Ferrite.“Zero telemetry” is a claim. Here’s how to check it.
Every firewall vendor says some version of “we don’t spy on you.” That’s not verifiable by itself — trusting a claim about a firewall, of all things, should feel wrong. So here’s exactly how to check three separate things yourself, with tools you already have.
1. The installer is the installer we published
We publish the SHA-256 hash of every release next to the download link. Before you run the installer, open PowerShell and check it matches:
Get-FileHash .\Ferrite_{version}_x64-setup.exe -Algorithm SHA256Compare the output against the hash on the download page. If they don’t match — for whatever reason, including a corrupted download — don’t run it. This is the same step the download page’s own SmartScreen guidance walks through.
2. Updates are signed, not just downloaded over HTTPS
Auto-updates are verified with minisign — an update has to carry a valid signature from our bundled public key before Ferrite will install it, independent of whether the connection itself was secure. That means a compromised or spoofed update server can’t push a malicious update; it would need our private signing key, which we never ship and never publish.
3. Nothing about your connections leaves your machine
This is the one you don’t have to take our word for — it’s directly observable. With Ferrite running:
- Watch it with your own network monitor. Resource Monitor (built into Windows —
resmon.exe→ Network tab) or Wireshark will show you every connection Ferrite’s own processes make. You’ll see the signed-update check against our update server, and — only if you’ve turned one on — the secure-DNS provider you explicitly configured. Nothing else, because there isn’t anything else: no analytics endpoint, no crash-reporting service, no background phone-home. - Compare against the in-app claim. The dashboard’s own network activity view is drawn from the same data Ferrite itself sees — if it were hiding a connection from you, it would have to hide it from its own visibility engine too, which is the thing the whole product exists to prevent.
- Check what leaves the website, separately. ferritesec.com itself runs no analytics scripts and sets no cookies — see the privacy policy for the complete, short accounting. The app and the website are different things, deliberately kept to different promises, so neither claim has to lean on the other.
What “zero telemetry” does not mean
It doesn’t mean Ferrite is offline. It makes exactly two kinds of outbound connection on its own: the signed update check, and — only when you turn one on — the secure-DNS provider you picked. Both are visible in the same network monitor from step 3. If you configure Enterprise SIEM/webhook forwarding, that’s a third, and it’s something you turned on and pointed somewhere you chose — not a hidden default.