Trust center
Where your files go,
and what we have not done.
Plain answers for the person who has to approve Ferry: what is stored, who can see it, how long it stays, who helps us run it, and where we fall short.
Controls
Eight things that protect a transfer.
Sealed on the sender's device
Files, names and text are encrypted with AES-256-GCM before they leave the device that sends them.
The key never reaches us
For a link, the key sits after the # sign, and browsers never send that part to a server.
Direct first
Devices connect to each other. A relay is used only when a direct path fails, and it carries encrypted traffic.
A code you can check
A guest who joins with the 6-digit code is admitted only after the host compares the security code on both screens.
Files that end
A held file lasts from 1 hour to 7 days and is deleted then. A direct link ends after 24 hours.
Keys with limits
An agent key can send, list, or both. It can have a size limit and an expiry, and you can revoke it at once. We store only a one-way hash.
People open accounts
Each access request is read by a person. The admin area needs a password and an authenticator code.
Code you can read
The source is public on GitHub, so each claim on this page can be checked against it.
Data
What we store, where, and for how long.
| Data | Where | How long | Who can see it |
|---|---|---|---|
| A held file | Cloudflare R2, as sealed bytes | Until it expires, 1 hour to 7 days, or until you remove it | Nobody can read it. The operator sees its owner, size, expiry and open count. |
| Your account | Convex. Sign-in is handled by Kinde. | Until you delete the account | The operator: email, name, plan and last sign-in. |
| History you choose to save | Convex | Until you delete it | The operator, in the database: file name, size, type, direction and device name. |
| An agent key | Convex, as a one-way hash | Until it is revoked or expires | Nobody. The key is shown once, when you make it. |
| A direct transfer | Not stored | Not kept | Nobody. It goes from device to device. |
| Usage counts | Convex, as totals for each day | Kept as totals | The operator, with no link to a person. |
You can export or delete your data from the Your data page in the dashboard. A deleted account removes its held files and keys.
Subprocessors
The companies that help us run Ferry.
| Company | What it does for Ferry | What it can see |
|---|---|---|
| Vercel | Hosts the website and runs its servers. | Web requests, including IP addresses, as any host sees them. |
| Convex | The database for devices, rooms, accounts, history and held-file records. | Account and device records, and sealed file metadata. Not file contents or keys. |
| Cloudflare | Stores sealed held files (R2), relays traffic when a direct path fails (TURN), and runs DNS. | Sealed bytes it cannot read, and relay traffic that is already encrypted. |
| Kinde | Sign-in for accounts. | Your email address and sign-in details. |
| Resend | Sends emails about access requests and invitations. | Your email address and the message. |
| Public STUN servers that help two devices find a direct route. | Network addresses of the devices, as part of finding a route. |
Gaps
What we have not done yet.
- Ferry has not had an independent security audit or a penetration test.
- It does not hold a SOC 2 or ISO 27001 report.
- Anyone with a full link can open the file, unless it has a password. Share links with care.
- A file's password cannot be reset. If it is lost, so is the file.
- Ferry cannot protect a device that is already compromised, or a file after it is saved.
- The operator is one person. There is no 24-hour security team.
Documents
Read the rules.
- SecurityHow a transfer is protected, and what we do not claim.
- Privacy policyWhat we collect, why, and how to ask us to delete it.
- SubprocessorsThe companies that help run Ferry, and what each can see.
- Acceptable useWhat you may and may not do with Ferry.
- TermsThe rules for using Ferry.
- CookiesEvery cookie and storage key, and your choice.
- Source codePublished under the Functional Source License. Read every claim in the code.
Report an issue
Found a weakness? Tell us in private.
Open the Security tab of the repository and choose Report a vulnerability. Include the steps to reproduce it and what an attacker could do. Please give us reasonable time to fix a problem before you publish it.
Incidents
If an incident ever affects customer data, we will list it here with what happened, who was affected and what changed. None are listed today.
A security questionnaire?
Send it to us at me@sholajegede.com. We answer in writing, and we point to the code for each claim.
Last updated 28 October 2026.