Operations & privacy

patchletter runs on our own servers in Germany, and every provider involved is in the EU.

A tool that knows which software you operate holds a sensitive list. Where it lives, who can touch it and what we do not run ourselves is written down here. What happens on the server you cannot see from outside. For those points we say what we checked it against.

Where the data lives

Every machine here is named with its operator and its place, not an unnamed cloud region. Application, database, object storage, analytics and error tracking run on one server of ours at netcup in Nuremberg; independent uptime monitoring runs on our own machine at IONOS in Berlin. The backups go two ways, and the paragraph under the table says which: both in Berlin, at two different providers. Every provider involved is a European company, and every place of processing is inside the EU — the domain's authoritative name servers included.

Two addresses are read by the application rather than by a person: dmarc@ (reports from other mail servers about whether forged mail is being sent in our name) and unsubscribe@ (one-click unsubscribe by email). Our mailbox forwards copies of those two — and only those two — to our own server in Nuremberg, where Postfix hands them to the application over an encrypted connection. A collector for the whole mailbox would also have given the application access to the correspondence at hello@, legal@ and security@.

None of the backups stays on the server it protects, and they sit with two different providers. Every 15 minutes we pull a dump of the database, and once a day a copy of everything else; both go into the Drive of mailbox.org (Heinlein Hosting, Berlin), encrypted by our own server beforehand (Kopia, AES-256-GCM), so mailbox.org only ever sees ciphertext. Once a day the whole set also goes, encrypted (restic), to our separate machine at IONOS in Berlin; our server can add to that copy but cannot delete from it, so a compromised server cannot wipe its own backups. Every dump is checked for readability right after it is written; without that check a truncated dump would sit in the rotation for weeks and look like a backup. Both destinations keep 30 days. No destination lies outside the EU and none of them is a hyperscaler. That machine at IONOS also carries the status page: status.patchletter.com — it runs at a different operator in a different country, under an IP of its own.

The software we run

No proprietary black box. Every piece here is something SysAdmins run themselves too, and we run every one of them ourselves. And except for ALTCHA every one of them is tracked in our own catalog, so you can check its update history the same way you would for your own infrastructure.

• Caddy — Reverse proxy and TLS termination for our public hostnames — one instance of it on each machine.
• Node.js — The runtime of the application itself (Next.js on Node 22).
• PostgreSQL — The database — products, subscriptions, releases, everything. It runs as a container on our own server with no public endpoint, reachable only from the application's internal network.
• Valkey — Job queue and cache (Redis-compatible).
• ALTCHA — Self-hosted proof-of-work captcha on sign-up and sign-in: your browser solves a puzzle (PBKDF2/SHA-256), our server verifies it. No reCAPTCHA, no Turnstile — the browser contacts exactly one address for it, and it is ours.
• Postfix — On our server in Nuremberg it hands outgoing email to the mailbridge relay, and receives the machine-read addresses our mailbox forwards there, passing them to the application.
• Docker Compose — Runs the containerised services on our machines. Postfix and the backup jobs deliberately sit next to it, straight on the host.
• Gatus — Independent uptime monitoring on our separate machine at IONOS in Berlin.
• Bugsink — Self-hosted, Sentry-compatible error tracking on our server in Nuremberg. Reports reach it from the application and from visitors' browsers — never from a third party and never out of the EU.
• Umami — Self-hosted, cookieless analytics, likewise in Nuremberg.

What we don't do

• No advertising cookies and no consent banner. Only technically necessary cookies are set: one for your chosen language, and when you sign in two more for the session and for binding the login code to your browser.
• No third-party captcha. We host the bot protection on sign-up and sign-in ourselves (ALTCHA, proof-of-work). It sets no cookies and builds no behavioural profile; your browser asks neither Google nor Cloudflare for it.
• No tracking pixels in emails. We do not measure whether you opened a message. Some links do act when you click them, and therefore identify your account — the sign-in link, the unsubscribe link, and the one in an update email that records which version you run. That is what they are for. Nothing else in our emails is redirected or counted.
• No marketing tags, no third-party scripts. The browser talks to our own domains only.
• No selling, renting or enriching of email addresses. Ever.
• No account required to browse. The only mandatory datum is an email address, and only if you want notifications. Without JavaScript the catalog, product pages, search and the suggestion form work in full — only sign-up and sign-in do not, because the bot check's puzzle is solved by your browser.

What we don't run ourselves

“In the EU” does not mean “all on our own machines”. Every provider below is a European company processing inside the EU — but they are providers, and that belongs on this page as plainly as the rest:

The certificate authority, too

Every certificate we serve is issued by Actalis S.p.A. in Bergamo, Italy — a European certificate authority and member of the CA/Browser Forum. That covers patchletter.com, www and every subdomain, the status page on its separate machine, and the SMTP-TLS of the mail server on port 25. No US certificate authority issues for patchletter.com.

Power and climate

We do not have a documented figure for the electricity and efficiency of our server in Nuremberg, so this section names none. We could quote our provider's published claims, but a figure we cannot verify ourselves has no business on this page. As soon as we hold a documented figure, it will stand here — a gap is more honest than a borrowed number.

A commitment, not a claim

For every paid Pro subscription we plant two trees a year through PLANT-MY-TREE, a German reforestation initiative. It is a per-subscription commitment, not a share of profit — so it does not depend on whether a good year happens. As soon as the first trees are in the ground, the number stands here.

PLANT-MY-TREE

More detail

• Privacy policy
• Crawler policy of patchletterBot
• Legal notice
• security.txt — how to report a security issue

Questions

← Back to catalog