Social responsibility

Pages like this one usually list principles. Principles are cheap: nobody can check them. So this page lists only things patchletter actually does — each one you can verify yourself, from the outside, without asking us. Where there is nothing to show, the last section says so instead of filling the gap with a value statement.

The radar costs nothing, and it stays that way

The update radar is free and stays free: pick from 1240 products and get an email when the vendor ships a new release. The people this matters to most are the ones with the smallest budget — a club, a doctor’s practice, a school, the one person who keeps a company’s servers running on the side. They get the same 1240 products and the same delivery as a corporation, and they pay nothing for it.

Being told about a new release is the part that costs nothing, and we do not intend to change that: no tier, no seat limit, no advertising, and no upsell in the emails. What we do sell is the vulnerability side — knowing what is dangerous right now, including the flaws for which no patch exists yet. That is the work we cannot give away, and our pricing says so in the first line rather than hiding it three clicks deep.

And nobody loses what they already have: everyone who subscribed to the KEV alert emails before that changeover keeps them permanently and free of charge, tied to no subscription. That promise is in our pricing, and it is the reason the switch is a communication date rather than a deployment.

We are a guest on other people's servers

To know about 1240 products, patchletter has to fetch pages that belong to other people every single day — vendor release feeds, repositories, advisory pages. None of those operators asked for our traffic. So the crawler is deliberately slower than it could be: one request per host every two seconds, conditional requests (ETag/Last-Modified) so an unchanged page costs the other side almost nothing, no login areas, no ignored robots.txt.

We also identify ourselves rather than hide. Every request carries patchletterBot/1.0 with a link to our crawler policy, so any vendor can find us in their own logs, throttle us, or shut us out. And we never store or mail a vendor’s full text: what we keep is a short summary of at most 300 characters plus a link to the original. The reader ends up on the vendor’s page, not on a copy of it.

Deadlines a security researcher can hold us to

Anyone who reports a vulnerability in patchletter is doing us a favour, usually unpaid. The least we owe them is not being left in the dark. So the deadlines are binding, not aspirational: acknowledgement within 3 working days, a first solid assessment within 14 days, and a status update at least every 14 days for as long as the finding is open. In return we ask for 90 days before publication — and if a fix genuinely needs longer, we say so instead of going quiet. There is no bug bounty; we do not have the money. There is safe harbour for good-faith research, and that costs us nothing but is worth something. Details on the responsible disclosure page.

The cheapest way to protect data is not to have it

The only mandatory personal datum is an email address. No name, no company, no phone number, nothing that would make the account more valuable to us and more dangerous to you. No tracking pixels in emails, no advertising cookies, no consent banner — the analytics are cookieless and run on our own instance. Every email carries a one-click unsubscribe, an unconfirmed account is deleted automatically after 48 hours, and you can delete a confirmed one with all its data at any time, in one click. What we do store is listed in the privacy policy.

Money and the environment

patchletter has not made a profit yet, so there is nothing to distribute. What exists is a commitment — a share of future profits to a German reforestation initiative, and two trees a year for every paid subscription. As long as no money has actually moved, that is a promise and we call it one. The same page also carries an open gap on electricity and climate figures for our machine in Paris, because we would rather show a gap than inherit a number from somewhere else. Both are on operations & privacy, where they can be maintained in one place instead of two.

What is not on this page

Pages like this one usually have three more chapters, and we are leaving all three blank on purpose. There is no chapter on working conditions, because patchletter employs nobody besides its managing director — a list of measures for a workforce that does not exist would be decoration. There is no list of donations, because none are flowing yet; the commitment above is all there is. And there are no sponsorships. If any of that changes, it will appear here with a name and a number, not as a value statement.

If you think something on this page is wrong, we would like to hear it: the legal notice has the address, and every claim above was written so that you can check it without us.