End User License Agreement

Last updated · August 13, 2026

This End User License Agreement (“EULA” or “Agreement”) is a binding legal contract between you (an individual or a single legal entity, “you”) the sole proprietor operating as Ferrite Security (“Ferrite,” “we,” “us,” “our”) — for the registered legal entity behind Ferrite Security, contact admin@ferritesec.com, governing your installation and use of the Ferrite Desktop Firewall software, including its installer, executables, bundled components, updates, and accompanying documentation (the “Software”).

Read this Agreement carefully. By downloading, installing, copying, activating a license for, or otherwise using the Software, you accept this Agreement in full. If you do not agree, do not install or use the Software, and — if you purchased a subscription — request a refund under the Refund Policy within the refund window.

This EULA governs your use of the Software. Your purchase of a subscription and your use of ferritesec.com are additionally governed by the Terms of Service. Your data is handled per the Privacy Policy. In the event of a direct conflict between this EULA and the Terms of Service on a licensing question, this EULA controls; on a purchase, billing, or website question, the Terms of Service control.

1. The nature of the Software — read this first

Ferrite is a host-based personal firewall and network-observability tool for Microsoft Windows. You must understand what it is and what it is not before you rely on it.

It is a host firewall, not a network appliance. Ferrite protects the single Windows machine it is installed on. It is not a perimeter firewall, router, IDS/IPS appliance, or managed security service.

It ships no kernel driver of its own. Ferrite’s enforcement uses Microsoft’s built-in Windows Filtering Platform (WFP) application-layer filters, the operating system’s own DNS path, and connection tracking. Ferrite does, however, bundle and install one third-party kernel driver, WinDivert, which powers the deep-inspection features and is separately licensed to you under the LGPL-3.0 (see §7). Deep inspection is the only capability that requires it, and it may be removed or replaced.

It runs with high privilege. To enforce policy, the Software’s enforcement component runs with elevated Windows privileges, up to and including the LocalSystem account. You authorize it to operate at that level solely to perform its firewall, DNS, and observability functions, and are responsible for the physical and account security of any machine on which you grant it that privilege.

It cannot guarantee your security and cannot replace defense-in-depth. A firewall is one layer of a security posture. We do not, and cannot, warrant that the Software will detect, classify, block, or alert on every threat, malicious connection, data-exfiltration attempt, or DNS-bypass technique — present or future. You remain responsible for your overall security strategy. Do not rely on Ferrite as your sole protection.

No Ferrite kernel driver means lower bluescreen risk, not zero risk. Because Ferrite ships no kernel-mode filter driver of its own, its own code does not carry the class of risk associated with a faulty kernel driver. The bundled third-party WinDivert driver (§7) is kernel-mode and does carry that class of risk while deep inspection is in use; it can be removed. This is a meaningful risk reduction, not a warranty of system stability (see §10–11).

2. Subscription license grant

Tiers. Free: the core firewall, DNS handling, and observability surface — no paid subscription and no license key required. Pro: a paid, recurring subscription that unlocks the Pro feature set (unlimited rules, deep inspection where installed, extended log retention, advanced analytics, and other features described at point of sale). Pro requires a valid, current license credential.

Grant. Subject to your continuous compliance with this Agreement and, for Pro, your payment of the applicable subscription fees, we grant you a personal, limited, non-exclusive, non-transferable, non-sublicensable, revocable license to install and run the Software: on Free, on any number of Windows devices you own or control; on Pro, on one (1) device per subscription (the device your license key is activated on) for as long as your subscription is current and paid. To move a Pro seat to a different device, deactivate it on the current device first, then activate on the new one.

Subscription, not sale. Pro is licensed on a subscription basis, not sold. Your right to use Pro features exists only while your subscription is active and paid. The license is term-limited and ends when the subscription ends (by cancellation, non-payment, expiry, or termination), at which point the Software reverts to Free-tier behavior — your locally stored rules, profiles, and settings are retained and continue to operate within Free-tier limits.

License credential. Pro is unlocked by a license credential — a Polar-issued key (delivered by email on purchase) or a signed .ferritelic file — cryptographically verified by us. The credential is bound to a locally computed device identifier (a hash derived from the machine; see the Privacy Policy). You may not share, publish, resell, or sublicense the credential.

Ownership. The Software is licensed, not sold. We and our licensors retain all right, title, and interest in and to the Software, including all intellectual property rights. No rights are granted to you except those expressly stated here.

