Privacy policy

1. What we collect

• Your account: your name, email address, the tenant(s) (customer organizations) you belong to and your role in each. Your password is stored only as a one-way hash we can't read.
• Two-factor sign-in: the secret your authenticator app uses, stored encrypted; recovery codes, stored only as one-way hashes.
• The NDA: each time you accept it, the name you typed, your email, the agreement's version and fingerprint, the date and time, and your IP address and browser.
• Security and activity records: sign-ins and failed attempts, invites, role changes and similar account events, with their time and IP address.
• Server logs: like most websites, our web server records each request (IP address, time, page, browser) to keep the site running and secure.
• Devices you add to your Inventory, Sanity Check reports and SBOMs: only if you choose to (section 2).
• Clicks on a Server Sanity badge: counts by website name only, nothing about the person clicking (below).
• Your tenant's data: what your tenant puts into Patch Sanity, such as its settings, its Inventory and, when the agent arrives, its machines and their software. That data belongs to your tenant.

2. Devices you add to your Inventory

Inventory's This device tab shows what any website can see about the computer or phone you're using: your IP address and its DNS name, your browser and its exact version, the operating system and its version, the processor, memory, graphics card, screen size, time zone, languages, and a few display and network settings. Just looking at it saves nothing: it's read fresh and shown only to you.

• When you press "Add to Discovered Devices", those details are saved to your tenant's Discovered Devices list, with a name you give it and who added it. Everyone in your tenant can see them. Your browser gets a cookie (a random code, kept for a year) so Patch Sanity can recognise that device again; we store only a one-way hash of it.
• Keeping it up to date (on unless you untick it, and you can turn it off any time on the This device tab): whenever that browser opens Patch Sanity, the device is marked as seen, and once a day its details are read and saved again. Changes to its browser, operating system and IP address are kept as its history, so your tenant can see when it was updated.
• Its status: we compare its browser version with the newest release, which we get each day from Google, Microsoft and Mozilla's public release information, and with the fixes in our CVE data. Nothing about you or your device is sent to them.
• If a browser looks like one already listed (its cookie was cleared, say), we ask whether it's the same one; we never link it without you saying so.
• Read-only members can see Discovered Devices but not add to it.

Sanity Check: a one-time check you choose to run

Sanity Check gives you a one-time script to run on a computer, or lets you upload its results file or an SBOM (a list of the software in something). It's entirely your choice, and nothing is kept unless you tell us to.

• What the script reads: the operating system's name, version and build; the installed updates (Windows); the installed programs, apps or packages and their versions, with each program's own update or information link where its installer recorded one; which of them have newer versions, as the machine's own package manager lists them; the computer's name, processor type and count, graphics card and time zone (the last three only to tell which of your devices it is, by comparing them with what its browser showed: never to track anyone). It does not read your files, user names, passwords, serial numbers or network details. It shows you a summary first, and sends it only if you type y. (The tab lists every command it runs.)
• winget on Windows: to see which programs have newer versions, the script runs Microsoft's winget, which contacts Microsoft's winget catalog (under Microsoft's own terms). That's between your computer and Microsoft; nothing about it passes through us except the list in the report. Only if you tick Also install winget if it's missing does the script install anything: Microsoft's App Installer, from Microsoft.
• One time only: each link sends a single report, then stops working; an unused link expires after 24 hours. We store only a one-way hash of the link's code.
• Not saved unless you say so: a report that arrives is shown only to you, and deleted within an hour, or as soon as you sign out or press Discard, unless you press Submit to save it to Discovered Devices. Uploaded files are handled the same way.
• If you save it, the report is kept with that device in your tenant's Discovered Devices (the newest one per device), where everyone in your tenant can see it, until the device is removed.
• We record in your tenant's activity log that a link was made and that a report arrived or was saved (not its contents). The report is compared only with our own CVE data: nothing from it is sent to anyone else, and we never visit the programs' update links it contains (they're only shown to you).

SBOMs: software lists your tenant keeps

Inventory's SBOMs tab keeps the software bills of materials (lists of the components in a product, container image or server) that someone in your tenant uploads, so they can be checked again as new vulnerabilities are published.

