Security

• Each client sees their own workspace and nothing else.
• Internal notes and team-only updates are only visible to your team.
• What your team can do follows their role in your company.
• Every read and change is checked against these rules, the same way in the app, the API, and over MCP.

There are no passwords to leak. People sign in with a link sent to their email, and each link works for 15 minutes.

AI apps like Claude and ChatGPT connect with OAuth. Every connection goes through Dora's consent screen and acts as the person who approved it, with their access and no more. People see and disconnect their apps in Settings.

Dora's AI runs on Claude, made by Anthropic. When Dora works on something, the content she needs is sent to Anthropic to write her answer.

We don't train AI models on your content, and under its commercial terms Anthropic doesn't either.

In Dora's chat, every change she suggests waits for your click. She assigns or approves work on her own only if you turn those settings on.

Dora runs on a few established providers, each only processing data to provide their service:

• Vercel hosts the website and app.
• Convex stores the database and files.
• Anthropic runs Dora's AI.
• Resend sends and receives email.
• Stripe and Link handle payments.

Data is encrypted in transit and mainly processed in the United States.

Card details go straight to Stripe and Link. Dora never sees or stores card numbers.

To export or delete your company's data, email [legal@dora.work]. Deleted data is removed from Dora within 30 days and from backups after that.

Found a vulnerability or something that looks wrong? Tell us at [legal@dora.work]. We'll look into it right away.