Trust
Smaller surface by design
Static files only. No server-side execution on customer sites. API keys stay out of the browser. Quotas and HTTPS are enforced on the control plane and edge.
Posture
- Static HTML/CSS/JS only — no SSR, no customer server code
- HTML served as-is — third-party widgets and /data/*.json are allowed
- Allow-listed extensions; executables and server-side code rejected
- Per-project isolation for uploads and live URLs
- HTTPS on *.novence.ai and custom domains
- Hard Free caps (HTTP 402); metered overages on Pro/Scale
- Platform hosts ({suffix}.novence.ai) are noindex; custom-domain robots.txt is authoritative
API keys
Bootstrap returns an nv_ key. Prefer MCP/REST from the agent environment. Status: /status (raw: https://api.novence.ai/health). Full FAQ: /faq.
Security FAQ
Why static-only?
Novence serves HTML/CSS/JS and static assets only — no SSR, no server routes, no databases. That shrinks the attack surface versus full PaaS runtimes. Third-party widgets and JSON data files still work because HTML is served as-is — see /site-data.
How should I store API keys?
Keep nv_ keys with the agent or secret store. Never embed them in HTML, client JS, URLs, or git. The local console-kit uses a short-lived mgmt_ token only — see /dashboard.
Are sites served over HTTPS?
Yes. Both {suffix}.novence.ai and attached custom domains use HTTPS from the edge. Certificates for custom domains are issued automatically after DNS validates.
Do you publish SOC 2 or similar?
This page describes product security posture (static-only, key hygiene, quotas). It is not a compliance certification claim. Contact us at /support if you need formal paperwork.
Read more
Terms and privacy cover legal handling of account and site data.