Security
We built it so we
cannot read your files.
Privacy that depends on trusting a company is a promise. Privacy that comes from the design is a property. Ferry is built for the second kind.
How it works
Eight decisions that protect a transfer.
Sealed in your browser
Each file is encrypted on the sending device. The server only ever handles bytes it cannot read.
Keys stay with you
Keys are made on your devices. For a link, the key sits in the part after the # symbol, which browsers never send to a server.
Direct when possible
Devices connect to each other first. A relay is used only when a direct path fails, and it carries encrypted traffic.
Verify the person
Paired devices show a short code that you can compare, so you know you are talking to the right device.
Short lives
You choose how long a held file stays, from 1 hour up to 7 days. It is deleted then, and you can remove it sooner.
Optional password
Add a password to a held file. It is used in your browser to make the key, and it is never sent to us. We cannot reset it.
Accounts opened by hand
Each access request is read by a person before an account opens, and the admin area needs a password and an authenticator code.
Read the code
The code is public on GitHub. Every claim on this page can be checked against it.
Accounts and held files
What we store, and what we cannot see.
What Ferry stores
- Your email, name, plan and last sign-in. Sign-in itself is handled by Kinde.
- Each held file, as sealed bytes in Cloudflare R2, until it expires.
- Its size, its expiry and how many times it was opened.
- The history you choose to keep, and a one-way hash of each agent key.
What Ferry cannot see
- What is inside a file, or its name or type. All three are sealed in your browser.
- The key. It lives in the link, after the # sign, which browsers never send.
- Your password for a file, if you set one. It stays on your device.
- Anything about a direct send. It goes from device to device and is never stored.
The operator can see how many files were sent and held, who owns each held file, its size and its expiry, so that storage can be managed and abuse can be handled. That is all. File contents and names are not available to anyone at Ferry, including the operator.
What we do not claim
Being honest about limits is part of security.
- Ferry has not had an independent security audit.
- It does not hold a SOC 2 or ISO 27001 certification.
- Anyone who has a link with its key can open the file, unless it has a password. Share links with care.
- A password protects a file only if it is a good one and is sent by a different route from the link. We cannot recover a lost password, or the file.
- Ferry cannot protect a device that is already compromised.
Report an issue
Found a weakness? Tell us.
Report it privately, with steps to reproduce it, using the feedback page or me@sholajegede.com. Please give us a reasonable time to fix a problem before you publish it. See also the subprocessor list and the privacy policy.