← phpatch.com home

Privacy Policy

PHP Patch Assurance is operated by Superstar Telecom LLC. This policy covers phpatch.com and patch engagements.

What we collect

• Free scan: the URL you submit and what that site discloses publicly (response headers, fingerprints). We keep the scan result to operate the service.
• Deep check (read-only): a software inventory of the server you authorize — PHP binaries and versions, packages, containers, and crash indicators in recent logs. No application data, no user content, no database contents.
• Patch engagements: the patch manifest, before/after versions, verification results, and the snapshot of the runtime being patched.
• Billing: payment is processed by our payment processor; we do not store card numbers.
• Access key (patch engagements): for each order we generate an SSH key pair. The public key is shown to you, to install on a dedicated account on your Docker host; the private key is stored encrypted on our servers and is never displayed, sent anywhere, or written to any log. You never send us a password or a private key.
• Account security: when you sign in — or try to — we record the time, the email address entered, your IP address and browser, and whether the attempt succeeded. We use this only to detect and stop attacks on accounts and to investigate sign-in problems.

Retention

Pre-patch snapshots: 72 hours on the Patch tier, an extended window on Patch + Rollback, then deleted. Engagement records and reports are kept so we can support you and evidence the work; ask us at any time to delete your snapshot and engagement data early and we will.

The private key generated for an order is destroyed when the job completes; if the order closes without a job (refund or cancellation), it is destroyed within 7 days of closure.

Account security (sign-in) logs are kept for 180 days and then automatically deleted.

Sharing

We do not sell personal or engagement data. Infrastructure is hosted with Hetzner (data center in the United States for this service). Our subprocessors are Hetzner (hosting), Stripe (payments) and NVIDIA (the AI assistant — see below). We disclose data only when legally required.

Contact

Privacy questions: via the contact channel on https://phpatch.com/security

Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.

This document is published in English, which is the controlling text.

AI assistant

The website offers an AI chat assistant, powered by NVIDIA NIM. When you use it, the messages you type — together with the recent turns of the same conversation, which your browser sends along with each new message — are transmitted to NVIDIA, our AI service provider and a subprocessor, for the sole purpose of generating a reply. We do not sell chat messages or any other data. We do not store the content of assistant conversations on our servers: the only record we keep is an anonymous count of chats per day, with no message text and no identity attached. NVIDIA processes what is sent under its own privacy policy. Do not enter passwords, keys or personal data into the assistant. Assistant conversations are not used to operate the patching service.

Superstar Telecom LLC · phpatch.com · Free scan
Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.