Auth0 Data Processing

Describes how Auth0 processes data in its possession.

This document discusses what data Auth0 has, as well as how it processes this data.

Data Auth0 possesses

All of the data Auth0 has about an end user is located in the Auth0 user profile. The specific attributes contained in the user profile vary based on customer implementation and are based on a number of factors, such as connection type, user consent during the authentication flow, and whether you’ve augmented the user profiles with additional information.

Auth0 metadata is not a secure data store and should not be used to store sensitive information, such as high-risk secrets and Personally Identifiable Information (PII) like social security numbers or credit card numbers. Auth0 customers are strongly encouraged to evaluate the data stored in metadata and only store that which is necessary for identity and access management purposes.

When data is stored

The Auth0 user profile information is stored in Auth0 when you use a database connection. If a user logs in using any other type of connection (including custom database connections), Auth0 stores information provided by the external identity provider for future queries.

How data is used

The personal data stored in Auth0 is used only for the purposes of providing its services, namely authenticating users

How can I delete my data?

As the Data Controller, the Customer is responsible for managing and deleting data via the self-service features including:

• Delete or Reset Tenants - Use this feature to delete a Tenant. When you delete a Tenant, the system permanently removes all associated Customer data.
• Manage Users Using the Management API - Use the API to retrieve, create, update, or delete users with the Management API.
• Manage Users in Dashboard - Use the Dashboard to create, view, modify, or delete users manually.

When is Customer data automatically deleted?

Auth0 retains Customer data as long as the Customer is considered active.

Auth0 classifies a Customer as inactive when they meet both of the following conditions:

1. The Customer uses a Free Plan (including those who opted for or downgraded to a Free Tier).

2. All associated tenants show no activity for a continuous period of 150 days.

After 150 days of inactivity, the system schedules the inactive Customer’s tenants and all associated data for permanent deletion.