Privacy policy
Last updated November 5, 2026. Applies to the K-Defender website, the K-Defender desktop app, and the K-Defender Enterprise edition, all provided by C-Le-B Services (Texas, USA).
The short version
- K-Defender is built so your security data stays with you. We do not receive your audits, findings, reports, tickets or log events.
- The apps contain no analytics or tracking, and they send no usage data to us.
- The only things that leave your computer or servers are what you tell them to send: requests to the sites you audit, text sent to the AI provider you choose, alerts to Teams or email you set up, and public vulnerability data downloaded from the internet.
- This website collects only what you type into the contact form, plus ordinary server and network logs. It sets no advertising or tracking cookies.
- We never sell personal information.
1. Who we are
K-Defender is made by C-Le-B Services, a Texas company. In this policy, "we" and "us" mean C-Le-B Services. You can reach us through the contact form on this site, and we reply by email.
2. This website
What we collect
| Data | Why | Where it goes |
|---|---|---|
| Name, email, organization (optional), edition, topic and message from the contact form | To read and answer your message | Emailed to us through Microsoft 365, and saved on our server so a message is not lost if email fails |
| Your IP address, when you send the form | Spam protection and rate limiting | Saved with your message on our server |
| Standard web server logs (IP address, pages requested, browser type, time) | Security, reliability and troubleshooting | Our web server and Cloudflare |
Cookies and tracking
The site does not set cookies of its own and does not use advertising or behavior tracking. Cloudflare sits in front of the site to protect and speed it up, and it may set a security cookie and may measure basic, aggregated traffic. Fonts are loaded from Google Fonts, so Google receives your IP address and browser details when a page loads.
How long we keep it
We keep contact messages as long as needed to answer you and keep a record of the conversation, and delete them when you ask. Server logs are kept for a short period for security and are then rotated out.
3. The K-Defender desktop app
The desktop app runs on your computer and stores its data there, in the app's own data folder. That includes audits, reports, uploaded project files, risk assessments, your settings, and a local copy of the public CVE database. We do not have access to any of it. Uninstalling the app and deleting that folder removes it.
What the app sends over the internet
- The websites you audit. The app loads the address you enter, like a browser would, and reads the page, headers and performance data.
- Your chosen AI provider. Analysis, summaries and risk reports are written by an AI model you select in Settings. The app sends that provider the information it needs for the task: text gathered from the audited page, findings, relevant code excerpts if you uploaded a project, and screenshots when you use a vision model. Each provider has its own privacy terms, so choose one you trust, or run a model on your own network and nothing leaves it. We do not receive this data.
- Vulnerability data. The app downloads the public CVE list from the internet when you first run it and when you press refresh. It does not send your data in return.
- Microsoft Store. Subscriptions are sold and billed by Microsoft. The app asks the Microsoft Store whether your subscription is active. We never see your payment details.
Keys and license codes
AI provider keys you enter are saved on your computer. A license key we give you is checked on your computer against a built-in public key. Checking it does not contact us.
4. The K-Defender Enterprise edition
Enterprise runs on servers you control, in Docker. All data it stores is stored on your infrastructure, and we have no access to it. You are the one responsible for that data, and your organization decides what is collected and how long it is kept.
What the software stores for you
- People. When someone signs in with Microsoft Entra ID, the app records their name, email address, directory object ID and group memberships, so it can decide what they may see and offer them as ticket owners. Sessions are kept on the server.
- Events and tickets. Security events from the sources you connect (Event Hub, syslog, webhooks), the AI's decision and reasoning for each, the tickets built from them, and every note, assignment and status change with who made it and when.
- Audits and risk data. Same as the desktop app.
What Enterprise sends out
- Your AI provider. The text of events being triaged goes to the model you configured. Events can contain usernames, host names and IP addresses. Use a provider you trust or host your own.
- Microsoft Teams and email. Ticket alerts and digests go to the Teams webhook and mailbox recipients you set up, using your own Microsoft 365 tenant.
- Microsoft Graph. Used to list users and groups for the owner menu and to send email, with permissions you grant to your own app registration.
- Vulnerability data. The public CVE list is downloaded and refreshed hourly.
Because event data can include information about your employees or customers, you may need to cover this processing in your own privacy notices and agreements.
5. Who else is involved
- Microsoft for the Store, Entra ID, Microsoft 365 email, Graph and Teams.
- AI providers you choose for model processing.
- Cloudflare for protecting and delivering this website.
- Google for web fonts on this website.
- GitHub as the source of the public CVE list.
We do not sell personal information, and we do not share it for advertising.
6. Your choices and rights
You can ask us to tell you what contact information we hold about you, to correct it, or to delete it. Send a request through the contact form and we will act on it. Depending on where you live, you may have further rights, such as those under the GDPR or the California Consumer Privacy Act, and you may complain to your local data protection authority. For data inside the apps, you already control it directly, because it is on your computer or your servers.
7. Security
This site is served over HTTPS. The apps are designed to keep data on your side, to bind the desktop app to your own computer only, and to keep Enterprise sessions on the server. No system is perfectly secure, and you are responsible for securing the computer or servers that run K-Defender.
8. Children
K-Defender is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.
9. Changes
If we change this policy, we will post the new version here and update the date at the top. If the change is significant, we will say so on the home page.
10. Contact
Questions about this policy or a request about your information: use the contact form and choose the topic that fits.