Operations & privacy

patchletter runs on our own machines and on managed services beside them, all in the EU.

A tool that knows which software you operate holds a sensitive list. Where it lives, who can touch it and what we do not run ourselves is written down here. What happens on the server you cannot see from outside. For those points we say what we checked it against.

Where the data lives

Every machine here is named with its operator and its place, not an unnamed cloud region. Application, database and object storage run at Scaleway in Paris, and since the subdomain move on 29 August 2026 analytics, error tracking and the inbound path for our machine-read addresses run on that same instance; independent uptime monitoring runs on our own machine at IONOS in Berlin. The backups of the database go three ways, and the paragraph under the table says which: Paris, Amsterdam, Berlin. Every provider involved is a European company, and every place of processing is inside the EU — the domain's authoritative name servers included.

Two addresses are read by the application rather than by a person: dmarc@ (reports from other mail servers about whether forged mail is being sent in our name) and unsubscribe@ (one-click unsubscribe by email). Our mailbox forwards copies of those two — and only those two — to our own instance in Paris, where Postfix hands them to the application over an encrypted connection. A collector for the whole mailbox would also have given the application access to the correspondence at hello@, legal@ and security@.

There is more than one backup of the database, and they sit in more than one country. Scaleway backs up the managed database itself every six hours and keeps those states for seven days — in the same region as the database, which helps against a broken instance and not at all against that region going down. So we pull our own dump every 15 minutes and put it into an object storage of ours in Amsterdam: different region, different country, same provider. And because a provider can fail as a whole, or lock an account, a third set goes into the Drive of mailbox.org (Heinlein Hosting, Berlin) — someone else's storage service, a German one, and what arrives there our own machine has encrypted beforehand (Kopia, AES-256-GCM), so mailbox.org only ever sees ciphertext. Every dump we pull ourselves is checked for readability right after it is written; without that check a truncated dump would sit in the rotation for weeks and look like a backup. No destination lies outside the EU and none of them is a hyperscaler. Our separate machine at IONOS in Berlin carries the status page: status.patchletter.com — it runs at a different operator in a different country, under an IP of its own.

The software we run

No proprietary black box. Every piece here is something SysAdmins run themselves too — the database has been a managed service at Scaleway since the move, everything else we run ourselves. And except for ALTCHA every one of them is tracked in our own catalog, so you can check its update history the same way you would for your own infrastructure.

• Caddy — Reverse proxy and TLS termination for our public hostnames — one instance of it on each machine.
• Node.js — The runtime of the application itself (Next.js on Node 22).
• PostgreSQL — The database — products, subscriptions, releases, everything. Since the move it is a managed service at Scaleway: no public endpoint, reachable only over a private network from our own machine.
• Valkey — Job queue and cache (Redis-compatible).
• ALTCHA — Self-hosted proof-of-work captcha on sign-up and sign-in: your browser solves a puzzle (PBKDF2/SHA-256), our server verifies it. No reCAPTCHA, no Turnstile — the browser contacts exactly one address for it, and it is ours.
• Postfix — On our instance in Paris it receives the machine-read addresses our mailbox forwards there, and passes them to the application.
• Docker Compose — Runs the containerised services on our machines. Postfix and the backup jobs deliberately sit next to it, straight on the host.
• Gatus — Independent uptime monitoring on our separate machine at IONOS in Berlin.
• Bugsink — Self-hosted, Sentry-compatible error tracking on our instance in Paris. Reports reach it from the application and from visitors' browsers — never from a third party and never out of the EU.
• Umami — Self-hosted, cookieless analytics, likewise in Paris.

What we don't do

• No advertising cookies and no consent banner. Only technically necessary cookies are set: one for your chosen language, and when you sign in two more for the session and for binding the login code to your browser.
• No third-party captcha. We host the bot protection on sign-up and sign-in ourselves (ALTCHA, proof-of-work). It sets no cookies and builds no behavioural profile; your browser asks neither Google nor Cloudflare for it.
• No tracking pixels in emails. We do not measure whether you opened a message. Some links do act when you click them, and therefore identify your account — the sign-in link, the unsubscribe link, and the one in an update email that records which version you run. That is what they are for. Nothing else in our emails is redirected or counted.
• No marketing tags, no third-party scripts. The browser talks to our own domains only.
• No selling, renting or enriching of email addresses. Ever.
• No account required to browse. The only mandatory datum is an email address, and only if you want notifications. Without JavaScript the catalog, product pages, search and the suggestion form work in full — only sign-up and sign-in do not, because the bot check's puzzle is solved by your browser.

What we don't run ourselves

“In the EU” does not mean “all on our own machines”. Every provider below is a European company processing inside the EU — but they are providers, and that belongs on this page as plainly as the rest:

The certificate authority, too

Every certificate we serve is issued by Actalis S.p.A. in Bergamo, Italy — a European certificate authority and member of the CA/Browser Forum. That covers patchletter.com, www and every subdomain, the status page on its separate machine, and the SMTP-TLS of the mail server on port 25. No US certificate authority issues for patchletter.com.

Power and climate

We do not have a documented figure for the electricity and efficiency of our instance in Paris, so this section names none. We could quote our provider's published claims, but a figure we cannot verify ourselves has no business on this page. As soon as we hold a documented figure, it will stand here — a gap is more honest than a borrowed number.

A commitment, not a claim

For every paid Pro subscription we plant two trees a year through PLANT-MY-TREE, a German reforestation initiative. It is a per-subscription commitment, not a share of profit — so it does not depend on whether a good year happens. As soon as the first trees are in the ground, the number stands here.

PLANT-MY-TREE

More detail

• Privacy policy
• Crawler policy of patchletterBot
• Legal notice
• security.txt — how to report a security issue

Questions

← Back to catalog