Adora

Security isn't a single yes/no, but Adora is SOC 2 Type II compliant and holds SOC 2 Type II, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Adora hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@adora.so or via a /security page (Adora lists a security contact).

Adora lists 4 subprocessors on its trust center, including Amazon Web Services, Supabase, Clickhouse, OpenAI. Buyers use this for fourth-party risk review.

Adora hosts on AWS. Data residency details are on its trust center.

Adora's trust center is at https://trust.adora.so. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Adora takes privacy seriously and provides you with controls to allow or block what is captured in the end user’s browser. There are three primary privacy control features to manage data capture: masking, blocking, and URL management. By default, the Adora snippet does the following: - Masks all input fields, except for those with the CSS class `adora-unmask`. - Masks all HTML elements with the CSS class `adora-mask`. - Blocks all HTML elements with the CSS class `adora-block`. - Captures data only on pages where the snippet is installed, or where the URL is explicitly allowlisted. It also respects URL blocklists.

Privacy is a core value at Adora. We provide robust controls to ensure you capture only what you need and nothing more. Our privacy controls give you full authority over the data being sent: - Adora operates only on pages where the snippet is explicitly installed. - All input elements are masked by default. - You can configure additional elements to mask or block using `adora-mask` or `adora-block`. For guidance on managing your privacy settings, refer to Privacy Controls.

By default Adora doesn’t use any cookies. However, we do support tracking across subdomains, which requires the use of a first party cookie. This is setup on a case-by-case basis when requested by customers. If you want to link sessions between different subdomains (e.g. www.adora.so and app.adora.so) please reach out to us via slack.

Session data captured in the end user’s browser is transmitted securely via HTTPS and stored with encryption at rest. Adora does not capture images or screenshots directly from the client browser. Instead, only a stream of events—representing HTML and CSS changes—is recorded. These events adhere to the configured Privacy Controls to prevent the transmission of unwanted data.

Reach out to [privacy@adora.so](mailto:privacy@adora.so) with something identifiable (e.g. ip address or uid) and we’ll delete everything associated with that user.