Core Principles
Every request is re-verified on each call, not at login.
PoW, brute-force lockout, 2FA, passkeys — layered, not singular.
RBAC: each role accesses only what it needs — nothing more.
HSTS, secure cookies, and AES-256-GCM at rest — safe by default.
Protected by Default, Not by Accident
Every login is protected by bcrypt password hashing with HIBP breach checks, TOTP 2FA, and WebAuthn passkeys. Repeated failed attempts trigger an automatic lockout, capped at an 8-second delay.
Data is encrypted with AES-256-GCM at rest and HSTS in transit, access follows role-based control (RBAC), and every session can be viewed or revoked remotely. Spotted something off? Contact our security team directly.
No layer of protection stands alone
Zero Trust means every request gets re-verified — that's why Proof of Work runs on every auth call and sessions can be revoked individually, not just at login.
Defense in Depth is why a compromised password alone isn't enough: brute-force lockout, breach-database checks, 2FA, and passkeys each cover for the others. Least Privilege keeps that same discipline inside every role, every session.
Least Privilege is enforced server-side, not just hidden in the UI: every sensitive route checks the caller's role and feature permission before running — an Owner-only action stays blocked for every other role, even if someone calls the API directly.
Sensitive data stays encrypted at rest with AES-256-GCM, and every permission-gated action is written to an audit log — so "least privilege" isn't just who can click a button, it's a record of who actually did what, and when.
Every safeguard below exists because a principle demanded it.
TOTP-based 2FA with backup recovery codes
+ Details− ClosePasswordless login via WebAuthn and device biometrics
+ Details− CloseAutomatic lockout after repeated failed login attempts
+ Details− ClosePasswords verified against known breach databases
+ Details− CloseAnti-bot challenge on all auth endpoints, no CAPTCHA
+ Details− CloseView and revoke all sessions remotely, any time
+ Details− CloseYour data, your control
Every connection to our app runs over HTTPS with HSTS enforced, so data moving between your device and our servers can't be downgraded to an unencrypted connection — even by accident.
Under GDPR, CCPA, LGPD, and PIPEDA, you have the right to access, download, correct, or delete your personal data at any time — not just request it, but actually get it done through a real form we handle directly.
Security and privacy rights, working together.
Request Your Data
Your AI Agent Connect the AI agent you already trust — by voice or by text — and it generates your content directly on Ferrer, tailored to your business and your goals.
Working For You No account managers. No meetings. No calls. Once your content is ready, share it natively, straight from your phone, to whichever platforms you choose — no third-party ad APIs, no OAuth, no middleman.
Always Supervised Our team stays behind the scenes, quietly refining and supervising every result for quality — you'll never need to talk to a person to get results.
Your access token expires after 15 minutes and silently refreshes in the background while you're active. The underlying session (tracked in Active Sessions) lasts up to 14 days, or until you sign out or revoke it manually.
Yes. Every connection is served over HTTPS, and we send a Strict-Transport-Security header (HSTS) so browsers refuse to fall back to an unencrypted connection, even by mistake.
Use our Request Your Data form to access, download, correct, or delete your personal data. Requests are handled under GDPR, CCPA, LGPD, and PIPEDA — see our Compliance page for details.
Use our contact form and describe the issue with steps to reproduce. We investigate all reports promptly and treat security disclosures with priority.
We use TOTP-based 2FA — one-time codes from any authenticator app (Google Authenticator, Authy, etc.), plus single-use backup codes generated at setup in case you lose access to your device.
Yes, with a passkey. Sign in with your device's fingerprint, face recognition, or PIN via the WebAuthn standard — credentials never leave your device and can't be phished or reused elsewhere.
Failed logins add a progressive delay — 2s after the 6th attempt, 4s after the 7th, 8s after the 8th and beyond — on top of a hard account lock after 10 failed attempts, lasting 15 minutes.
Yes. At signup and on every password change, we check the Have I Been Pwned database to reject credentials already exposed in a known breach — passwords themselves are always hashed with bcrypt, never stored in plain text.
Before every login or signup, your browser solves a small Proof of Work computational puzzle — a few milliseconds for a real user, expensive at bot scale — which filters automated attacks without ever showing you a CAPTCHA.
Yes. The Active Sessions page lists every device and location currently logged into your account. You can revoke any single session instantly, remotely, without needing to change your password.
