Security at Ferrybox
Your clients trust you with their unreleased work. Here's how we protect it.
Encryption
Data is encrypted in transit with TLS 1.3 and at rest with AES-256.
Single sign-on
SSO with Google and Microsoft on Agency; SAML and SCIM on Enterprise.
Data residency
Enterprise workspaces choose where their data is stored: the EU or the US.
Audit log
Every approval and download is recorded with a name and a timestamp.
Backups
Daily backups, kept for 30 days, stored separately from production data.
Responsible disclosure
Found a vulnerability? Write to security@ferrybox.example and we will reply within two working days.
Security questions
How often is Ferrybox tested?
An independent firm runs a penetration test once a year and after major changes to how we handle files or sign-in. Enterprise customers can request the summary under NDA.
Which sub-processors do you use?
We keep a current list of sub-processors – hosting, email delivery and payments – with what each one processes and where. Enterprise customers are notified 30 days before a new one is added.
What happens to our data if we cancel?
You can export everything for 30 days after cancelling. After that, your workspace and files are deleted, and removed from backups when they expire 30 days later.