Last updated: 2026-10-18

InfoDefenders, LLC ("we," "our," or "us") operates Client Posture (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

Information We Collect

We collect information you provide directly to us when you create an account, use our Service, or communicate with us. This includes:

Account information (email address, name, company name)
Playbook requests: name, work email, company, optional client count, optional marketing opt-in, and a campaign ref when you download The First 90 Days playbook. The PDF is delivered on the page; we do not email it to you.
Payment information (processed securely through Stripe)
Domain names you scan and their security assessment results
Usage data and analytics, including cookieless page-view and performance analytics from Vercel Web Analytics and Speed Insights. We remove share links and query strings before they are sent.
Free tool and homepage scan logs: the tool you used, the domain you checked, a summary of the result (grade and score), a salted hash of your IP address (never the raw IP), a general device type (desktop, mobile, tablet or automated), the website that referred you, campaign tags (ref/UTM) and the first page you landed on from our first-party attribution cookie, and your organization if you are signed in.
Proposal acceptance records when someone accepts an MSP quote: name, email, optional title, IP address, user agent, timestamp, and the proposal content hash. We store this on behalf of the MSP as evidence of acceptance. Client Posture is not a party to the MSP–client agreement.
Proposal view tracking on public quote links (a hashed viewer identifier, first/last viewed time, and view count) so the MSP can see that a proposal was opened.
Security Brief view tracking on public prospect brief links (a hashed viewer identifier, first/last viewed time, and view count) so the MSP can see that a brief was opened. We do not store the viewer's name, email, or raw IP address for this purpose.
Anonymous homepage scans: the domain you type, the public-scan results, a short-lived signed token in an httpOnly cookie, and a hashed visitor fingerprint (hash of IP + browser cookie). We do not store raw IP addresses for this purpose beyond a short in-memory rate limiter.

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Process your transactions and send you related information
Send you technical notices, updates, and support messages
Respond to your comments and questions
Monitor and analyze trends and usage

Passive Scanning

Our Service performs passive external security assessments using publicly available information, including DNS records, certificate transparency logs, and normal HTTPS requests. We do not perform vulnerability testing, port scanning, or any intrusive security testing.

Data Ownership

You own the domain names you submit and the assessment results we generate for your organization. InfoDefenders, LLC processes that content to provide the Service (as a service provider / processor for your business use). We do not sell your scan results or use them to market to your clients.

Data Retention

Account & organization data: kept while your account is active. After a verified deletion request, we remove or anonymize account profile data within 30 days, except where law requires longer retention.
Domains, scans, and reports: retained for the life of the account so you can show history to clients. Deleted with the account on request (or earlier if you remove a domain in-product).
Anonymous free scans: stored up to 7 days (or until you claim the scan into a workspace) so we can attach the result after signup. Hashed visitor fingerprints are kept only as needed for the 3-scans-per-day abuse limit.
Scan logs: free-tool and homepage scan logs are deleted after 12 months.
Payment & invoice records: retained as needed for tax, accounting, and fraud prevention (typically up to 7 years), via Stripe and our books.
Operational logs: short-lived host and application logs used for reliability and abuse prevention (generally days to a few weeks).

To request deletion, email support@clientposture.com.

Subprocessors

We use these processors to run the Service (same list as our Security page):

Vercel — application hosting, web analytics and performance monitoring
Supabase — database, authentication, and file storage
Stripe — payment processing
Resend — transactional email

AI assistants

If you connect an AI assistant with an API key, Client Posture returns the organization data that assistant requests (client grades, findings, quotes, and similar records). That data then flows to the AI provider you chose, under your account and that provider's terms. Client Posture hosts no large language model. We do not train models on your data. You are responsible for your AI provider's handling of data fetched through the connection.

Finding an IT provider (MSP matching)

When you use "Find an IT provider" on one of our free tools, we collect what you enter: your name, work email, company, ZIP code, what you need help with, and any notes. We also keep a summary of the scan you ran (the domain, its grade, and the failed checks), the version of the consent you agreed to and when, whether you opted in to marketing emails, and your IP address to prevent abuse. We only act on your request after you confirm it from the email we send.

Who we share it with. Eligible IT providers (independent businesses that use Client Posture) that serve your state, and after 24 hours without a response, neighboring states, can see a summary without your contact details: your state, the tool, the grade, the failed checks, and what you asked for. Your name, email, company, domain, ZIP and notes are shared with only one provider: the first that accepts your request. That provider is an independent business, not Client Posture, and uses your details under its own privacy policy to answer your request. We don't sell your information. If no provider covers your area or none accepts, we tell you, and the Client Posture team may reply to you directly.

Retention. We keep your request and contact details for as long as needed to handle your request and for up to 12 months after that, unless you ask us to delete them sooner.

Deletion. You can delete your request at any time with the link in your confirmation email, or by replying to any email about your request. Deleting removes your request and contact details from Client Posture, including from the provider's view in Client Posture. If a provider has already contacted you, ask that provider to delete any copy they made.

Data Sharing

We do not sell your personal information. We may share your information with:

The subprocessors listed above, only to operate the Service
Law enforcement or regulatory authorities when required by law

Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Your Rights

You have the right to:

Access and receive a copy of your personal information
Correct inaccurate or incomplete information
Request deletion of your personal information
Object to or restrict certain processing of your information

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

InfoDefenders, LLC
7901 4th St N. STE 300, St. Petersburg, FL 33702
Email: support@clientposture.com