Legal information
Data portability and switching provider
The data you can take back, its formats, the procedure to switch provider and the infrastructure that hosts the Service.
Version of 23 Oct 2026
On this page
1. Data you can take back
All Customer Data can be taken back: the information entered in a Workspace and what the Service derives from it (the vulnerabilities that concern each device, priorities, statuses). A complete copy of each Workspace can be downloaded in self-service; an MSSP Account's data is provided on request. Public vulnerability information remains available on the public site, under its sources' licences; it is not Customer Data.
2. Register of export formats
| Export | Where to get it | Format | Content |
|---|---|---|---|
| Inventory | Reports › Exports | CSV (UTF-8, comma-separated, header row) | Asset, Hostname, Account, Vendor, Product, Version, Environment, Criticality, Internet exposed, Lifecycle, Tags, Open findings, Priority |
| Open vulnerabilities | Reports › Exports | CSV (UTF-8, comma-separated, header row) | Asset, Account, Product, Version, CVE, Title, Severity, CVSS, EPSS, KEV, Status, Confidence, Fixed in, Score, Reasons, Source |
| Remediation actions | Reports › Exports | CSV (UTF-8, comma-separated, header row) | Bundle, Type, Asset, Account, Product, Version, Target, Priority, Score, Findings, Workflow status, Planned for, Note |
| Exceptions | Reports › Exports | CSV (UTF-8, comma-separated, header row) | Bundle, Asset, Status, Until, Justification, Note |
| Managed customers summary (MSSP Account) | MSSP console › Reports | CSV (UTF-8, comma-separated, header row) | Customer, Customer reference, Asset, Hostname, Vendor, Product, Version, CVE, Severity, CVSS, CISA KEV, Status, Action, Remediation status |
| Complete copy of a Workspace | Settings › Workspace › Download your data (owners and administrators) | JSON (UTF-8, one document per Workspace, one section per kind of data, fields named as in the database) | Workspace and subscription, members and roles, invitations (without their token), managed accounts, every inventory field including archived assets, watches and IP watches, remediation actions and their history with notes, alerts, the audit log, acceptances of the Terms of Sale, and the open findings at the time of the export |
| Your account's data | Settings › Account › Download your data | JSON (UTF-8) | Account and profile, Workspace and MSSP Account memberships, notification settings, acceptances of the documents, security history, sessions, remembered devices (without their token), alert deliveries, the e-mail delivery log (without content), any suspension and its reason |
| An MSSP Account's data (managed customers and their references) | On request at contact@patcharo.com | JSON or CSV | Managed customers, references, operators and roles, the account's notification settings |
Exports use open, common formats (CSV, JSON) that can be read without any Patcharo-specific software. This register is kept up to date whenever the exports change.
3. Switching provider
- The Customer sends its request to contact@patcharo.com, stating whether it wants to retrieve its data, transfer it to another provider or have it erased.
- The request takes effect no later than two months after it is notified; the Customer may choose an earlier date.
- The export is delivered within the following thirty days, which may be extended once for a justified and notified technical reason.
- The data remains retrievable for at least thirty days after the end of the subscription or the effective date of the transfer, then is erased at the Customer's request, subject to statutory retention obligations.
The detailed terms are in the terms of sale and the data processing agreement.
4. Fees
No fee is charged for an export, a data transfer or a switch of provider, and there is no early termination penalty: online subscriptions are monthly and without commitment. Plan prices are on the pricing page.
5. Infrastructure and jurisdiction
- Running the application and delivering pages: the global network of Cloudflare, Inc., a company subject to the law of the United States.
- Database and authentication: Supabase Pte. Ltd., a company subject to the law of Singapore, on Amazon Web Services infrastructure located in Paris (France).
- E-mail delivery: Plus Five Five, Inc. (Resend), a company subject to the law of the United States.
- Mailboxes of the @patcharo.com addresses: Zoho Corporation B.V., a company subject to the law of the Netherlands, with data centres in the European Union.
To prevent access by a foreign authority that would conflict with Union or Member State law, the Publisher relies on its providers' contractual commitments, encryption of exchanges and of the database at rest, and limiting the data transmitted. It discloses data to an authority only on a request founded on the applicable law, and informs the Customer before answering, unless the law forbids it.