Terms of service

PatchFirst operator: PatchFirst (operator details will be published before payments open). Service, payment and complaint contact: [email protected]. Effective date: 2026-10-23.

1. What PatchFirst provides

PatchFirst compares the submitted anonymized software inventory against known CVEs and exploitation signals, calculates a rating and suggests remediation priorities. A one-off check of one server you own is free: a rating and highlighted stack, without finding details. CVEs, fixed versions, exploitation signals and recommendations are available only in paid monitoring. The agent reports periodically, every 6 hours by default and vulnerability feeds refresh every few hours. Results are in your dashboard; paid monitoring supports webhooks configured in Notifications.

PatchFirst is an information tool. It does not replace a security audit, penetration test, backups or a system administrator. A rating does not certify that a server is free of vulnerabilities or compromise.

2. Registration and permitted use

The webhook receiver URL is stored by the service in plaintext alongside the fleet and may identify your company. Use an address without a recognizable domain, such as a proxy or webhook receiver service. The receiver gets your selected events with the server UUID, an open alias if set, and brief finding details; inventory and encrypted names are excluded. You are responsible for choosing the receiver and protecting the signing secret.

When registering, you accept this version of these terms and the separate acceptable use policy. If acting for an organization, you confirm your authority to do so. Choose an invented username without your name, email address or phone number. Protect your login password, recovery code, tokens and devices, and notify the operator of suspected unauthorized access.

Connect only servers you own or have the owner's permission to assess. You are responsible for rights to submitted data, agent configuration, reviewing recommendations, updates and the security of your systems.

Save the recovery code at registration. Account recovery requires your username and this code: resetting the password issues a new code and invalidates the old one. You can issue a new code in the dashboard by confirming your current password. Losing both the login password and recovery code means losing access; the operator cannot restore it through your name, identity documents or email. This is a deliberate trade-off for registration without a name, email address or phone number. The separate names password is never known to PatchFirst; resetting the login password neither changes nor recovers it.

3. Price, payment and renewal

Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50. Each rate applies only to servers in that tier, and the tier amounts add up. For example, 10 servers cost 5 × $3.00 + 5 × $2.00 = $25.00 per month. You pay for an agreed number of server slots for a set term; a billing month means 30 days. For other terms, the monthly price is multiplied by the month count; totals are rounded to the selected currency’s minor unit. The credited term follows the paid month count, including all 12 months of an annual subscription. When the slot count changes, unused paid value is converted to time at the new price. Used grace debt is deducted once and cannot exceed the new payment; the credited term always ends in the future. The number of slots, term and total are confirmed before payment.

In the dashboard, choose the number of servers and billing period, review the total calculated by the server, and select “Pay” for an available provider. Return to the dashboard after checkout: slots and time are credited automatically after the provider's verified webhook. Returning alone does not confirm payment; the order remains pending until confirmation arrives. Payment history shows the order number, amount and date. There is no automatic charge or automatic renewal; you initiate each new payment.

Paddle is the Merchant of Record for international payments and handles applicable sales-tax collection and remittance. ЮKassa accepts payments in Russian rubles, including Mir cards and SBP; fixed ruble tier prices are shown before payment. CoinsSend is a custodial cryptocurrency service: it receives and holds funds on its side. Orders are priced in USD; the minimum CoinsSend payment is $3.00. Available coins include USDT, BTC, ETH, TON, USDC and others; the buyer chooses the coin and network on the CoinsSend page. The buyer pays the network fee. PatchFirst pays the service fee. An invoice lasts 24 hours; receipts on the merchant balance are held for 24 hours for AML checks. See the CoinsSend coins and fees page; the selected provider confirms available methods and the total before payment.

Seller for ЮKassa payments: an individual entrepreneur; details are not filled in. The owner must provide the seller's legal name, INN, OGRNIP, address and contact before enabling payments for Russia. These details are currently missing; the Russian seller and payment recipient differ from Paddle, the international Merchant of Record.

After expiry, new servers cannot be added above the available quota. Existing servers have a 7-day grace period for inventory updates, after which new inventory submissions stop. Reading and deleting stored data remain available, subject to retention limits.

Payment platforms and infrastructure operators process payment data under their own rules; Paddle, ЮKassa and CoinsSend act as independent controllers. PatchFirst sends a random opaque order number and payment parameters without a username or payer details. The privacy notice explains the data retained and the providers' roles.

An invited account’s first successful subscription payment credits the inviter with +1 server-month. The invited account receives no bonus. One server-month extends one chosen server by one month, rather than the whole fleet: with two servers, only one is extended. The owner chooses which server to extend and when to spend accumulated bonuses; the redemption value follows the selected server’s tier rate. Bonuses expire 12 months after being credited. Only a full refund or chargeback of the invited account’s payment reverses the unused bonus; a partial refund does not affect it. If already spent, it creates bonus debt: future bonuses first repay that debt. No money is collected, and bonus-funded slots and time remain available. CoinsSend payments earn the bonus after 14 days without a reversal. The limit of one bonus per payer fingerprint ever, across all inviters, applies only to platforms that provide a payer fingerprint (card payments through Paddle and ЮKassa). CoinsSend does not provide a payer fingerprint; this limit does not apply to cryptocurrency payments. In cases of abuse, including inflating invitation bonuses through your own accounts, the operator may cancel bonuses under the acceptable use policy. Bonuses are not money, cannot be exchanged for money and cannot be refunded. Copy the invitation link from your dashboard and share it: registration through that link connects the accounts, and the first successful payment credits the bonus automatically. No manual promotion code is needed.

