This page describes what the Cloudek website and OpsPilot do with the information you give them, in plain language, so you can decide what to share. It describes how the site works today. It is not an audit report, a certification or a contract.
Updated · Last reviewed
Calculators, converters, inspectors and reviewers, such as the CIDR calculator, the PowerShell script risk reviewer, the log secret redactor and the DMARC, SPF and DKIM inspectors, work on the text you give them inside your browser. What you paste is not sent to Cloudek and is not saved by the page. The Email Health Check reads DMARC reports and .eml files you drop on it in your browser; the files are not uploaded.
The domain and mail DNS checker and the Email Health Check send the DNS names being looked up, for example _dmarc.example.com, to Cloudflare’s public DNS-over-HTTPS service after you press the button. Cloudflare receives those names and your IP address, as with any web request. Cloudek does not receive the results. The website SSL and TLS quick check only prepares a Qualys SSL Labs link; the hostname goes to Qualys when you confirm and open it.
Some tools offer an optional “Explain with AI” button. Nothing leaves the page until you press it.
store: false). OpenAI may keep API data for a limited period under its own terms, for example for abuse monitoring.OpsPilot is Cloudek’s own operations workspace for Microsoft 365 and Azure reports. It is not open to the public: it needs a sign-in with the owner role. Its checks are fixed, named read-only queries; it does not run free-form Microsoft Graph queries or PowerShell, and it does not silently run AI-generated commands. Customer tenants are not connected through this website. Access to customer systems is agreed in writing for each engagement.
The public tools do not store what you paste, including tokens, keys, certificates and logs. Masking and redaction use fixed patterns and can miss things such as names, internal hostnames or unusual secrets; read the result before you share it. The secure password-share and file-request pages are synthetic demonstrations: do not enter real passwords or upload real files.
| What you do | Where it is processed | What leaves your browser |
|---|---|---|
| Use most free tools | In your browser | Nothing you paste or drop |
| Run a DNS or Email Health lookup | Cloudflare public DNS | The DNS names being looked up, plus your IP address as in any web request |
| Open the SSL and TLS check link | Qualys SSL Labs, after you confirm | The hostname you entered |
| Press “Explain with AI” | Cloudek API on Azure, then OpenAI API | The masked text shown in the preview, up to 6,000 characters |
| Visit a public page | Cloudek’s own counter, and Google Analytics only if you accept | A fixed page ID; with analytics accepted, also the page path and a fixed page name (details below) |
| Send a service enquiry | Your own email app | Whatever you choose to send from the draft it opens |
Google Analytics 4 is off until you accept it: a notice on public pages asks, and Google Analytics is not loaded and receives nothing unless you press “Accept analytics”. You can change the choice at any time from “Cookie and privacy settings” in the footer. If you accept, a public page sends one page-view event to Google Analytics 4. Public pages also send one request to a Cloudek counter hosted on Azure, whatever you choose. Google receives the page address (domain and path only) and a fixed page name, never query strings, fragments, referrers, document titles or anything you typed. Google signals and ad personalisation are turned off, but Google still receives the technical details that come with any web request, such as your IP address and browser, and sets its own cookies. Cloudek’s counter receives only a page ID from a fixed list and keeps daily totals per page. It sets no cookie and stores no IP address, user agent, referrer or query string. See the privacy notice for the full picture. Analytics is not loaded on a short list of email-review, email DNS and header pages and the secure-transfer demos, or on the private owner pages. You can block it with your browser settings or a content blocker; the tools keep working.
The service enquiry form works inside your page. It collects a service area, a broad environment and an optional short outcome, then opens a draft in your own email app for you to review and send. Please keep enquiries high level and leave out passwords, tokens, personal data and raw diagnostics. Paid reviews have their own written scope, evidence handling and retention terms, agreed before any access or files are exchanged.
Use the request page and choose “Other IT service enquiry”, or email info@cloudekhosting.com. Describe the issue at a high level and leave out credentials, tokens, personal data and raw logs. We will agree a suitable channel before any evidence is shared. The same contact is published in a security.txt file. A dedicated security mailbox may be added later if the owner sets one up; until this page says so, use the address above.
This page describes the behaviour of the public website and OpsPilot as of the review date above. It is general information, not legal advice, and it does not replace the written agreement for an engagement. AI output can be wrong or out of date. Third-party services (Cloudflare, Google, Microsoft Azure, OpenAI, Qualys) handle data under their own terms.