How this platform handles your code, credentials, and data, plainly stated.
Your workspace, projects, findings, and documentation are stored in a Postgres database with Row-Level Security enabled on every table that holds your data. That means the database itself, not just the application code, enforces that only members of your workspace can read or write it. Other workspaces' data is not just hidden by the interface; it is unreachable at the database layer.
Credentials you provide (like an AI provider API key) are encrypted before they're stored, using a server-side encryption key that never reaches the browser. The Supabase service role key and other platform-level secrets are never exposed to client-side code. We never log full secret values. If your app sends a key in an error, log, or console line, Invince redacts it before storage and opens a security finding so you can rotate it. Keys found in your connected repo may be checked against the provider to see if they still authenticate. A DPA template, subprocessors list, and retention schedule are public.
When you use an AI-powered feature (investigation, fix generation, documentation, project Q&A), the relevant code, error, or finding context is sent to the AI provider you've configured, or a shared platform key with lower limits if you haven't added your own. That request separates system instructions from your project's content, so content read from your repository (which could theoretically contain crafted text) cannot override the platform's own instructions or exfiltrate other data. We do not send your entire codebase on every request, only what's relevant to the specific question or finding.
Connecting a repository installs a GitHub App scoped to read-only access on repository contents and metadata. It cannot push, change settings, or open a pull request unless you later grant contents: write on GitHub and turn on “Allow Invince to open pull requests” in project settings. That write grant is off by default. You can review the App from GitHub's installation settings at any time.
You can disconnect a GitHub repository at any time from that project's settings, or uninstall the GitHub App entirely from your GitHub account; either immediately revokes access. A workspace owner can delete a workspace from workspace settings, which removes it and everything in it. You can delete your account from your profile.
These are required proofs mapped to test files in this repository. A listed file means the test exists in the checkout. It is not a claim that production CI is green right now, and it is not a security certification.
Workspace isolation
Role and project-in-workspace checks reject cross-tenant access.
lib/authz/workspace.test.ts
SDK ingest credentials
Ingest key lookup uses the hash, not a leaked plaintext column.
lib/monitoring/ingest-auth.test.ts
Issue grouping
Matching exceptions share a fingerprint; unrelated types do not.
lib/monitoring/grouping.test.ts
Security scanners
Known fixtures produce findings; validated code stays quiet.
lib/security/scan.test.ts
Public Check
Passport/public check tests use stored verdicts, not invented scores.
lib/passport/scan.test.ts
CLI URL check
invince check rejects non-http targets; verdict is 0 only for Ready and working.
lib/cli/local-url-check.test.ts
CLI local scan
Vulnerable fixtures produce env and secret findings; missing scanners exit 3, not 0.
lib/cli/scan.test.ts
Application check board
Missing tools and missing GitHub are not recorded as passes.
lib/checks/application-check.test.ts
Launch QA fail-closed
Ready only when every layer is verified. A k6 URL-only file is rejected. Missing load stays Unchecked.
lib/qa/launch-qa.test.ts
Owner-run k6 summary
k6 --summary-export parses HTTP counts. A bare URL is not a load job.
lib/qa/k6-summary.test.ts
Live traffic is not a health proof
Zero hits and dashboard-only errors stay Unchecked. First-party hits prove ingest, not that the app is healthy.
lib/quality/production-evidence.test.ts
Discovered tests vs execution
Counted test files without a stored suite, Playwright JSON, or lcov stay Unchecked. Invince does not treat discovery as a pass.
lib/quality/discovery.test.ts
GitHub gate waits for execution
When the last sync counted test files and no execution is stored, Invince launch gate stays in progress.
lib/github/launch-gate.test.ts
Quality gate fail-closed
Missing or skipped suite runs stay Unchecked. Zero criticals without a completed scan is not Ready.
lib/quality/gate.test.ts
Test run rollup
All-skipped is skipped, never passed. Any failed case fails the run.
lib/quality/rollup.test.ts
Same-origin API checks
Paths stay on the authorized live origin. HTTP 200 fails when JSON disagrees.
lib/quality/api-assert.test.ts
Run regression
Pass-to-fail is a regression. Still-failing is not.
lib/quality/regression.test.ts
Browser CI ingest (Playwright, Cypress, Selenium, Robot)
A bare URL is rejected. Empty suites are not a pass. Cypress/Robot/Selenium JSON counts cases.
lib/quality/playwright-report.test.ts
Requirement traceability
A requirement with no cases or skipped executions stays Unchecked.
