Operations & privacy
patchletter runs on its own server in Germany.
A tool that knows which software you operate holds a sensitive list. So here is exactly where that list lives, who can touch it, and what is still outside Germany. Everything on this page can be verified from the outside — the commands are at the bottom.
Where the data lives
One server, one provider. Application, database, object storage and inbound mail all run in the same place — there is no cloud fan-out.
| Component | Operated by | Location |
|---|---|---|
| Application, database, object storage | manitu GmbH | St. Wendel, Germany |
| Inbound mail (hello@, legal@ …) | Own mail server on the same machine | St. Wendel, Germany |
| Outgoing email | Brevo GmbH | Berlin, Germany |
| Analytics (Umami) | Self-hosted on the same machine | St. Wendel, Germany |
| Error monitoring (Bugsink) | Self-hosted on the same machine | St. Wendel, Germany |
What we don't do
- No advertising cookies — and therefore no consent banner. The site sets one technically necessary session cookie, and only once you log in.
- No tracking pixels in emails. We do not measure whether you opened a message.
- No marketing tags, no third-party scripts. The browser talks to our own domains only.
- No selling, renting or enriching of email addresses. Ever.
- No account required to browse. The only mandatory datum is an email address, and only if you want notifications.
What is not in Germany yet
Claiming “100 % German” would be convenient and wrong. Three things still leave the country, and here they are:
DNS (Cloudflare, USA)
The domain's authoritative name servers still run at Cloudflare. Domain transfers are locked for 60 days after registration, so the move to a German registrar is possible from September 2026. Nothing but domain lookups passes through it — no account data, no email content.
TLS certificates (Let's Encrypt / ISRG, USA)
Our certificates are issued by Let's Encrypt, a US non-profit. A certificate authority signs a public key; it never sees your data or your traffic.
The contact mailbox (Apple iCloud, USA)
Our own mail server receives email in Germany and forwards it to the operator's mailbox, which is hosted at Apple. If you email us, that content ends up there.
Power and climate
manitu has run its data centre and offices on 100 % renewable electricity since February 2008 — bought directly, not offset with certificates — and reports a PUE of 1.35 through optimised cooling and load-aware power management. The data centre sits in the same building as the company's offices in St. Wendel, Saarland.
manitu on ecology and climate protection
A commitment, not a claim
patchletter is free and has not made a profit yet — the only intended revenue is a clearly labeled official vendor presence. We commit to donating a share of future profit to plant-my-tree.de, a German reforestation initiative. As soon as money actually flows, we will state the amount here. Until then this is a pledge, and we would rather say so plainly than imply something has already happened.
Check it yourself
Do not take our word for it. These four commands tell you most of it:
- dig +short A patchletter.com
- Resolves to our server in Germany.
- dig +short MX patchletter.com
- Inbound mail points at our own machine, not a third-party inbox provider.
- curl -sI https://patchletter.com | grep -i server
- No CDN or reverse proxy of a hyperscaler in front.
- Open developer tools, reload the page
- The browser contacts patchletter.com and our own subdomains — nothing else.
More detail
Questions
Is patchletter really free?
Yes. There is no paid tier and no credit card. The intended revenue is an official, clearly labeled vendor presence on product pages — never advertising between listings and never influencing what we report.
Who can see which software I track?
Only the operator, through the admin interface, and only to run the service. The list is never passed to third parties, and it is not used for advertising. Delete your account and it is gone immediately — a hard delete, not a flag.
Does patchletter scan my systems?
No. There is no agent and no scanner, and patchletter never connects to your infrastructure. You tell us which products you run; we watch the vendors' public release sources.
Why is the DNS still at Cloudflare then?
Because a domain cannot be transferred within 60 days of registration. patchletter.com was registered on 7 July 2026, so the earliest possible move is early September 2026. We would rather name the gap than hide it.