Andora · Legal
Data Processing Addendum
Summary of how Andora processes personal data as a processor for Shield and the control plane. A countersigned DPA PDF is available for Control and Governance customers on request.
Roles
Customer is the controller (or a processor for its end users). Andora acts as a processor for account, workspace, and proxy metadata needed to deliver the service.
Categories of data
- Account identity (name, email, company, roles)
- Billing and subscription metadata
- Proxy metadata (tokens, cost, model, latency, status) — bodies only if opted in
- Support communications you send us
Transfers
Primary database: EU (Supabase). Sub-processors may process data in the US or other regions. Signed DPAs include Standard Contractual Clauses (or equivalent) where required for restricted transfers.
Breach notification
Without undue delay, and where feasible within 72 hours of becoming aware of a personal-data breach affecting customer data, Andora will notify the customer contact on file, with known facts and mitigation steps.
Sub-processor changes
Current vendors: /sub-processors. Material additions will be posted there. Paid customers may object as set out in the signed DPA (Governance: advance notice per agreement).
Security
Measures are described on /security.
Request a signed DPA
Email legal@useandora.com (CC privacy@useandora.com) or note “DPA” on /demo. We typically return a countersigned copy within two business days.