For research IT and data stewards

You decide whether a program may run on a managed machine, near a laboratory’s data. This page lists what Ingence touches, what it writes, what it sends over a network and who can reach it, so you can judge it without reading the code. Each answer links to the page that gives the full account.

Ingence is a pre-alpha. Where something is a limit and not a promise, this page says so.

At a glance

Question	Answer
Does it change the data it reads?	No. It reads names, sizes and dates, and when allowed it opens files read-only. It never moves, renames, deletes or writes to them.
Does it run code it finds in the data?	Never. It recognizes an installed program by the names of its parts and does not run it.
What access does it need to the data?	Read access.
Where does it write?	A project folder you choose, the system’s temporary folder, files you ask for, and a small settings folder for the user account.
Does it send anything over a network?	Only in three cases, each when someone asks (below).
Does it send usage data or crash reports?	No.
Does it check for updates?	No.
Does it listen on a network port?	Only the Dashboard, and only on the machine’s own loopback address.
Does it need an account, a server or a database service?	No.
Does it run as a service, or start with the machine?	No. It runs when someone starts it.
Does it need administrator rights to install?	Not when installed into a user’s own folder with uv, pip in a virtual environment, pipx or conda.

What it touches

The folders it reads (the roots). The census asks the operating system for each file’s name, size and dates, and for where each link points. It opens no file. A dive opens files, read-only, within a time budget someone grants, and reads headers, text, tables and the member lists of archives. Readers that need it run in short-lived helper processes of Ingence’s own, so one damaged file cannot hang a run. Because it opens files as any program does, security software that scans files as they are opened, and any auditing of file access, will see those reads, and your operating system may record that a file was opened. A server keeps its own logs, and Ingence cannot change that.

Give it read access and no more. The census and a dive run to the end on a folder whose write permission has been removed. For a folder that is not the user’s own, the safest way to start is init --depth metadata, which makes “open no file” the project’s default: a plain ingence dive there opens nothing and says so. It is a default and not a lock. Anyone can still run ingence dive --depth standard or ingence dive --depth deep in that project, and that opens files. If others use the project, tell them (Read someone else’s folder).

The load on a file server. The census lists folders several at a time and asks for each file’s metadata. ingence index -p PROJECT --dry-run --seconds 60 measures it for a minute and writes nothing. How many folders are listed at once is a setting (scan.workers), and hashing across a network share can be switched off (hash.skip_remote_filesystems). Network shares and slow storage has the details.

What it writes

Ingence writes in four places and no others. The first is a project folder the user chooses: one folder per run, a log of the user’s decisions, their settings and their changes to the rules and the Dictionary. The second is the system’s temporary folder while it works. The third is files the user asks for: an export, a report or an exported answers file. Ingence refuses to write any of them inside a folder the project reads. The fourth is a small settings folder for the user account. It holds the name the Dashboard signs decisions with and a short list of recently opened projects.

The settings folder is ~/Library/Application Support/Ingence on macOS and %APPDATA%\Ingence on Windows. On Linux it is the ingence folder under $XDG_CONFIG_HOME where that variable is set, and ~/.config/ingence otherwise. The environment variable INGENCE_CONFIG_HOME, when set, names a folder to use instead.

A project is as sensitive as the folder it came from. It holds the names of the files and short extracts read from inside them. Give it the permissions, backups and retention you give that folder. Privacy and your data lists everything it writes.

What it sends

Ingence runs on the machine it is installed on. A network connection is made in three cases only, and only when a person asks.

When	Where it goes
Installing or upgrading the package	Wherever your package manager is set to look: the public package index, or your own mirror.
ingence index --fetch on a public archive’s listing	The archive’s own server, one request at a time with a pause, each request logged beside the listing. It fetches the list of files, not the files.
ingence teach pack install with a web address	The address that was typed. A pack from an address is refused if it is larger than four megabytes or slow to answer.

It sends nothing anywhere else, no usage data and no crash reports, and it does not check for updates. A new version arrives only when someone installs it, so watch the project’s releases.

The Dashboard: who can reach it

ingence see starts a small web server, written with Python’s standard library, and binds it to the loopback address 127.0.0.1. There is no option to bind another address. --port chooses the port, and by default the system picks a free one and Ingence prints the address. The pages it serves fetch no script, font or image from anywhere, so it works with networking switched off. It refuses a request whose host name is not its own loopback address, and it accepts a change only from a request that carries a header another web page cannot set. A web page open in the user’s browser therefore cannot read it or write to it.

The limit: the Dashboard has no accounts and no sign-in. While it runs, any program and any person logged in to the same computer can use it, read the project it shows, add to the log of decisions, and use its landing page to list the folder names inside any folder typed into it. Other computers cannot reach it. Do not run it on a shared server or a shared workstation. Where a machine has several users, run it only while you are the one logged in, and stop it when you are done. This is described in the security policy (Community).

While the Dashboard runs a first reading or a re-run, it starts one helper process of Ingence’s own at a time to do the work.

Installing on a managed machine

Ingence is a Python program with no installer package and no background component. The Install page lists the supported systems and the four ways to install it. For a managed fleet:

• Install per user, into the user’s own folder, with uv tool install, pipx, or pip in a virtual environment. Pin the version, since interfaces still move.

• Where machines cannot reach the public package index, collect the package and everything it depends on into one folder on a connected machine of the same operating system, processor type (Intel or Apple silicon, for example) and Python version, move the folder, and install from it with no network:

  pip download ingence -d ingence-packages
  pip install --no-index --find-links ingence-packages ingence
  

  Use your own package mirror instead if you keep one.

• The base install needs no graphics card and no compiler. The target machine has about 12 GB of memory and four to eight cores.

• Ingence’s own code is under the MIT license. Each dependency keeps its own license and notice, which are listed in the file NOTICE in the source.

To remove it, uninstall it with the tool that installed it, delete the project folders you made, and delete the settings folder named above. Nothing else is left behind, except that a Dashboard that is killed instead of stopped can leave a temporary folder whose name begins ingence-explorer- in the system’s temporary folder; it is safe to delete.

What to ask the maintainers

Ingence has one maintainer (Community). A security problem is reported privately, never in a public issue. If something here does not match what you see on your machine, that is a fault in this page or in Ingence, and the maintainer wants to know (Reporting a problem).