• What's kept: the SBOM's name, version label, format and the tool that made it, and each component's name, version, package address (purl) and licence, with who uploaded it and when. Nothing else from the file is kept. Everyone in your tenant can see them; Read-only members can't upload.
• How it's checked: each component's package name and version (never the file, its name or anything about your tenant) is sent from our server to OSV.dev (Google's open vulnerability database, under its own terms) to ask which advisories cover it, when the SBOM is uploaded and again each night. The answers are matched with our own CVE data.
• How long: until someone in your tenant deletes it; a product keeps its newest 20 versions, and the oldest goes as a new one arrives. Uploads and deletions are recorded in your tenant's activity log.

The Server Sanity badge's verify page

Websites watched by Server Sanity can show a "Server Sanity Monitoring by PatchSanity.com" badge. Its images are served by that website, not by us, so just seeing the badge sends us nothing. Clicking it opens our verify page (patchsanity.com/verify.php), which says whether that website really is monitored. You don't need an account, and no cookie is set.

• What we count: for each day, the website the badge names, the website it was clicked on (the domain name only, as your browser reports it; some browsers don't say), whether it checked out, and how many clicks. Nothing about you: not your IP address, browser or the page you were on. (Our web server's own access logs, section 1, record the request like any other.)
• Who sees it: the tenant that watches the website the badge names, in its Server Sanity Badge report, so it can spot copies of its badge on other websites; the first click from a new other website is also noted in that tenant's activity log and emailed to its Owners and Admins (the other website's name only). Checks of a badge for a website no tenant watches are noted for us, once a day per website. The verify page itself shows only whether a website is monitored, since when, when it was last checked and which checks it has (such as "the website answers"): never their results.
• Which websites the page confirms: only ones a tenant watches that also show the badge; a watched website without the badge isn't confirmed or mentioned.
• How long: the daily counts are kept about 13 months, then deleted.

3. Why we use it

To run Patch Sanity for you: signing you in and keeping your account secure, keeping each tenant's data separate and visible only to that tenant, showing your tenant's Owners and Admins their tenant's activity, sending account emails (invites, password resets, security notices), keeping a record of the NDA, showing your tenant its devices and whether they're up to date, and keeping the service working, fixing problems and preventing abuse.

4. Who can see it

• Your tenant: its Owners and Admins can see the tenant's members, their roles and two-factor status, and the tenant's activity log. Everyone in the tenant can see its Inventory, including the devices in it and their history.
• Other tenants can't see anything of yours.
• Patch Sanity's platform admin (us) can see account details to run and support the service. To help with a problem, we can open a read-only, time-limited support view of a tenant; each one is recorded, with its reason, in that tenant's own activity log, so you can see it.
• Service providers: our server and email run on our own systems. We share information only if the law requires it, or to protect the service or its users from harm.

5. How long we keep it

Account details while your account exists. A Sanity Check report nobody saves, within an hour. An SBOM until your tenant deletes it (a product's newest 20 versions). Server Sanity badge click counts about 13 months. A device in Discovered Devices, with its history and any saved Sanity Check, until someone removes it (devices not seen for a while are flagged so your tenant can tidy them up); its cookie lasts a year. Failed sign-in records about a day. Security, activity and NDA records for as long as needed to keep the service secure and to show what was agreed, normally up to three years after your account ends. Server logs are rotated monthly and kept for a few months. When a tenant is deleted, its data is deleted with it.

6. Your choices

You can change your name and password and manage two-factor sign-in on your Account page. A device you added can be removed, or its automatic updates turned off, on Inventory's This device tab (by you, or your tenant's Owners and Admins); clearing your browser's cookies stops it being recognised. To see a copy of your information, have it corrected, or have your account deleted, ask your tenant's Owner, or reply to any Patch Sanity email. Some records (such as NDA acceptances) may be kept where we need them to show what was agreed.

7. Security

Every connection is encrypted (HTTPS). Passwords and recovery codes are hashed, two-factor secrets are encrypted, each tenant's data is kept separate, and sign-in attempts are limited. No system is perfectly secure, but we work to protect your information and will tell affected people if a breach affects them, as the law requires.

8. Changes

If this policy changes, the date at the top changes, and important changes will be pointed out when you sign in.