This policy describes the personal data collected by FerrLabs (Bryan Ferrando, sole proprietor, SIREN 104 243 951) acting as data controller for the FerrVault service, in accordance with the GDPR.
Encryption architecture
FerrVault uses envelope encryption. Each secret value is encrypted with AES-256-GCM under its own data encryption key (DEK), and each DEK is wrapped by the key encryption key (KEK) of its vault. The database stores only ciphertext and wrapped keys.
KEKs never leave the key management service that holds them. By default it is a key FerrVault manages for you in OVHcloud KMS, or in FerrVault's own key service, whose root key is itself held in OVHcloud KMS; both run in France (Paris region). You can instead use a key from your own KMS, which then stays under your own contract with that provider.
Decryption happens on our servers. To serve an authorized read, the FerrVault API asks the KMS to unwrap the DEK and decrypts the value in memory for that request only. Plaintext is never written to disk or to logs, and every read is recorded in the audit log. FerrLabs staff have no routine access to secret values, but FerrVault is not end-to-end encrypted: the service is technically able to decrypt the secrets it serves to you.
Data collected
- Account: your FerrLabs account identifier. Sign-in, email address, display name and password are handled by the FerrLabs account service; FerrVault reads your name and email from it to show who has access to a vault.
- Organization: name, slug, team size, country.
- Vaults and secrets metadata: vault name, slug, description, owner, members, role assignments. Secret name, version history, last rotation timestamp. The secret content, stored encrypted as described above.
- Audit log: every secret access (read, write, rotation, share) with actor, IP address, user-agent, timestamp.
-
Cookies:
fl_session(httpOnly, SameSite=Lax, 7-day lifetime), strictly necessary for authentication. - Server logs: 30-day retention.
Purposes
- Authentication and access to the service.
- Storage and synchronization of your encrypted secrets.
- Operation, integrity and security of the platform (audit log, abuse detection).
- Billing of paid subscriptions.
- Compliance with legal obligations.
Legal bases (GDPR art. 6)
- Performance of the contract (6.1.b) for accounts, vaults and subscriptions.
- Legitimate interest (6.1.f) for security, audit log and server logs.
- Legal obligation (6.1.c) for accounting and tax data.
Sub-processors
- OVH SAS: primary hosting (France).
- OVH SAS: OVHcloud KMS for key custody (KEKs), Paris region. The KMS holds wrapping keys only; secret content, encrypted or not, is never sent to it.
- Stripe Inc.: payments (United States, certified under the Data Privacy Framework), active when a paid subscription is activated.
- Resend: transactional emails, active when transactional emails are sent.
Audit log
FerrVault records every access to a secret in an append-only audit log: actor (user or service token), source IP address, user-agent, timestamp, action (read, write, rotation, share), and the affected secret reference. The audit log records metadata only: never the content of the secret.
Retention: 90 days, after which entries are purged.
Retention period
| Data | Retention |
|---|---|
| Active account, vaults, encrypted secrets | For the lifetime of the workspace |
| Deleted account or workspace | 30 days, then permanent purge |
| Audit log | 90 days |
| Server logs | 30 days |
| Billing data | 10 years (art. L.123-22 of the French Commercial Code) |
Your rights
Under the GDPR, you have the rights of access, rectification, erasure, portability, objection, and restriction of processing. The values of your secrets remain available to you at any time through the app, the API and the CLI.
To exercise your rights: privacy@ferrlabs.com.
You may also lodge a complaint with the CNIL (cnil.fr).
Data Protection Officer (DPO)
FerrLabs has not appointed a DPO. This is not required for a sole proprietorship that does not carry out large-scale processing of sensitive data (GDPR art. 37).
Transfers outside the European Union
Where applicable, transfers occur to sub-processors located in countries with an adequacy decision or certified under the Data Privacy Framework (Stripe Inc., United States). The primary data store and key custody (both OVH, France) are located in the European Union.
Changes
This policy may be updated. The date of the last revision is shown at the top of this page.