Privacy and data boundary
What Kairavo keeps on your computer, what it sends and to whom, how local data is protected, and how to remove it.
Kairavo runs on your computer. Your tenant history stays there. Kairavo has no telemetry, no crash reporting, no analytics and no diagnostic upload.
For the legal terms, read the Privacy Policy.
What stays on your computer
| Data | Where it is kept |
|---|---|
| Collected tenant history | A local PostgreSQL database in the database folder. Preferences > Local database shows the folder. |
| Tenant sign-ins and Microsoft sign-in tokens | Encrypted files in the Kairavo user data folder. |
| Your license key, preferences, database passwords and integration secrets | The same encrypted files. |
| Logs | The logs folder in the Kairavo user data folder, scrubbed of tokens, keys and credentials. See Diagnostics and logs. |
| Automation output | The Kairavo/Automation folder in your Documents folder. |
The Kairavo user data folder is:
%APPDATA%\KairavoThe database folder is %APPDATA%\Kairavo\database, unless you chose another location.
Each installation keeps its own history. Two admins on two computers have two separate histories.
What Kairavo sends, and to whom
Kairavo connects only to the services below. It uses the operating system network settings for every connection, including the proxy and trusted certificates.
| Service | Why | What is sent |
|---|---|---|
Microsoft sign-in (login.microsoftonline.com) | Signing in to your tenants | Your sign-in, through your own app registration. |
Microsoft Graph (graph.microsoft.com) | Reading your tenant | Requests with your own delegated token. The data comes back to your computer only. |
Kairavo licensing (kairavo.com) | Checking your license | The license key, a random installation ID, the tenant ID, the operating system and the app version. Also your app registration's client ID and a fresh Microsoft sign-in token, to find licenses shared with the tenant. |
GitHub (github.com) | Updates, while a tenant holds a valid license | A plain HTTPS request for the releases feed and downloads. No tenant or product data. See Updates. |
| PowerShell Gallery | Only when you select Install modules for this user on the Automation page | PowerShell downloads the Microsoft.Graph.Authentication module. |
| Services you configure | Only the integrations you set up | Only what that integration needs, sent directly from your computer, never through Kairavo. |
The license check never sends device, user, policy or app data from your tenant, and never sends logs or Microsoft Graph access tokens.
Services you configure are off until you set them up. They include:
- Alert and report delivery channels.
- AI model endpoints, including local models.
- ITSM and paging services.
- Hardware vendor warranty services.
- Git hosts for configuration as code.
- Public script catalogues and check and report pack repositories.
Changes to your tenant
Monitoring only reads. Kairavo collects with read permissions and never changes your tenant while it collects.
Automations are the exception, and only when you allow them. A script that sends email or changes your tenant runs only after you turn on Allow automations that change your tenant on the Automation page. Every such run then asks for your confirmation in a system dialog. It uses a token with exactly the permissions the script declares. Device scripts never run in Kairavo.
Support
Support email is the only way diagnostic data reaches us, and only when you attach it yourself. A diagnostics export is saved to a file you choose, so you can read it before you send it.
How local data is protected
- Local database. Kairavo runs its own PostgreSQL database. It listens only on
127.0.0.1, so other computers cannot reach it, and it accepts only password logins. Kairavo creates random database passwords and keeps them in its encrypted store. - Encrypted store. Sign-ins, Microsoft token caches, the license and integration secrets are encrypted with the operating system: DPAPI on Windows and the Keychain on macOS. They are bound to your user account on this computer.
- Disk encryption. The database files are not encrypted by Kairavo itself. Turn on disk encryption, such as BitLocker on Windows or FileVault on macOS, to protect your history at rest.
On Windows, DPAPI protects the encrypted store against other users of the computer. It does not protect against other programs that run as your own user.
Remove your data
Open Go > Settings. Under Tenants and sign-in, select Sign out for each tenant. This removes the sign-in and its tokens from this computer.
Under License, select Deactivate this machine to release this computer's license activation.
Quit Kairavo and uninstall it. The uninstaller keeps your data folder, so a reinstall finds your history.
To remove everything, delete the Kairavo user data folder listed above. If you moved the database with Change location, delete that folder too.
On macOS, you can also delete the Kairavo Safe Storage item in Keychain Access. It holds the key for the encrypted store.
Deleting the data folder removes your collected history for good. If you want to keep it, export a history archive first.
To have data that Kairavo holds about your license deleted, write to support@ugurlabs.com. The Privacy Policy explains what is stored and for how long.