Your data stays where it is.
How the agent runs, what reaches Invarly, and what never does.
The agent
Invarly runs rules through a small agent you deploy as a Docker container inside your network, next to the database it checks.
- It connects with a database user you create, and that user only needs read access to the tables your rules use.
- It opens outbound HTTPS connections to Invarly. It never listens for inbound connections, so there is no port to open.
- It pulls rule definitions, runs them locally, and pushes results.
What leaves your network
Only rule results: for each run, how many records were checked and which ones broke the rule. For a violation, Invarly receives the entity identifier and the columns you list in the rule. Columns you don’t list are never sent.
Full tables, raw rows and unrelated columns never leave your network.
What the AI sees
To suggest rules and investigate incidents, the AI works with your schema (table and column names and types), the repositories you connect, and rule results. It does not receive raw rows. Code from connected repositories is used for your account only.
In Invarly’s cloud
- All traffic between the agent and Invarly is encrypted with TLS.
- Each agent has its own token. Invarly stores only a hash of it.
- Every run is read-only, time-limited and capped in rows, and the agent logs the fingerprint of every rule it executes.
Access and accounts
Access to your workspace is limited to the people you invite. Invarly staff access a workspace only to help with a support request you open.
Compliance status
Invarly is in early access and has not completed a SOC 2 or ISO 27001 audit yet. We’ll share our security roadmap and answer questionnaires for design partners.
Reporting a vulnerability
If you find a security issue, email [email protected]. We reply within two business days and won’t take action against good-faith research.