Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
- What does Dora AI actually offer?
- How is Dora AI built and delivered?
- What data does Dora AI collect and process?
- Which security certifications or audits does Dora AI have?
- What are the main risks of integrating Dora AI into corporate messaging?
- How can a security team evaluate Dora AI before adopting it?
- Should you use Dora AI in a production environment today?
- Where can you learn more about evaluating SaaS AI assistants?
Key takeaways
- Dora AI is a 2024 Delaware startup that provides a 24/7 AI relationship - coaching assistant via messenger integrations.
- The company does not publish detailed technical or compliance information, so security teams must perform their own risk assessment.
- Primary concerns include data privacy in messaging apps, lack of public certifications, and unknown LLM model provenance.
- Use a layered approach: review the privacy policy, test API endpoints for data leakage, and monitor for third - party access.
What does Dora AI actually offer?
Dora AI delivers a real - time conversational coach that works inside WhatsApp, iMessage, Slack and similar platforms. The service is marketed as a 24/7 assistant that helps users resolve conflicts, improve communication skills and develop personally and professionally.
How is Dora AI built and delivered?
The product runs as a cloud - hosted SaaS service accessed through APIs and webhooks that connect the AI engine to messenger apps. The company says it uses “advanced AI technology” and a “human - centred design” layer, but it does not disclose the underlying large - language model, cloud provider, or any runtime hardening measures.
What data does Dora AI collect and process?
Public statements only imply that user messages are sent to the AI service to generate a response. No explicit details are given about encryption in transit, data retention periods, or whether conversations are stored for model training. The lack of a privacy policy that lists these specifics makes it impossible to confirm compliance with GDPR, CCPA or other regulations.
Which security certifications or audits does Dora AI have?
Dora AI’s LinkedIn profile and website do not list any security certifications (ISO 27001, SOC 2, etc.) or third - party audits. Without independent verification, organizations cannot rely on the vendor’s self - claimed “human - centred design” to guarantee data protection.
What are the main risks of integrating Dora AI into corporate messaging?
- Message interception - If the API calls are not secured with TLS 1.3 and strong cipher suites, an attacker could capture sensitive relationship advice that may contain personal identifiers.
- Data residency - The cloud provider is unknown, so data may be stored in jurisdictions with weaker privacy laws.
- Model hallucination - An undisclosed LLM could generate inaccurate advice, leading to user trust issues and potential liability.
- Third - party access - Integration with Slack or WhatsApp may expose the bot’s credentials if not stored securely.
How can a security team evaluate Dora AI before adopting it?
- Request a security questionnaire - Ask for details on TLS version, cipher suite, encryption at rest, and data retention.
- Perform a passive scan - Use a tool like Decloak’s free scan to check the public endpoints for TLS posture, HTTP headers, and any exposed third - party domains.
- Conduct a controlled API test - Send benign messages and monitor network traffic to verify that only the necessary data is transmitted.
- Review the privacy policy - Ensure it includes explicit statements on data deletion, user consent, and compliance with relevant regulations.
- Monitor for updates - Because Dora AI is a very early - stage startup, its security posture may evolve; set up alerts for any new compliance certifications or third - party audits.
Should you use Dora AI in a production environment today?
Given the absence of published security details, certifications, or clear data - handling policies, it is advisable to limit Dora AI to low - risk personal use or a sandbox environment until the vendor provides concrete security evidence.
Where can you learn more about evaluating SaaS AI assistants?
- Decloak’s guide on assessing third - party SaaS risk: https://decloak.com/journal/your-ssl-certificate-being-valid-isnt-the-same-thing-as-your-tls-being-secure
- OWASP Top 10:2025 for guidance on data exposure and insecure API design.
All factual statements about Dora AI are drawn from its LinkedIn profile and public website as of September 2026.
Related guides
What is NIST in cybersecurity and why should you care?
NIST is the U.S. agency that creates the Cybersecurity Framework and a suite of standards like SP 800 - 53 that guide risk management for both government and private organizations.
Which NIST Cybersecurity Standards Should My Organization Adopt in 2024 - 2025?
Learn the core NIST publications that form a practical, layered security program, how they map together, and concrete steps to start using them today.
Does the EU AI Act apply to U.S. companies?
Yes - the EU AI Act has extraterritorial reach and can bind U.S. AI providers, deployers, importers or distributors whenever their systems are placed on the EU market, used by an EU entity, or produce output that is used in the Union.