Privacy policy
Effective
PatchPlane uses account and system information to help your organization reduce vulnerability exposure. We do not sell personal information or share it for cross-context behavioral advertising.
This policy covers the PatchPlane website, control plane and connected agents. “PatchPlane,” “we” and “us” mean the operator of this service, reachable below. We manage account and website information for our own service operations. When your organization connects hosts, we process its system information on its behalf; your organization controls enrollment, access and remediation settings.
Information we collect
- Account and organization details. Email addresses, organization names, membership roles, invitations, sign-in times and identity-provider identifiers. Optional passkeys add a credential identifier, public key, name and usage records. We do not receive your passkey’s private key or biometric data.
- Host and security information. Enrolled host identifiers, hostnames, platform and software versions, component inventory, configuration observations, process and resource details, available execution capabilities, vulnerability findings and remediation policies.
- Execution and audit records. Instructions, job status, before-and-after evidence, errors, agent receipts and organization activity, including the email address of the person taking an action. Evidence may contain file paths, network addresses or other information supplied by your systems.
- Connection and support details. IP addresses, request metadata, timestamps, security and error logs, and information you send when contacting us. Sign-in rate limiting uses a hash derived from your IP address; our hosting provider also processes connection metadata.
We receive information from you, your organization’s administrators and hosts, your chosen identity provider and our hosting infrastructure. Avoid sending passwords, private keys, application payloads or unrelated personal information in host labels, evidence or support messages.
How we use it
We use information to authenticate users and hosts, enforce permissions, assess vulnerability exposure, deliver authorized recipes, verify results, maintain audit history, troubleshoot problems and prevent abuse. We use contact details for requested sign-in codes, invitations, service notices and support.
PatchPlane uses Cloudflare Workers AI to research public vulnerability advisories and help develop and review recipes. The current recipe research workflow uses public advisories and research material, rather than account details or enrolled host inventory as model input.
Where a legal basis is required, we rely on providing the requested service, legitimate interests in operating and securing it, compliance with legal obligations, or consent when required. For organization-controlled information, we act on the organization’s instructions.
Retention and deletion
We retain information as needed to provide the service, maintain security and audit evidence, resolve disputes and meet legal obligations. Sign-in codes and sessions expire, and expired authentication records are periodically cleaned up.
Removing a host or deleting an organization does not erase all of its records. Those actions revoke access and hide removed resources. Host inventory, execution receipts and audit history may remain stored; they do not currently have a fixed automatic deletion schedule. Organization deletion does not automatically delete your account or passkeys.
Contact us to request deletion and identify the account or organization involved. We review requests with the relevant organization and applicable law. Some records may need to remain for security, legal obligations or others’ rights; retained copies remain subject to this policy.
Your choices and rights
You can sign out, manage passkeys in your account, and ask your administrator to change or remove membership. Administrators manage host enrollment and remediation settings. To stop new host reports, revoke access and remove the agent from that host.
Depending on where you live and which laws apply, you may have rights to access, correct, export or delete personal information, restrict or object to processing, withdraw consent, or appeal a request decision. You may complain to your privacy regulator. We do not discriminate against you for exercising applicable privacy rights.
Send requests to the contact below. We may need to verify your identity and authority. For information your organization controls, contact its administrator first; we will help it respond where required. Withdrawal of consent does not affect earlier lawful processing.
Security and processing location
Safeguards include encrypted connections, authenticated host communication and organization access controls. No service can guarantee absolute security. Protect your sign-in methods, enrollment links and host credentials, and promptly report suspected misuse.
We and our providers may process information in the United States and other countries where we operate. Privacy laws may differ from those in your country. Where required, we use applicable safeguards for international transfers; contact us for details.
Children and policy changes
PatchPlane is a business service for adults and is not directed to children under 18. Contact us if you believe a child has provided personal information.
We may update this policy as the service changes. We will post the revised policy and effective date here and provide additional notice of material changes through the service or email when required.
Contact
For privacy questions or requests, email PatchPlane at support@patchplane.dev. Include your account email and organization name, but do not send credentials or sensitive host evidence.