667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Guest Author

Eugene Kogan

Eugenia Castaño

Talent Acquisition Specialist

eugenio-pace-new-avatar

CEO and Co-Founder

Eugenio Pace

Eutelo Pena

Head of Product at Alice Biometrics

sofia-prosper

Sofía Prósper, a trained architect, is a passionate Developer Advocate and the current Partner Manager of Auth0 by Okta Marketplace. She has a diverse background focused on architecture, design, art, and verbal communication. Recipient of the Spanish Data Protection Agency Prize in 2018, in her spare time, she has worked since as an advocate defending Privacy, Digital Rights, and Digital Sovereignty in Spain. Outside her daily work, you can find her illustrating her travel journal, cooking for friends, collecting recipe books, and joining side projects in beautiful Galicia, Spain.

Senior Developer Advocate and Partner Manager of the Auth0 Marketplace

Sofía Prósper Díaz-Mor

All my career I have been oriented to the creation of software products for mobile devices. Initially, as an Android & iOS developer, implementing biometric solutions in Gradiant / Alice Biometrics. Over the years, my role has been changing towards the management layer, the product and the leadership of teams, carrying it out in places like Bank Sabadell, InAuth (AMEX group), Verse (Square group) or Eccocar. Currently back home, where I am helping to make digital onboarding easier for people.

Facial biometrics revolutionizes digital processes. Implemented thoughtfully, it provides businesses a competitive edge while safeguarding privacy.

## Introduction

In the era of digital transformation, businesses are constantly looking for ways to streamline their processes and enhance security. One technology that is rapidly gaining traction in this regard is facial biometrics, which includes face recognition and face liveness detection. This technology is revolutionizing processes such as the digital onboarding of new users and adding an extra layer of security to prevent AI bots and fraudsters from causing harm. Auth0 has included facial biometrics features at [Auth0 marketplace](https://marketplace.auth0.com/partners/alice-biometrics).

## The Power of Facial Biometrics

Facial biometrics technology uses unique features of a person’s face to verify their identity. It’s a powerful tool that can be used in a variety of applications, from unlocking smartphones to verifying identities at border controls.

### Face Recognition

Face recognition technology works by comparing selected facial features from a given image with the photo ID for the onboarding use case or with the facial template stored for authentication, password reset, or access control use cases. It’s a fast and accurate way to verify the identity of users, making it an excellent tool for digital onboarding and multiple account opening. 

### Face Liveness Detection

Face liveness detection is a technology that can determine whether the source of a biometric sample is a live human being or a representation of a human being. This technology is crucial in preventing fraudsters from using photos, videos, or masks to impersonate legitimate users.

![](https://images.ctfassets.net/23aumh6u8s0i/72e8GkU7K8cuSoxC8JrleF/c3d57801015e621f725020f2db951b8e/Biometric_3.jpg)

## How Facial Biometrics Enhance Businesses Processes

Facial biometrics can significantly enhance several aspects of digital security and user experience. Let’s delve into how this technology can improve authentication, bot prevention, account recovery, and password reset processes.

### Digital Onboarding

Digital onboarding is the process of integrating new users into a system. It’s a critical process for businesses, as it’s often the user’s first interaction with the company. Facial biometrics can streamline this process by quickly and accurately verifying the identity of the user.

For example, a bank can use facial biometrics to verify the identity of a new user opening an account. The user simply takes a selfie, which is then compared to a photo ID they provided. The process is quick, easy, and secure, providing a positive experience for the user while ensuring the bank is complying with KYC (Know Your Customer) regulations.

### Authentication

Facial biometrics provide a secure and user-friendly method for user authentication. Instead of remembering complex passwords, users can simply use their faces as a form of identity verification. This not only enhances security but also improves the user experience by offering a quick and convenient authentication method.

### Bot Prevention

Bots pose a significant threat to digital security. They can carry out a variety of malicious activities, from spamming to automated attacks. Facial biometrics, particularly face liveness detection, can help prevent bots by ensuring that a real, live person is behind each action.

### Account Recovery

Account recovery can be a complex process. Traditional methods often involve answering security questions or receiving a code via email or SMS. With facial biometrics, users can recover their accounts by simply verifying their identity with their face. This makes the account recovery process more secure and user-friendly.

### Password Reset

Resetting passwords can be a hassle for users. However, with facial biometrics, this process can be simplified. Users can verify their identity using their faces and then set a new password. This not only streamlines the password reset process but also adds an extra layer of security.

![](https://images.ctfassets.net/23aumh6u8s0i/1PBtpzTeahMOcqlpm1MoL3/09f0029a9c41c405493f0549b51a7397/Biometric_2.jpg)

## Adding Security to Business Processes

In addition to streamlining digital processes, facial biometrics can also add an extra layer of security. By verifying the identity of users at key points, businesses can prevent AI bots or fraudsters from gaining access to sensitive information or systems.

For instance, a business could use facial biometrics to verify the identity of users before they make a transaction. This could prevent a fraudster who has gained access to a user’s account from making unauthorized transactions.

