About patchletter

You list Proxmox VE, FortiOS and Veeam Backup & Replication as things you run, and you get an email the moment one of them ships a new release. That email costs nothing. Currently 1430 products across browsers, operating systems, virtualization, firewalls, network gear, NAS, servers, databases, monitoring and DACH business software. Version data comes from official vendor sources (release feeds, GitHub and GitLab releases, package repositories) and is checked daily. Product pages also carry the support cycles from endoflife.date and the CISA KEV catalog of actively exploited vulnerabilities. Both are free to read, no account needed; the alert emails about them are part of patchletter Pro. For the update emails patchletter needs no access to your systems and no agent. The Microsoft 365 tenant scan is different, and you start it yourself: it reads your tenant's settings through Microsoft Graph, read-only. The only required datum for an account is an email address, and the service runs data-minimal and ad-free, without tracking. It runs on our own server in Helsinki (EU).

Where does the version data come from?

For every product we track one or more official, public sources: vendor release feeds and RSS, GitHub and GitLab releases and tags, package repositories (WinGet, Chocolatey), the endoflife.date support-cycle data, and structured vendor pages. Our crawler checks them daily, uses conditional requests (ETag/Last-Modified) to be gentle, and keeps generous rate limits. New versions are normalized and sorted so the latest release sits at the top and the history below it in the right order.

Our crawler is transparent. See the patchletterBot crawler policy.

How does patchletter flag actively exploited vulnerabilities?

Product pages cross-reference the CISA Known Exploited Vulnerabilities (KEV) catalog. When a product has a vulnerability that is being actively exploited in the wild, it sits at the top of the product page: with the CVE, a link to the authoritative entry and, where applicable, a ransomware marker.

What data does patchletter store?

patchletter is deliberately data-minimal: the only required datum for an account is an email address. There are no tracking pixels in emails, no advertising cookies and no consent banner; the analytics run cookieless on the very same instance as the application. We operate that instance ourselves, with database and object storage on it, at Hetzner in Helsinki (Finland). If you connect a Microsoft 365 tenant, the results of your scans are stored there too; we do not store Microsoft's access token. Every email has a one-click unsubscribe, and you can delete your account with one click at any time. What we keep and for how long, including the records that remain after deletion, is in the privacy policy.

Who runs patchletter?

patchletter is operated by patchletter UG (haftungsbeschränkt) in Germany; its Managing Director is Kolja Sagorski. Full details and contact in the legal notice. Missing a tool? Suggest it.