Patcharo — Data portability and switching provider
Version of 23 Oct 2026

The data you can take back, its formats, the procedure to switch provider and the infrastructure that hosts the Service.

1. Data you can take back

All Customer Data can be taken back: the information entered in a Workspace and what the Service derives from it (the vulnerabilities that concern each device, priorities, statuses). A complete copy of each Workspace can be downloaded in self-service; an MSSP Account's data is provided on request. Public vulnerability information remains available on the public site, under its sources' licences; it is not Customer Data.

2. Register of export formats

- Export: Inventory
  Where to get it: Reports › Exports
  Format: CSV (UTF-8, comma-separated, header row)
  Content: Asset, Hostname, Account, Vendor, Product, Version, Environment, Criticality, Internet exposed, Lifecycle, Tags, Open findings, Priority
- Export: Open vulnerabilities
  Where to get it: Reports › Exports
  Format: CSV (UTF-8, comma-separated, header row)
  Content: Asset, Account, Product, Version, CVE, Title, Severity, CVSS, EPSS, KEV, Status, Confidence, Fixed in, Score, Reasons, Source
- Export: Remediation actions
  Where to get it: Reports › Exports
  Format: CSV (UTF-8, comma-separated, header row)
  Content: Bundle, Type, Asset, Account, Product, Version, Target, Priority, Score, Findings, Workflow status, Planned for, Note
- Export: Exceptions
  Where to get it: Reports › Exports
  Format: CSV (UTF-8, comma-separated, header row)
  Content: Bundle, Asset, Status, Until, Justification, Note
- Export: Managed customers summary (MSSP Account)
  Where to get it: MSSP console › Reports
  Format: CSV (UTF-8, comma-separated, header row)
  Content: Customer, Customer reference, Asset, Hostname, Vendor, Product, Version, CVE, Severity, CVSS, CISA KEV, Status, Action, Remediation status
- Export: Complete copy of a Workspace
  Where to get it: Settings › Workspace › Download your data (owners and administrators)
  Format: JSON (UTF-8, one document per Workspace, one section per kind of data, fields named as in the database)
  Content: Workspace and subscription, members and roles, invitations (without their token), managed accounts, every inventory field including archived assets, watches and IP watches, remediation actions and their history with notes, alerts, the audit log, acceptances of the Terms of Sale, and the open findings at the time of the export
- Export: Your account's data
  Where to get it: Settings › Account › Download your data
  Format: JSON (UTF-8)
  Content: Account and profile, Workspace and MSSP Account memberships, notification settings, acceptances of the documents, security history, sessions, remembered devices (without their token), alert deliveries, the e-mail delivery log (without content), any suspension and its reason
- Export: An MSSP Account's data (managed customers and their references)
  Where to get it: On request at contact@patcharo.com
  Format: JSON or CSV
  Content: Managed customers, references, operators and roles, the account's notification settings

Exports use open, common formats (CSV, JSON) that can be read without any Patcharo-specific software. This register is kept up to date whenever the exports change.

3. Switching provider

- The Customer sends its request to contact@patcharo.com, stating whether it wants to retrieve its data, transfer it to another provider or have it erased.
- The request takes effect no later than two months after it is notified; the Customer may choose an earlier date.
- The export is delivered within the following thirty days, which may be extended once for a justified and notified technical reason.
- The data remains retrievable for at least thirty days after the end of the subscription or the effective date of the transfer, then is erased at the Customer's request, subject to statutory retention obligations.

The detailed terms are in the terms of sale (https://patcharo.com/legal/sales#data) and the data processing agreement (https://patcharo.com/legal/dpa#end).

4. Fees

No fee is charged for an export, a data transfer or a switch of provider, and there is no early termination penalty: online subscriptions are monthly and without commitment. Plan prices are on the pricing page (https://patcharo.com/pricing).

5. Infrastructure and jurisdiction

- Running the application and delivering pages: the global network of Cloudflare, Inc., a company subject to the law of the United States.
- Database and authentication: Supabase Pte. Ltd., a company subject to the law of Singapore, on Amazon Web Services infrastructure located in Paris (France).
- E-mail delivery: Plus Five Five, Inc. (Resend), a company subject to the law of the United States.
- Mailboxes of the @patcharo.com addresses: Zoho Corporation B.V., a company subject to the law of the Netherlands, with data centres in the European Union.

To prevent access by a foreign authority that would conflict with Union or Member State law, the Publisher relies on its providers' contractual commitments, encryption of exchanges and of the database at rest, and limiting the data transmitted. It discloses data to an authority only on a request founded on the applicable law, and informs the Customer before answering, unless the law forbids it.