Promotion codes and partner referrals

Only the service operator issues promotion codes. A code can have no expiry or have an expiry date, a total usage limit and a per-account limit. Its issue conditions define the discount, minimum server and month counts, gift amount and partner attribution. A discount is saved to the account and applies once to the next eligible order; discounts from different codes do not stack. The discounted payment is at least 0.01 in the selected currency: a fully free term is issued as a gift. Gift slots and time are activated immediately: the code defines the server and month counts, and each month means 30 days. An existing plan is recalculated under the billing rules while preserving its unused prepaid value. A gift is not a payment, earns no first-payment invitation bonus or partner reward, and cannot be exchanged for money.

A partner code attributes the account to its first partner only before the first successful payment. After the first successful payment, a partner code can only give a discount: it neither changes the partner nor credits a gift. Partner rewards, currency, rate, earning period and payout procedure are subject to a separate agreement between the operator and the partner. Rewards accrue only on successful payments; a refund or chargeback reverses the corresponding reward. If already paid out, the partner balance becomes debt accounted for against subsequent accruals and payouts.

The operator may revoke a code and end its future application. Already credited gifts and the confirmed total of an existing payment remain valid, except in cases of abuse or mandatory legal requirements. Refunds for discounted payments use the amount actually paid and the general refund rules.

4. Cancellation and refunds

You may stop using PatchFirst at any time and choose not to renew. Not using an already supplied period does not itself trigger an automatic refund. For mistaken or duplicate payments, failure to provide paid access, or a refund required by mandatory law, contact the operator with the order number and your request. Send only the information needed for reconciliation; never send passwords or card details.

The operator reviews the request and agrees the refund amount and method. Unused prepaid time is refunded if the operator permanently ends the service without a breach on your part. Mandatory cancellation rights, refund rights and other remedies remain available.

Following a full refund or chargeback, slots and time credited by that payment are reversed under the billing rules; access is recalculated using remaining payments, used grace and debt. The unused invitation bonus is removed; spent bonuses create bonus debt, repaid by future bonuses. No money is collected and no slots are taken away. A partial refund does not affect the bonus. For Paddle and ЮKassa, the status updates automatically after a verified webhook, and refunds use the original provider and its procedures. For CoinsSend payments, only full refunds are available; the operator makes them on request manually in cryptocurrency: contact the operator by order number and agree the coin, network and refund address. After completing the refund, the operator records it by order number; credited slots, time and related bonuses are recalculated under the same rules. CoinsSend refunds are not automatic.

You can leave names unset: the dashboard will show “Server 01”. You can also choose an alias such as web-1: it is stored openly. Do not enter a domain, IP address, company or customer name. For protection, enable name encryption in Account: your browser will move existing names into an encrypted dictionary and the service will delete the open copies.

5. No warranties and limited liability

To the extent permitted by law, PatchFirst is provided “as is” and “as available”, without warranties of completeness, accuracy, currency, fitness for a particular purpose or uninterrupted operation. Sources may lag and versions may be misidentified; false positives and missed findings are possible. The server owner decides what to fix and bears responsibility for those decisions.

To the extent permitted by law, the operator is not liable for indirect loss, lost profits, lost data or the consequences of attacks or actions taken on reports. The operator's total liability relating to the service is limited to the amount you paid for the last paid month of monitoring. The fee for a free check is zero.

These limits do not exclude or restrict liability or rights that mandatory law does not allow to be excluded or restricted, including applicable consumer rights. Where a limit is invalid, the mandatory legal rule applies.

6. Availability and data

Maintenance, outages, feed delays and changes to features may occur. Plans include no guaranteed response time or SLA. Results are available in your dashboard; paid monitoring supports webhooks configured in Notifications. Keep your own backups and regularly review your servers.

The Data & privacy page explains what the service sees, anonymization, encryption and retention. You retain rights to your data and authorize its processing only to operate the service and prevent abuse.

The anonymized inventories and reports for monitoring are stored in PostgreSQL in readable form for searching and recalculation. Their contents are available to the service and anyone holding a database copy. When name encryption is enabled, the owner seals the names dictionary with a separate names password; PatchFirst cannot read it. Backups use a separate recipient key, with no private key on the server; disk encryption is configured on the host. The Data & privacy page explains these boundaries and retention periods.

7. Ending access

You may delete your account and data or contact the operator. Disable agents and revoke tokens. The operator may restrict or end access for a breach, a threat to the service or a legal requirement. Breaching the acceptable use policy may lead to suspension without a refund to the extent allowed by law; that policy explains how to contact the operator about a decision.

8. Changes, governing law and complaints

Revisions are published with a date and version. Material changes to paid access are communicated before taking effect; a new price applies to the next agreed payment. Contact the operator if you disagree with a change and stop further use.

Operator's governing law and jurisdiction: to be stated together with the operator details. Mandatory protections under the law of your place of residence remain available. Send complaints first to [email protected]; this does not restrict your right to approach a competent court or regulator.