3. License restrictions

You shall not, and shall not permit any third party to: reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying algorithms, or structure of the Software, except to the precise extent applicable law expressly prohibits such a restriction; copy, distribute, sublicense, rent, lease, lend, sell, resell, or commercially host the Software or any license credential; modify, adapt, translate, or create derivative works of the Software, or remove, alter, or obscure any proprietary notice, trademark, or label; circumvent, disable, or tamper with license verification, tier gating, integrity checks, update signing, or any technical protection measure; use the Software to monitor, intercept, filter, or interfere with network traffic on systems or networks you do not own or are not authorized to administer — unauthorized monitoring may violate wiretapping, computer-misuse, and privacy laws, which is your responsibility, not ours; use the Software to bypass, defeat, or attack the security measures of systems you do not own; use the Software in any unlawful manner; or use the Software in high-risk environments requiring fail-safe performance (life-support, aircraft navigation, nuclear facilities, weapons systems, or any context where failure could lead to death, personal injury, or severe physical or environmental damage), for which the Software is not designed, intended, or licensed.

4. Privilege, elevation, and your responsibilities

Installing the Software per-machine, and enabling enforcement, requires Windows administrator consent; the enforcement component may run as LocalSystem. By proceeding through those prompts you knowingly grant the Software that privilege for its stated purpose. You are responsible for configuring rules and profiles appropriately for your environment, understanding that an overly strict rule set can block legitimate traffic, testing policy changes, and maintaining your own backups — we are not responsible for connectivity loss, application breakage, or business interruption caused by rules or settings you configured.

The Software contains no advertising SDK, no third-party telemetry broker, and does not sell or share your data. The only outbound connections it initiates are the limited, documented ones described in the Privacy Policy (a signed update check, and a license activation check if you enter a Pro credential) plus destinations you explicitly configure (your chosen DNS resolvers, webhooks, SIEM forwarding).

5. License activation and verification

If you activate Pro, the Software verifies the cryptographic signature and validity of your license credential — locally against an embedded public key for a .ferritelic file, or via the licensing service for a Polar key. The data involved is limited and described in the Privacy Policy. You may not tamper with, spoof, or bypass this verification.

6. Updates

The Software may check for updates. Updates are cryptographically signed, and the Software will not install an unsigned or invalidly-signed update. Where an update is delivered automatically, your continued use after an update constitutes acceptance of that version. We may end-of-life unsupported versions, and critical security patches may be required to continue receiving Pro entitlements or support.

7. The bundled WinDivert deep-inspection driver — separate license

Bundled, but separately licensed. Certain deep-packet-inspection and on-the-wire features (DPI, TLS-SNI inspection, payload rules) require the third-party WinDivert component. WinDivert is included in the Ferrite installer and installed on your machine, but it is not licensed to you under this EULA. It is licensed to you separately, directly under the GNU Lesser General Public License, version 3 (LGPL-3.0-only), by its own authors. Nothing in this EULA limits, and this EULA does not purport to grant, any right you have in WinDivert under the LGPL-3.0.

WinDivert’s own license governs WinDivert. Your use of WinDivert is governed exclusively by the LGPL-3.0 as supplied by its author. Ferrite loads WinDivert dynamically and does not combine with it statically. We provide the corresponding source and the information needed to replace it — see the Open-Source & Third-Party Notices accompanying the Software. Where any term of this EULA conflicts with the LGPL-3.0 as it applies to WinDivert, the LGPL-3.0 prevails for that component. We make no representation or warranty about WinDivert itself.

Your right to replace or remove it. As the LGPL-3.0 requires, you may replace the WinDivert component with a compatible version of your own. Ferrite verifies WinDivert against known-good hashes by default as a supply-chain protection; an administrator may override that check using the documented consent marker described in the Notices. Loading a modified kernel driver is additionally subject to Microsoft’s Windows kernel-mode code-signing policy — a platform requirement, not a restriction we impose. You may also simply remove it: all other functionality, including enforcement, secure DNS, and connection tracking, operates without it.

Kernel-driver acknowledgment. WinDivert is a kernel-mode component. It carries the class of risk associated with any third-party kernel driver, which Ferrite’s own architecture otherwise avoids (§1). Deep inspection is the only capability that requires it. You run it under its own license, and the disclaimers and liability limits in §10–11 apply to your use of Ferrite alongside it.

8. Third-party and open-source components

The Software may include or link third-party and open-source components, each licensed under its own terms, listed in the Software’s notices / “About” disclosures. To the extent those terms grant you rights or impose conditions, they govern those components and prevail over this EULA for those components only. Nothing here limits any right you have under an applicable open-source license.

