Security and privacy.

In development: this site describes the first release. Details may change before launch.

This page answers the questions the Privacy Commissioner of Canada's guidance asks organisations to put to a service provider: where data goes, who else handles it, what is kept and for how long. It describes the first release, on Mac and Windows; where the two differ, it says so. We will date every change.

Where your data goes

On your computer

The AI models, your documents, your document library and dictation.

Only with your permission

A request to a larger cloud model, Anthropic's Claude or Google's Gemini. Names and identifiers are detected and replaced first, and you see what will be sent.

Off until you allow it

The internet. You choose which connections may go online.

On your computer: The models, your documents and their index, your conversations and dictation.
To a cloud model, only with your consent: The text of your request after names and identifiers are replaced. These requests go through Ferox's relay. Claude requests are processed by a third-party model provider outside Canada; Gemini requests can be processed in Canada (Google Vertex AI, Montréal).
To a search provider, only if you allow web search: Your search terms. They go through Ferox's relay to Brave Search, or straight to DuckDuckGo when cloud features are off.
To Ferox's relay: Your account, credits, payment status and web search terms. Payments are handled by Paddle.
To Ferox, for fixing bugs: Crash reports, if you agree (below).
On Windows, to Microsoft, with your consent: The component that lets Nodus use your graphics card or NPU, downloaded from Microsoft's Windows ML catalogue.
On Windows, to Microsoft: Diagnostic data that Microsoft's app framework (WinUI 3) may send under your Windows settings. Nodus turns this off wherever Microsoft provides a supported way; where it cannot, we will say here exactly what is sent. We are testing it before launch.

What is replaced before a cloud request

Two stages run on your computer: pattern rules (for things like phone and account numbers) and a name-recognition model. Automatic detection can miss things, so check what you send.

When Nodus asks

Before each cloud request it shows the text and the replacements. If you choose "Always allow", it stops asking; requests are still scrubbed, and they are recorded. You can turn it off again in Settings.

What is recorded

Your computer keeps a record of each cloud request. Nodus does not log the content of your questions, and local questions are not logged.

Encryption

Your document index is encrypted (AES-GCM, with keys derived by HKDF). The master key is protected by hardware: on a Mac by the Secure Enclave; on Windows by the PC's TPM security chip, or, on a PC without one, by the most secure method Windows provides, with a notice. Encryption of conversation history is in progress for the first release.

Screen capture on Windows

Nodus is designed to ask Windows to keep its windows out of screenshots, screen recordings and Recall, unless you allow capture in Settings. Windows decides how fully that request is honoured, so we don't claim it is absolute.

Crash reports

Nodus asks once, the first time it opens, whether to send Ferox crash reports. Nothing is sent before you answer; after a yes, a report goes automatically when Nodus crashes, so we can find and fix the bug. Crash reports are designed to contain technical information about the failure only: none of your documents, conversations, dictation or anything you type. They are used to fix problems and are not used to train AI models unless you give specific consent for that. You can change your answer in Settings, and Nodus works the same without them. This is the same on Mac and Windows. Nodus collects no usage analytics and adds no third-party analytics or crash-reporting code; on Windows, Microsoft's app framework is the one exception, described above. Any other problem report is sent only if you choose to send it, after you have seen what it contains.

Models

No models of Chinese origin; each model file is checked against a pinned checksum before it loads; only safe file formats load.

This website

Cookie-free visitor statistics from Plausible; the waitlist form is processed by Formspree; hosting by Cloudflare. Fonts are served from this site.

Privacy and compliance roadmap (as of 2026-11-04)

Done, 2026-11-03: published our vulnerability reporting policy (below), and corrected the privacy policy to say this website uses Plausible.
In progress: encryption of conversation history (before launch).
In progress: internet settings with a per-connection allow list (before launch).
Before launch: a postal address for Ferox AI on the waitlist and in every email we send (a Canada Post box).
Before launch: a test that crash reports from the Mac and Windows release builds carry none of your content, with the result published here.
Before launch: a test of what Microsoft's app framework sends from the Windows app, with the result published here.
Before launch: a privacy impact assessment following the Privacy Commissioner of Canada's guidance, with a summary published here.
Before launch: an independent lawyer's review of this website's claims.
Before launch: publish where the relay is hosted and what it keeps (routine records 30 days; 2 years after a confirmed abuse case).
Preparing for CyberSecure Canada certification (CAN/DGSI 104), target before launch. Not yet certified.
Not done yet: an independent penetration test; a SOC 2 report.

Reporting a vulnerability

Ferox AI builds Ferox Nodus, a privacy-first, local-first AI assistant for regulated professionals. We take the security of our software and of the wider open-source ecosystem we depend on seriously.

Reporting a vulnerability in Ferox Nodus

If you believe you have found a security vulnerability in Ferox Nodus or its cloud relay, please report it privately. Do not open a public issue.

Email: security@feroxai.ca
What to include: a description of the issue, the affected component and version, reproduction steps or a proof-of-concept, and the impact you believe it has.

Our commitment to reporters

We will acknowledge your report within 5 working days.
We will provide an assessment and expected remediation timeline within 10 working days.
We will keep you informed as we work on a fix, and we will credit you (with your consent) when the fix is released.
We support coordinated disclosure and ask that you give us a reasonable opportunity to remediate before any public disclosure. Our default embargo is 90 days from acknowledgment, which we will shorten where a fix ships sooner and may extend by mutual agreement for complex issues.

Safe harbour

We will not pursue or support legal action against researchers who:

act in good faith and in accordance with this policy;
test only against their own installations or accounts, or ours with prior written permission;
avoid privacy violations, data destruction, and any degradation of service to others;
do not access, modify, or retain data belonging to other users; and
give us a reasonable time to remediate before public disclosure.

Out of scope

Denial-of-service and volumetric testing.
Social engineering of Ferox AI staff, users, or contractors.
Findings in third-party services we use (report those to the relevant provider).
Reports without a demonstrable security impact (e.g. missing headers with no exploit path).

Our coordinated disclosure of vulnerabilities in dependencies

Ferox Nodus depends on a large open-source supply chain. As part of hardening our own software, we perform security analysis of the dependencies present in our software bill of materials (SBOM). When that analysis surfaces a vulnerability in an upstream open-source component, we follow coordinated disclosure:

We report the issue privately to the upstream maintainer through their published security channel (or, if none exists, through a reasonable private channel such as the maintainer's listed contact or the RustSec/GitHub advisory process).
We provide a clear technical description, reproduction, and, where we can, a suggested remediation.
We observe a 90-day default embargo from the date the maintainer acknowledges the report before any public disclosure, extending it by agreement where remediation is genuinely complex, and shortening it where a fix ships sooner or the issue is already public.
We do not publish exploit code for an unpatched dependency vulnerability.
Our research is confined to components already present in our own SBOM. We do not conduct untargeted, opportunistic testing of arbitrary third-party software.

This policy governs all AI-assisted security research Ferox AI conducts, including work performed under authorized advanced tooling.

Last updated: 2026-11-03