Legal
Privacy policy
What personal data Permenta processes, why, and what you can ask of us. Last updated 24 September 2026.
1. Scope and who is responsible
This policy covers the website permenta.com, our email correspondence, early-access requests and the Permenta service. The controller is Patchgate, LLC, doing business as Permenta, 651 N Broad St, Suite 201, Middletown, DE 19709, United States. You can reach our privacy contact at privacy@permenta.com.
2. Our two roles
For the website, our emails and your account we are the controller. For the content a customer puts into a workspace (product records, SBOMs, findings, reports, documents, and any personal data those contain, for example names of the customer’s staff or of vulnerability reporters) we act as a processor on the customer’s instructions under a data processing agreement; the customer is the controller and requests about such data should be directed to them.
3. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Your email, name and message when you write to us or request early access | Answering you, setting up your workspace | Art. 6(1)(b), steps before a contract; Art. 6(1)(f), correspondence |
| Account data: name, email, organisation, role, authentication credentials, sessions, security events | Providing and securing the Service | Art. 6(1)(b); Art. 6(1)(f), security |
| Billing data: company name, address, VAT number, invoices, payment status (card details are held by Stripe, never by us) | Charging for paid plans, tax and accounting | Art. 6(1)(b); Art. 6(1)(c), legal obligations |
| Server logs: IP address, request path, timestamp, user agent, error details | Operating, debugging and protecting the Service | Art. 6(1)(f) |
| Product emails: security alerts, reporting deadlines, digests, invoices | Delivering the Service you asked for | Art. 6(1)(b) |
We do not sell personal data, do not run advertising, and do not send marketing email without your consent.
4. Cookies and browser storage
This website sets no cookies and uses no analytics or tracking. The Service uses strictly necessary cookies for sign-in sessions and security, and browser storage for preferences such as theme. No consent banner is needed for these, and none is shown.
5. Who receives personal data
Providers who process data for us under contract: Microsoft Azure (hosting, EU region), our email provider (correspondence and product email), Stripe (payments, invoicing and tax calculation) and, for transactional email from the Service, a transactional email provider. We disclose data to authorities only where the law requires. A current list of subprocessors for the Service is published in the Service and provided with the data processing agreement.
6. Where data is processed and international transfers
Workspace data and the Service’s database are hosted in the European Union (Microsoft Azure, Sweden Central). Because Patchgate, LLC is established in the United States, our own staff access and some providers involve a transfer outside the EEA, which is covered by the European Commission’s standard contractual clauses or, for providers certified under it, the EU-US Data Privacy Framework.
7. How long we keep data
Correspondence for as long as needed to deal with it and for up to three years afterwards; account data for the life of the account and 30 days after deletion; billing records for the periods tax law requires (typically ten years); server logs for 30 days. Workspace content is kept as long as the customer keeps it; the Service is designed for ten-year retention of compliance records, and deletion follows the customer’s instruction.
8. Security
Encryption in transit and at rest, tenant isolation enforced in the database, least-privilege access, passkeys and two-factor authentication, hash-chained audit records and regular backups. Details are on our security page.
9. Your rights
Where the GDPR or a similar law applies you may ask for access to your personal data, rectification, erasure, restriction, portability, and you may object to processing based on our legitimate interests. Write to privacy@permenta.com; we answer within one month. You may also complain to a supervisory authority, in particular in the EU member state where you live or work. Residents of US states with privacy laws have comparable rights and may exercise them the same way.
10. Children, changes and contact
The Service is for businesses and is not directed at children under 16. We may update this policy; material changes are announced on this page and, for customers, by email. Questions: Patchgate, LLC, doing business as Permenta, 651 N Broad St, Suite 201, Middletown, DE 19709, United States, privacy@permenta.com.