What PatchBee can touch, and what it cannot

PatchBee connects to Microsoft Intune through the Microsoft Graph API. Your Entra administrator consents to a defined set of application permissions, scoped to what packaging, publishing, assigning and reading install status require; PatchBee asks for nothing it does not use. The consent is visible in your Entra admin center as an enterprise application, and revoking it there cuts PatchBee off immediately. Apps already published stay in your tenant and keep working: Intune is the delivery mechanism and your tenant is the source of truth.

Nothing is installed on endpoints. There is no PatchBee agent, no script running on devices, and no device-level data beyond what Intune itself reports about app installs.

Every package starts as a plan: the install and uninstall commands, detection rule, requirements and the installer's hash, shown in full. An administrator reviews it and publishes; PatchBee does not create or change an app in your tenant on its own. Update automation runs within the policies you set (rings, delays, auto-approve, a CVSS fast-track threshold) and can be paused or rolled back at any ring.

Installers are downloaded from the publisher's own URL as recorded in the winget community repository or Homebrew, through requests guarded against server-side request forgery, so PatchBee cannot be steered into fetching from somewhere else. Each download is hashed and compared with the SHA-256 the source publishes before it is packaged; a mismatch fails the job. Where a source publishes no hash (a few vendors serve the latest build from a fixed URL), the plan says so rather than pretending to verify.

PatchBee runs on Microsoft Azure in the West Europe region (Netherlands). Data is stored in Azure Database for PostgreSQL and Azure Blob Storage, encrypted at rest by the platform. Tenant connection secrets are additionally encrypted by the application with keys held in Azure Key Vault, and are never shown back in the interface. Backups are taken automatically by the platform within the same region.

Each customer workspace is isolated at the data layer: every query is scoped to the workspace, and the MSP console adds per-customer scoping on top. An activity log records who did what in a workspace. The privacy page lists the exact fields stored and how to have them deleted.

CVE records and CVSS scores come from the US National Vulnerability Database, and the exploited flag from CISA's Known Exploited Vulnerabilities catalogue. The data is matched to catalog versions, not read from your devices: PatchBee is not a vulnerability scanner and never inspects endpoints. Apps without a reliable mapping show no data rather than a false "clean".

Every connection to PatchBee, to Microsoft Graph and to publishers' download servers uses TLS. The website and the application send HTTP Strict Transport Security headers, and the site sets a content security policy limiting where scripts and frames may load from.

Microsoft Azure hosts the service and Microsoft 365 delivers the email we send. The marketing site counts visits with self-hosted, cookieless analytics; session recording and LinkedIn ad measurement run only with your explicit consent. The contact page can load a Calendly booking calendar, as described on the privacy page. No other third party processes customer data.

PatchBee is built and operated by Elevate Solutions, a small team in Bosnia and Herzegovina. We do not hold a SOC 2 or ISO 27001 certification today, and we would rather say so than imply otherwise. We answer security questionnaires, and we will discuss a data processing agreement with EU customers who need one. Write to contact@patchbee.io.

If you believe you have found a security issue in PatchBee or this site, email contact@patchbee.io with the details and how to reproduce it. We read every report, reply quickly, keep you informed while we fix it, and credit you if you want to be credited. Please give us a reasonable time to fix an issue before publishing it.