach |
|---|---|
| Data storage | Supabase (PostgreSQL and private object storage) in West Europe (London) |
| Authentication | Supabase Auth; email confirmation required |
| API hosting | Railway |
| Product app | Vercel (Next.js) |
| Website | Vercel (static Next.js pages) |
Data protection
| Layer | What we do today |
|---|---|
| In transit | HTTPS/TLS between your browser, our app, and our API |
| At rest | Encryption at rest through our cloud providers (Supabase, object storage) |
| Access control | Space-scoped roles (owner, editor, viewer); API enforces membership on every request |
| Documents | Private buckets; short-lived signed URLs; backend-mediated access only |
| Sessions | Device list with revoke; inactivity auto-lock (default 30 min); single-session option (default on); JWT-based auth. Changing password or turning on MFA signs out other devices. New sign-ins from an unfamiliar browser are emailed to you, with an optional “remember this browser”. Authenticator step-up for vault downloads and mailbox connect. |
Private content is encrypted and protected from routine internal access. Invena retains limited plaintext metadata required to operate the service, and authorised, audited access to permitted operational data is possible.
We do not currently offer end-to-end, client-side or zero-knowledge encryption — our service must read your data to organise entries, run intake, and generate exports. See our FAQ for the same limitation in plain language.
Technical controls (beta)
| Control | Status |
|---|---|
| Private storage buckets | Document storage is not public-by-default |
| Permission model | Space-scoped roles enforced by the API |
| Audit events | Operational audit trail; sensitive content excluded from logs where configured |
| Error monitoring | Sentry on the API with scrubbing configured |
| Uptime monitoring | External health checks on /health (when configured) |
| Malware scanning (uploads) | ClamAV sidecar on the API upload path |
| Dependency monitoring | Automated dependency vulnerability monitoring |
Reporting a security concern
If you believe your account has been compromised or you have found a security issue:
Report: Security contact
Please include enough detail for us to investigate. Do not include passwords or full document contents unless we ask you to.
Application-level encryption
We apply application-level encryption to certain sensitive Entry fields so those values are not casually readable in the database without our application key. This is not a claim that every field or legacy value is protected that way today, and it is not end-to-end or zero-knowledge encryption. The service must be able to decrypt data to organise Entries, run intake, and generate exports. Searchable metadata such as titles and Space names may be stored in a form we can use to operate the service.
Limitations (beta)
This is an early-access service. No online service can guarantee absolute security. We design for least privilege, auditability, and clear user control over who can access each Space.