lib/quality/traceability.test.ts
Owner lcov ingest
A URL is rejected. Empty lcov is not a pass. Zero hits with files is failed.
lib/quality/lcov.test.ts
Owner eval ingest
A URL is rejected. A pass/judge flag is ignored. Expected vs actual only.
lib/quality/eval-report.test.ts
Quality evidence pack
The JSON snapshot keeps Unchecked when a required suite has no stored run. It is not a certification.
lib/quality/evidence-pack.test.ts
CLI quality ingest audit
CLI ingest audit uses the admin client and attributes the row to the workspace owner with via cli.
lib/audit/cli-ingest.test.ts
Owner k6 p95 compare
A large p95 jump is a regression. Missing summaries are not.
lib/quality/load-compare.test.ts
GitHub App credentials
Numeric App ID only. Quoted PEM unescapes. Client ID Iv1 is rejected.
lib/github/app-credentials.test.ts
Placeholder data signals
Production mock imports and empty click handlers are flagged as review prompts, not automatic proof of a fake app.
lib/security/scanners/placeholder-data.test.ts
Scan history delta
Introduced vs resolved findings come from stored fingerprints across two completed syncs.
lib/reports/scan-delta.test.ts
MFA workspace gate
Enrolled aal1 sessions are sent to /mfa-challenge on workspace paths. Ingest and webhooks stay ungated.
lib/auth/session-gate.test.ts
MFA write fail-closed
Sensitive writes fail closed if AAL cannot be read. Missing MFA APIs still fail open.
lib/auth/require-aal2.test.ts
Anonymous private URL check
401/403/redirect/login form is blocked. A 200 app page is open. Paths stay on the live origin.
lib/security/protected-url-probe.test.ts
On-call paging repeats
Repeats only while the incident is open, after the wait, and under max pages.
lib/incidents/page-on-call.test.ts
GitHub Release records
Published tags parse into a version. Compare URLs need a previous tag.
lib/github/record-release.test.ts
Trace id join
Error and performance rows that share a traceId sort by time. Not an OTel collector.
lib/monitoring/trace-join.test.ts
Watch speed story
Observation rows with a speed change say the public page got slower from stored ms.
lib/simple-mode/app-events.test.ts
Incident related evidence
Related findings and issues are capped and labeled as timing, not cause.
lib/incidents/related-evidence.test.ts
Last scan status
Scan phase comes from stored scans and open findings. A quiet result is not a pass. Lane list matches the loophole scanner.
lib/security/swimmer.test.ts
Route-to-test pairing
App Router files pair to colocated test files by path stem. A pair is not a passing test.
lib/evidence/feature-paths.test.ts
Go-live operator checks
Env doctor never prints secret values. Missing SQL is a schema gap, not a 500.
lib/ops/go-live-checks.test.ts
Public check blockers
5xx, invalid TLS, and a certificate inside 7 days are blockers. TTFB is one checker, not LCP.
lib/simple-mode/health-findings.test.ts
Launch gate fail-closed
An unfinished scan stays in_progress. Required GitHub checks cannot complete as a green neutral.
lib/github/launch-gate.test.ts
Release issue delta
New vs still firing vs not seen on this version comes from error events tagged with each release.
lib/release-deltas.test.ts
Watch functional page delta
Hashed HTML fingerprints are ignored. Vanished titles and empty shells are flagged. Not a headless hydration wait.
lib/simple-mode/watch-diff.test.ts
Watch cadence by plan
Free is a day, Pro about an hour, Business 15 minutes. Scheduler floor is 15 minutes.
lib/simple-mode/schedule.test.ts
Browser check history seed
localStorage keeps recent Check ids on this device. Sign-in does not upload them.
lib/simple-mode/check-history.test.ts
WAF is not downtime
A Cloudflare-style 403 challenge is not a down homepage.
lib/simple-mode/checker-block.test.ts
Watch deploy-flap retries
Broken assets retry in the same tick. Hashed-class-only pages do not look like a flap.
lib/simple-mode/flap-retry.test.ts
Shareable public check
Share links omit owner-only findings and keep the stored verdict.
lib/simple-mode/public-report.test.ts
Found a hole in Invince itself? Email the address on security.txt. There is no paid bounty. Unauthorized Checks go to /report.
Have a question this page doesn't answer? Visit the Help Center.
We use only the cookies necessary to keep you signed in. No analytics or advertising cookies are set. Cookie list