Skip to content

License check and privacy

Ferrule runs on your Docker host and keeps what it learns there. This page lists everything that crosses the internet, and what it carries.

The license check

Only an install with a license key checks it. The trial and Community have no key, so they never check, and neither does an offline key.

What happens: once a day, and when Ferrule starts, it downloads a short list from https://license.ferrulehq.dev/revoked. Until a new key is confirmed it tries hourly, so a new key is usually confirmed within about two hours.

What the list holds: fingerprints (SHA-256) of keys that have been withdrawn, such as a key that leaked, and when the list was signed. The list is signed, and Ferrule ignores one whose signature doesn't check out. Ferrule compares your key's fingerprint with the list on your own host.

What it sends: nothing about you, your network or your equipment. It's a plain download. Like any web request, the server sees your public IP address, and the request names the software as ferrule/ and its version number.

If it can't reach the list: your key keeps working. After 30 days without a confirmation the paid features pause until one gets through, with a warning in Needs attention a week before. Monitoring, alerts and sign-in never stop. A withdrawn key pauses the paid features at once.

For a site with no internet access, ask for an offline key. It never checks in, and lasts up to a year.

The key itself is checked by its signature on your host, with no network needed. See Enter your license for what the license panel shows.

The assistant

The assistant is off until you add a model, and it sends only when someone clicks Analyse.

  • A model on your network, such as llama.cpp, LM Studio or Ollama on your own machine: nothing leaves your network.
  • A hosted model (Claude, OpenAI, Gemini or xAI): the question goes to that provider, under your own API key and their terms. Only admins can ask one.

What a question holds, which the panel shows before sending:

  • the readings and alerts for that one alert, device or system;
  • if ticked, the last 7 days of the archive about it: alerts, reboots, firmware changes and outages;
  • never a password, key or token.

With Replace names, addresses and serials ticked, the default for a hosted model, the names of your sources, hosts, VMs, devices, cameras and NVR, their serials, and every IP and MAC address are replaced with stand-ins such as HOST-1 before sending, and put back in the answer. Other text the readings carry, such as disk and volume names, goes as it is: check See exactly what will be sent if it matters.

What you send on purpose

These go only where you point them:

  • Notifications, to the channels you set up: Gotify, ntfy, Pushover, Discord, email, Slack, Teams, PagerDuty, Apprise or a webhook. Each carries the alert's text.
  • Backups, to your share or your S3 bucket, encrypted if you set BACKUP_KEY.
  • Docker downloads Ferrule's image from ghcr.io, and the others from Docker Hub, when you deploy.

Nothing else

Ferrule has no analytics and no usage reporting. Apart from the above, it talks only to the equipment you connect it to.

One thing your browser does: the dashboard page loads its typefaces from Google Fonts.