Social responsibility

Pages like this one usually list principles. Principles are cheap: nobody can check them. So what is written here is only what patchletter actually does, and you can verify every point from the outside, without asking us. Where there is nothing to show, the gap stays open.

The update radar costs nothing

From 1286 products you tick the ones you look after and get an email as soon as the vendor ships a new release. The people this matters to most are the ones with the smallest budget: a club, a doctor's practice, a school, the one person who keeps a company's servers running on the side. They get the same 1286 products and the same update email as a corporation, and they pay nothing for it.

Being told about a new release is the part that costs nothing: the email names the new version, and it carries neither advertising nor an offer for something pricier. What we sell is everything that turns it into a security message — the flag that a release closes a hole, the alert about a vulnerability under active attack, the BSI and CERT-Bund advisory, the warning before a product falls out of support, and delivery of those alerts within minutes instead of in the daily run. Reading it costs nothing all the same: what we know about vulnerabilities and end-of-life dates is on the website for everyone, without an account. What you pay for is being woken up, and our pricing says so in the first line rather than hiding it three clicks deep.

We are a guest on other people's servers

To know about 1286 products, patchletter has to fetch pages that belong to other people every single day — vendor release feeds, repositories, advisory pages. None of those operators asked for our traffic. So the crawler is deliberately slower than it could be: one request per host every two seconds, conditional requests (ETag/Last-Modified) so an unchanged page costs the other side almost nothing, no login areas, no ignored robots.txt.

We also identify ourselves rather than hide. Every request carries patchletterBot/1.0 with a link to our crawler policy, so any vendor can find us in their own logs, throttle us, or shut us out. And we never store or mail a vendor’s full text: what we keep is a short summary of at most 300 characters plus a link to the original. The reader ends up on the vendor’s page, not on a copy of it.

Deadlines a security researcher can hold us to

Anyone who reports a vulnerability in patchletter is doing us a favour, usually unpaid. The least we owe them is not being left in the dark. So the deadlines are binding, not aspirational: acknowledgement within 3 working days, a first solid assessment within 14 days, and a status update at least every 14 days for as long as the finding is open. In return we ask for 90 days before publication — and if a fix genuinely needs longer, we say so instead of going quiet. There is no bug bounty; we do not have the money. There is safe harbour for good-faith research, and that costs us nothing but is worth something. Details on the responsible disclosure page.

The cheapest way to protect data is not to have it

The only mandatory personal datum is an email address. No name, no company, no phone number, nothing that would make the account more valuable to us and more dangerous to you. There is no tracking pixel in our emails, we set no advertising cookies, and the analytics run cookieless on our own instance; a consent banner is therefore not needed. Every email carries a one-click unsubscribe, an unconfirmed account is deleted automatically after 48 hours, and a confirmed one you can delete at any time with all its data, in one click. What we do store is listed in the privacy policy.

Money and the environment

patchletter has not made a profit yet, so there is nothing to distribute. What exists is a commitment — a share of future profits to a German reforestation initiative, and two trees a year for every paid subscription. As long as no money has actually moved, that is a promise and we call it one. The same page also carries an open gap on electricity and climate figures for our server in Nuremberg, because we would rather show a gap than inherit a number from somewhere else. Both are on operations & privacy, where they can be maintained in one place instead of two.

What is not on this page

There would usually be a few more chapters here; those stay blank on purpose. Nothing is written about working conditions, because patchletter employs nobody besides its managing director; a list of measures for a workforce that does not exist would be decoration. There are no sponsorships, and there is no list of donations, because none are flowing yet; the commitment above is all there is. If any of that changes, it will appear here with a name and a number — and not as a value statement.

Nor does this page claim that we give security away. What is free is the message that a new version exists — not the flag that a release closes a hole, not the alert about a vulnerability under active attack, and not the warning before a product falls out of support. Those are paid for. Reading them is not: the data sits on the website for everyone, without an account.

If you think something on this page is wrong, we would like to hear it: the legal notice has the address, and every claim above was written so that you can check it without us.