Privacy policy

Who we are

Pheme Media Ltd (“we” or “us”) runs patchd.net and Patchd. We’re a company registered in England and Wales, company number 15380848, with our registered office at The Old Church School, Butts Hill, Frome, United Kingdom, BA11 1HR.

For anything about your personal data, send us a message from our contact page, choosing “Privacy and your data”, or write to us at our registered office.

Our two roles

• We decide how to use the personal data of people who visit patchd.net, request an invite or contact us, of the people who pay for Patchd, and the records we need to keep Patchd secure, such as sign-ins. For this data, we’re the controller.
• Inside an organisation’s Patchd account, such as who’s been invited, their roles, its audit log and its decisions about findings, we handle personal data for that organisation, following its instructions. For this data, we’re its processor, so your organisation’s admins are the first people to ask about it, and we’ll help them.

What we collect, and why

When you visit patchd.net

• We don’t use analytics, advertising or any other tracking.
• Our hosting provider records each request to the site, including your IP address and browser, so we can keep the site running and secure. This is in our legitimate interest in protecting the site.
• If you switch to the light theme, your browser remembers the choice. That stays on your device, and our cookie policy explains it.

When you request an invite

We collect your name, work email address and company, where your code is hosted, and anything else you tell us. We use them to reply to you and set up your trial, because you’ve asked us to.

When you contact us

We collect your name, email address, your company if you give it, what your message is about and the message itself. We use them to reply to you, which is in our legitimate interest in answering the people who write to us.

When you use Patchd

• Your account: your name, email address and role, and your theme and font choices.
• Signing in: your password, kept only as a secure hash; the public keys of your passkeys, whose private keys never leave your devices; and your authenticator app’s secret and recovery codes, kept encrypted.
• Sessions: while you’re signed in, your IP address and browser details, to keep your account secure.
• Password checks: when you choose a password, we check it hasn’t appeared in a known data breach, using Have I Been Pwned. Only the first five characters of a hash of the password are sent, so the password itself never leaves Patchd.
• The audit log: the changes made in your organisation’s account, with the name of the person who made each one, the names and email addresses of the people a change affected, and the reasons given for accepting the risk of a finding.
• Connections: the access tokens your organisation gives Patchd, kept encrypted and never shown again; the username of the GitHub account that created a token; and your repositories’ names and details, with the paths, package names and versions from their lockfiles and Dockerfiles. Patchd reads those files but doesn’t keep them.
• Emails we send: invites, which include the name of the person who invited you and your role, password reset links and email address checks.

We use this data to provide Patchd under our contract with your organisation, and to keep it secure, which is in our and your organisation’s legitimate interests.

When your organisation pays for Patchd

We collect the billing contact’s name and email address, the billing address, any VAT number and the history of payments, to take payment and keep the accounts the law requires. Card details go straight to Stripe, our payment provider, and we never see full card numbers.

Who we share it with

We don’t sell personal data, or use it for advertising. We share it only with:

• the providers that host patchd.net and Patchd, receive our forms and send our emails, under contracts that let them use it only to provide their service to us
• Stripe, which processes payments, and uses some payment details for its own purposes, such as preventing fraud, as its privacy policy describes
• Have I Been Pwned, which receives only the part of a password’s hash described above
• GitHub and GitLab, when Patchd reads your repositories with the tokens your organisation gives it. Their own privacy policies cover how they handle your use of their services.
• the places your organisation chooses to send its alerts, such as Microsoft Teams or Better Stack
• our professional advisers, and authorities or courts when the law requires it
• a buyer of our business, who would have to protect it as this policy does

The public sources Patchd checks your packages against, such as OSV.dev, CISA’s catalogue of known exploited vulnerabilities, endoflife.date and the npm, Packagist and PyPI registries, receive only package names and versions, which aren’t personal data.

Outside the UK

Some of our providers handle data outside the UK, such as in the United States. When they do, we make sure it’s protected as UK law requires, through the UK’s adequacy regulations, or the ICO’s international data transfer agreement or addendum.

How long we keep it

• Invite requests and messages: up to 12 months after we last hear from you, unless they lead to an account.
• Accounts: until an admin removes you, or your organisation stops using Patchd. When an admin removes someone, their account and passkeys are deleted straight away. The audit log keeps their name against the changes they made, and its record of their removal keeps their email address, because it’s the organisation’s record of who did what.
• Sessions: until they expire, 8 hours after you were last active, and are cleared away.
• Invites and the audit log: for as long as your organisation uses Patchd.
• When your organisation stops using Patchd: we delete its account and everything in it within 30 days.
• Billing records: 6 years, as UK tax law requires.
• Hosting records of visits to patchd.net: up to 30 days.

How we keep it secure

• Everything is sent over encrypted connections.
• Passwords are hashed. Access tokens, authenticator secrets and recovery codes are encrypted. Passkeys only ever give us public keys, and invite links are kept only as a hash.
• Nobody sees any data in Patchd until they’ve added a passkey or set up an authenticator app.
• Roles limit what each person can do, and the audit log records every change.

Your rights

Under UK data protection law, you can ask us to:

• give you a copy of your personal data
• correct it
• delete it
• limit how we use it, or stop using it
• send it to you or another organisation in a format computers can read

To ask, send us a message from our contact page, choosing “Privacy and your data”. We’ll reply within a month. If you ask about data in your organisation’s Patchd account, we may pass your request to your organisation, because it decides what happens to that data.

If you’re unhappy with how we’ve handled your data, please tell us. You can also complain to the ICO, at ico.org.uk or on 0303 123 1113.

Cookies

patchd.net doesn’t use cookies, and Patchd uses only the cookies it needs to sign you in and keep your account secure. Our cookie policy lists them.

Children

Patchd is for businesses and other organisations, and isn’t meant for children.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters, we’ll also tell the people who use Patchd.