Security overview
Invena Labs Limited (trading as invena)
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Company number 17237229
Registered in England and Wales
Last updated: 19 July 2026
Invena is in private beta. This page summarises our security posture at a high level. It is not a certification or audit report.
For privacy and data handling, see our Privacy Policy. For third-party providers, see our Subprocessor register.
Service scope
During private beta, Invena provides:
- A beta web application at app.invena.app (invitation-only) for organising and sharing household information within Spaces
- A governed API for authentication, permissions, and data access
- Legal and trust pages on this website
Access to new accounts is invitation-only. Public self-service sign-up is disabled.
Infrastructure
| Area | Approach |
|---|---|
| Data storage | Supabase (PostgreSQL and private object storage) in West Europe (London) |
| Authentication | Supabase Auth; email confirmation required |
| API hosting | Railway |
| Product app | Vercel (Next.js) |
| Website | Vercel (static Next.js pages) |
Data protection
| Layer | What we do today |
|---|---|
| In transit | HTTPS/TLS between your browser, our app, and our API |
| At rest | Encryption at rest through our cloud providers (Supabase, object storage) |
| Access control | Space-scoped roles (owner, editor, viewer); API enforces membership on every request |
| Documents | Private buckets; short-lived signed URLs; backend-mediated access only |
| Sessions | Configurable inactivity auto-lock; single-session option; JWT-based auth |
We do not currently offer end-to-end or client-side encryption — our service must read your data to organise entries, run intake, and generate exports. See our FAQ for the same limitation in plain language.
Technical controls (beta)
| Control | Status |
|---|---|
| Private storage buckets | Document storage is not public-by-default |
| Permission model | Space-scoped roles enforced by the API |
| Audit events | Operational audit trail; sensitive content excluded from logs where configured |
| Error monitoring | Sentry on the API with scrubbing configured |
| Uptime monitoring | External health checks on /health (when configured) |
| Malware scanning (uploads) | ClamAV sidecar on the API upload path |
| Dependency monitoring | GitHub Dependabot on the repository |
Reporting a security concern
If you believe your account has been compromised or you have found a security issue:
Report: Security contact
Please include enough detail for us to investigate. Do not include passwords or full document contents unless we ask you to.
Roadmap (honest)
We are exploring application-level encryption for certain sensitive Entry fields so those values are not casually readable in the database without our application key. This is a work-in-progress roadmap item during beta, not a claim that every field or legacy value is protected that way today. We do not claim end-to-end encryption. The service must be able to decrypt data to organise Entries, run intake, and generate exports. Any implementation, assurance work, and related disclosures will be updated if and when the feature is shipped.
Limitations (beta)
This is an early-access service. No online service can guarantee absolute security. We design for least privilege, auditability, and clear user control over who can access each Space.