9. Term and termination

This EULA takes effect when you first install or use the Software and continues until terminated. You may terminate at any time by ceasing all use and uninstalling the Software; cancelling a Pro subscription is handled per the Refund Policy and Terms of Service. We may suspend or terminate the license — in particular the Pro entitlement — for material breach of this Agreement. Except where the breach poses an imminent security or legal risk, we will give fourteen (14) days’ notice to the email associated with your license to allow cure. On termination, the Free tier is unaffected; the Pro credential is revoked and the Software reverts to Free-tier behavior, with your locally stored rules and settings retained. Sections 1, 3, 5, 7, 8, 10, 11, 12, and 13 survive termination.

10. Disclaimer of warranties

To the maximum extent permitted by applicable law, the Software is provided “as is” and “as available,” with all faults and without warranty of any kind. We expressly disclaim all warranties and conditions, whether express, implied, or statutory, including without limitation any implied warranties of merchantability, fitness for a particular purpose, title, quiet enjoyment, accuracy, and non-infringement.

Without limiting the foregoing, we do not warrant that the Software will meet your requirements or operate uninterrupted, securely, or error-free; that it will detect, block, or alert on every threat, malicious connection, exfiltration, or bypass; that defects will be corrected; or that the Software is free of vulnerabilities. A firewall is one layer of defense-in-depth; you must not rely on the Software as your sole security control (see §1). Some jurisdictions do not allow the exclusion of certain warranties, so some exclusions may not apply to you; in that case such warranties are limited to the minimum scope and duration permitted by law.

11. Limitation of liability

To the maximum extent permitted by applicable law: in no event will Ferrite or its suppliers be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, data, or business, business interruption, loss of connectivity, or cost of substitute products — including losses arising from a security incident, intrusion, malware, or data exfiltration that the Software did not detect or prevent — however caused and under any theory of liability, even if advised of the possibility of such damages.

Our total aggregate liability arising out of or related to the Software or this Agreement will not exceed the greater of (a) the amount you actually paid us for the Software in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) USD $50. For Free-tier users who have paid us nothing, our aggregate liability is USD $0 / the minimum permitted by law.

Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under applicable law, including for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability applicable law does not permit to be excluded. Where a jurisdiction does not allow some of these limitations, they apply to the maximum extent that jurisdiction permits. These disclaimers and limitations are a fundamental basis of the bargain between you and us, reflecting a reasonable allocation of risk given the Free/low-cost subscription model, and apply even if a limited remedy fails of its essential purpose.

12. Indemnification

To the extent permitted by law, you will indemnify and hold harmless Ferrite and its officers, employees, and agents from any third-party claim, loss, or expense (including reasonable legal fees) arising from your unauthorized monitoring or misuse of the Software in breach of §3; your violation of law or third-party rights in connection with the Software; or your installation and use of the WinDivert component. This section does not apply to the extent a claim arises from our own breach of this Agreement.

13. Governing law, jurisdiction, and general terms

This Agreement is governed by the laws of Canada, without regard to its conflict-of-laws rules, and excluding the U.N. Convention on Contracts for the International Sale of Goods. The courts located in Canada have exclusive jurisdiction over disputes arising from this Agreement, except that where mandatory consumer-protection law in your country of residence gives you the right to bring proceedings in your local courts and to the protection of your local law, those rights are preserved and prevail over this clause.

You represent that you are not located in, and will not use or export the Software in violation of, any applicable export-control or economic-sanctions regime, and that you are not on any government denied-party or restricted-party list.

This EULA, together with the Terms of Service, Privacy Policy, and Refund Policy, is the entire agreement between you and us regarding the Software and supersedes all prior understandings on that subject. If any provision is held unenforceable, it will be modified to the minimum extent necessary and the remaining provisions stay in effect; our failure to enforce a provision is not a waiver of it. You may not assign this Agreement without our prior written consent; we may assign it in connection with a merger, acquisition, or sale of assets. We may update this EULA for new versions of the Software or for legal/operational reasons — material changes are notified per the Terms of Service change process, and continued use after the effective date of a change constitutes acceptance.

Contact

Support, license, billing, and legal questions about this Agreement: admin@ferritesec.com. See also the Terms of Service, Privacy Policy, and Refund Policy.

By installing, activating, or using the Software, you acknowledge that you have read and understood this EULA and agree to be bound by it.