Security overview

The short version

Ferflow is not a hosted service. It runs as a Docker image on a server you own, against databases you already have. Dashboards, queries, credentials and query results stay inside your network. They are never sent to us, because there is nowhere in our systems for them to go.

What leaves your network

• License activation. One HTTPS request to ferflow.com carrying your serial number, the server hardware ID, and whether it runs Linux or Windows. Nothing else. You can skip it entirely and install the license files by hand on an air-gapped server.
• Microsoft sign-in endpoints. Only if you switch on Azure SSO, and only to authenticate your own users.
• Your own LDAP and database servers, wherever you point Ferflow.

That is the complete list. No analytics, no usage telemetry, no crash reporting, and no license check while the product runs. An install whose license is already in place needs no connection to us at all.

Inside your install

• Data-source credentials are encrypted with AES-256-CBC before storage, under a key generated on first start and kept on that install's own volume. We never hold it and cannot read your backups.
• User passwords are hashed with bcrypt. Local accounts, LDAP and Azure SSO work separately or together.
• Sessions are signed tokens with a seven-day expiry, signed by a secret unique to your install.
• Roles are admin, user and viewer on every package, plus manager on Business and Corporate, with per-dashboard view, edit and manage access on top. Data sources and datamarts are admin-only, and a viewer can neither reach them nor create dashboards. The full breakdown is in user roles & responsibilities.
• Queries - custom SQL, the visual query builder and the AI assistant all run inside a read-only transaction, as a database role that can only read the analytics schema. Whatever SQL a user writes, the database itself refuses to show them Ferflow's own tables, read server files, or change anything.
• Network surface is one published port, 7070 over HTTPS. The bundled Postgres is reachable only on the internal Docker network, never from your LAN or the internet.
• TLS starts with a self-signed certificate generated on first run, so nothing is served in the clear. Put your own certificate or a reverse proxy in front for production; the deployment guide covers both.
• Administrative actions are recorded in the instance's own log against the user who performed them.

Integrity of what we ship

Every license is signed with an Ed25519 key that never leaves our signing service, and is bound to the hardware identity of the server it was issued for. The application ships encrypted and is decrypted at start only after that signature and binding check pass, under a key derived per customer — so one customer's encrypted build cannot be opened on another customer's deployment. Database schema upgrades apply automatically on start, and every release is listed on the release notes page.

What we hold about you

Only what running a shop requires: the name and email address from your Google sign-in, your orders and license records, the hardware ID you register, and support correspondence. Payments are processed by PayPal and Xendit, so card numbers never touch our servers. We are the controller of that account data, and not a processor of the business data inside your instance. A data processing addendum is available on request.

What we do not have

No SOC 2 report, no ISO 27001 certificate, no bug bounty programme. Saying so plainly is more useful than a vague claim: if your process requires a certified vendor, we will not pass it today. What we offer instead is an architecture where sensitive data never reaches us, written answers to your security questionnaire, and a call with the person who wrote the code.

Reporting a vulnerability

Email support@ferflow.com with steps to reproduce. We aim to acknowledge within 3 business days and to keep you updated until it is resolved. Please allow a reasonable window for a fix before publishing. We will not pursue researchers who act in good faith, stay within their own installs, and do not access anyone else's data.