Trust
Smaller surface by design
Static files only. No server-side execution on customer sites. API keys stay out of the browser. Quotas and HTTPS are enforced on the control plane and edge.
Posture
- Static HTML/CSS/JS only — no SSR, no customer server code
- Allow-listed extensions; executables and server-side code rejected
- Per-project isolation for uploads and live URLs
- HTTPS on *.novence.ai and custom domains
- Hard Free caps (HTTP 402); metered overages on Pro/Scale
- Customer robots.txt is authoritative — platform does not inject crawl blocks
API keys
Bootstrap returns an nv_ key. Prefer MCP/REST from the agent environment. Status: /status (raw: https://api.novence.ai/health). Full FAQ: /faq.
Security FAQ
Why static-only?
Novence serves HTML/CSS/JS and static assets only — no SSR, no server routes, no databases. That shrinks the attack surface versus full PaaS runtimes.
How should I store API keys?
Keep nv_ keys with the agent or secret store. Never embed them in HTML, client JS, URLs, or git. The local console-kit uses a short-lived mgmt_ token only.
Are sites served over HTTPS?
Yes. Both {suffix}.novence.ai and attached custom domains use HTTPS from the edge. Certificates for custom domains are issued automatically after DNS validates.
Do you publish SOC 2 or similar?
This page describes product security posture (static-only, key hygiene, quotas). It is not a compliance certification claim. Contact us via the FAQ if you need formal paperwork.
Read more
Terms and privacy cover legal handling of account and site data.