Security
No telemetry. No data collection. Your hardware data stays on your network.
No Telemetry
Ferqon Server does not collect usage statistics, performance metrics, or behavioral data. Your work remains completely private.
Offline First
Core Ferqon functionality works completely offline. Build, flash, and test embedded systems without any internet dependency.
Cryptographic Licenses
License keys use Ed25519 cryptographic signatures for tamper-proof validation. No personal data embedded in licenses.
Local-First Data
Your project files, build artifacts, and configurations stay on your machines. No cloud sync or forced data uploads.
Security model
Defense in depth, by default
Self-hosted means your data stays on your network. These layers keep it protected there.
JWT authentication & sessions
Token-based auth with refresh, session management, and pairing codes for device flows. WebSocket connections are authenticated.
Multi-factor authentication
TOTP-based MFA with encrypted secret storage, recovery codes, and audit-logged enrollment and verification.
CSRF protection
State-changing endpoints require validated CSRF tokens, with exemptions only for explicitly flagged API keys.
Rate limiting
Per-IP and per-user token-bucket rate limiting, with stricter limits on authentication and pairing-code endpoints.
Content-Security-Policy
CSP headers on UI responses with configurable frame-ancestors and resource domains. No hardcoded fallbacks.
Request size limiting
Configurable request size limits with per-path overrides to bound upload and payload sizes.
AES-256-GCM encrypted store
Sensitive configuration is encrypted at rest with AES-256-GCM, keys derived via HKDF-SHA256 from a master key.
Ed25519-signed licenses
Licenses are JSON tokens signed with Ed25519. Signature verification gates tier features and update windows.
Offline activation
Air-gapped deployments activate via a challenge-response flow with nonce caching — no call-home required.
RBAC & scopes
Role-based access control with scoped permissions across IO pins, teams, and administration.
Audit logging
Two audit streams: action audit (flash, test, transfer) and auth audit (login, method, path, status, principal, IP).
Reliability model
Built to stay usable under pressure
Degraded modes, grace windows, and observability keep the server operational when things go wrong.
Degraded mode
If a license is invalid (bad signature, past-grace expiry, revocation, or vendor-detected clone), the server silently falls back to free-tier features. No 5xx errors; admin reads keep working.
Grace windows
14-day online and offline grace periods keep the server operational during transient license or connectivity issues.
Prometheus metrics
Metrics exposed at /metrics cover uploads, diagnostics bundles, remediation, and device scans.
Grafana dashboards
Grafana ships with the compose stack and auto-loads dashboards for runtime observability.
Structured audit trail
Every flash and test produces structured, queryable logs — not tribal knowledge. History is preserved across restarts.
Diagnostics & remediation
Site admins can upload redacted support bundles, inspect bundle history, and trigger guarded remediation actions.
Deterministic pipelines
Build, flash, and test stages live in a single version-controlled definition, so a pipeline runs the same way every time.
Air-gapped deployment
Offline activation and offline grace windows support fully air-gapped environments with no external network dependency.
Data Transparency
What We Collect vs. What We Don't
Minimal Data Collection
- Email address (optional, for license delivery)
- License key and activation status
- Support request details (when you contact us)
What We Never Collect
- Usage statistics or analytics
- Project files or source code
- Build configurations or device profiles
- System information or hardware details
Privacy Commitments
GDPR Aligned
Our data practices follow GDPR principles: minimal collection, lawful basis for processing, data subject rights support, and subprocessor transparency. DPA available on request.
CCPA Aligned
California residents can request data access, deletion, and opt-out of sale. We do not sell personal data. Contact our privacy email to exercise your rights.
No Tracking
Zero third-party analytics or marketing cookies
Signing Keys
License Signing Key Rotation
Ferqon licenses are signed with Ed25519 cryptographic keys. We maintain a rotation schedule to ensure key security and support smooth transitions.
Current: FERQON_LICENSE_SIGNER_PUBLIC_KEY
Active for all new licenses
Previous: FERQON_LICENSE_PUBLIC_KEY_V1
Grace period ended 2025-12-31. No longer accepted.
Ferqon Server accepts keys from the current and previous versions during the grace period. After the grace period, only the current key is accepted.
Organizational Security
Security for Organizations
Current Capabilities
- Air-gapped deployment support
- On-premises license server options
- Custom security audits available
- Source code escrow for premium customers
Roadmap
- Zero-trust architecture enhancements
SOC 2 and ISO 27001 details are in the compliance roadmap below.
Software Bill of Materials
Transparency Through SBOM
We generate Software Bill of Materials (SBOM) for Ferqon releases in CycloneDX format. This provides complete visibility into dependencies and their versions.
SBOMs available on request during early access
Automated SBOM publication is being set up. During early access, contact our security email to request the current SBOM for any Ferqon component. security@revyrlabs.com
SBOMs are generated using cyclonedx-npm and syft. Historical SBOMs will be available for all past releases once automated publication is live.
Responsible Disclosure
Report Security Vulnerabilities
We welcome responsible security research. If you discover a vulnerability, please report it to us following our disclosure policy.
Email our security address
Use PGP encryption for sensitive reports. Request our public key by replying to that address.
Include details
Describe the vulnerability, steps to reproduce, and potential impact.
We respond within 48 hours
We'll acknowledge receipt and provide a timeline for remediation.
Bounty program
We offer a bounty for valid security findings. Contact us for details.
Compliance roadmap
SOC 2 Type II & ISO 27001 — planned
Ferqon is in early access. The phases below are our planned path to formal certification — targets are plans, not commitments, and may shift with the product roadmap.
Phase 1: Foundation
Target: 2026-09-30
- Security policy documentation
- Access control review
- Incident response procedures
- Vendor risk assessment
Phase 2: Implementation
Target: 2026-12-31
- MFA enforcement
- Log aggregation and monitoring
- Vulnerability scanning automation
- Penetration testing program
Phase 3: Audit prep
Target: 2027-06-30
- Pre-audit assessment
- Gap remediation
- Control documentation
- Evidence collection
Phase 4: Certification
Target: 2027-12-31
- SOC 2 Type II audit
- ISO 27001 certification
- Public trust center launch
Status & audit
Uptime reporting
Automated uptime reporting is being integrated. In the meantime, see the status page for the current operational state of Revyr-operated services.
Audit trail
Security-relevant actions (license issuance, key rotation, admin access, authentication events) are recorded and retained. A public, sanitized event feed will be published once automated reporting is available.
Security Contact
security@revyrlabs.com
Security vulnerabilities and concerns
privacy@revyrlabs.com
Data protection and privacy requests
We respond to all security-related inquiries within 24 hours.
Documentation
Privacy Policy
Complete privacy and data handling details
Acceptable Use Policy
Permitted and prohibited uses of our services
All legal documents are regularly reviewed and updated.