## Conclusion

Facial biometrics offer a powerful tool for businesses undergoing digital transformation. By streamlining the digital processes and enhancing security, this technology can provide a competitive edge while protecting against AI bots and fraudsters. As with any technology, it’s important to implement it in a way that respects user privacy and security. With these considerations in mind, facial biometrics can play a key role in the digital transformation journey. If you want to try biometrics, please visit [Alice Biometrics](https://marketplace.auth0.com/partners/alice-biometrics) profile at Auth0 marketplace to learn more.

Facial Biometrics: The Key to Digital Transformation and Enhanced Security

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Join us at KubeCon + CloudNativeCon Europe on April 17th, 2023, for the official launch of OpenFGA v1.0

We’ve been talking to hundreds of developers who consistently tell us that they want to change how authorization is implemented in their applications. Authorization logic is embedded in the code and implemented differently in each service. It’s not flexible enough to define complex policies or finer-grained authorization. They struggle with load at scale. The existing RBAC/ABAC solutions can’t handle this complexity. That’s why we built OpenFGA.

We are thrilled to announce the release of [OpenFGA](https://openfga.dev) v1.0, a modern, flexible authorization system inspired by [Google's Zanzibar](https://zanzibar.academy). OpenFGA, designed for reliability and low latency at scale, has been embraced by the developer community since its open-sourcing in June 2022. As a Cloud Native Computing Foundation (CNCF) Sandbox Project, OpenFGA is having a significant impact in the world of authorization.

## OpenFGA v1.0: A Host of Enhancements

OpenFGA v1.0 brings a wealth of improvements since it was open sourced, raising the bar for authorization systems and providing developers with the tools they need to create secure, scalable applications. Here's a rundown of the new features:

1. Enhanced Authorization Model Language: OpenFGA v1.0 offers a [significantly improved](https://openfga.dev/docs/modeling/migrating/migrating-schema-1-1) language for defining authorization models, making them easier to read and author.
2. ListObjects API: This [new API](https://openfga.dev/docs/interacting/relationship-queries#listobjects) lets you retrieve all resources that a user can access based on the defined authorization policies, greatly simplifying auditing and access controls.
3. Elevated Observability: OpenFGA v1.0 takes [observability to new heights](https://openfga.dev/docs/getting-started/setup-openfga/docker#telemetry) with Open Telemetry tracing, Prometheus metrics, and prof profiles, providing insights into your authorization system's performance.
4. Effortless Deployment: Deploying OpenFGA to Kubernetes has never been easier, thanks to [official Helm chart](https://artifacthub.io/packages/helm/openfga/openfga) support. Get your Kubernetes cluster provisioned with just one command.
5. Postgres Storage Adapter Performance Boost: OpenFGA v1.0's Postgres storage adapter is supercharged, ensuring rapid performance and seamless scalability.
6. New Python SDK: A brand-new [Python SDK](https://pypi.org/project/openfga-sdk/) makes it even more convenient for Python developers to integrate OpenFGA into their projects.
7. Batching support in SDKs: OpenFGA v1.0's enhanced SDKs support batching queries, providing greater efficiency when making authorization requests, available for [JavaScript](https://github.com/openfga/js-sdk#batch-check) and [.NET](https://github.com/openfga/dotnet-sdk), [Go](https://github.com/openfga/go-sdk) coming pretty soon!

## Experience OpenFGA v1.0 at KubeCon + CloudNativeCon Europe, April 17, 2023

Mark your calendars and join us at KubeCon + CloudNativeCon Europe for the official launch of OpenFGA v1.0. Be among the first to discover the future of authorization systems and learn how OpenFGA can transform your cloud deployments and bolster your application security.

You’ll be able to connect with the OpenFGA team in different ways:

* Find us at Kiosk #27 in the Project Pavilion in the afternoons.
* Join the [OpenFGA project meeting](https://kccnceu2023.sched.com/event/1JWSb) on April 18, 9:30 AM CST in Room D406, Congress Center
* Participate in the Cloud Native Authorization Birds of a Feather meeting on April 21st from 11 AM - 12:30 PM CST. You can register [here](https://kccnceu2023.sched.com/event/1KW9e).

## Join us!

An open-source project is only as good as its community, so we are extending a warm welcome to everyone who wants to get involved. 

The project already has more than 30 contributors from multiple companies, and it’s being deployed in production by many of them.

The community has contributed a [MySQL Storage Adapter](https://github.com/openfga/openfga/pull/210), SDKs for [ASP.NET Core](https://github.com/Hawxy/Fga.Net), [Elixir](https://github.com/msutkowski/fga-elixir-sdk),  [Kotlin](https://github.com/Ozee-io/fga-kotlin-sdk) and integrations with [Quarkus](https://github.com/quarkiverse/quarkus-zanzibar), [Open Policy Agent](https://github.com/thomasdarimont/custom-opa-openfga), [Keycloak](https://github.com/embesozzi/keycloak-openfga-workshop), [Kratos](https://github.com/tx7do/kratos-authz) and [SCIM](https://github.com/SUSE-Skyscraper/openfga-scim-bridge).

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our [monthly meetings](https://github.com/openfga/community/blob/main/community-meetings.md), or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project.

Find out more by checking out the Github repository [https://github.com/openfga/openfga](https://github.com/openfga/openfga), and learn how to use it in our [documentation](http://openfga.dev). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).


Announcing OpenFGA v1.0: A New Milestone in Cloud Native Authorization Systems

Todd McKinnon

Todd McKinnon is the CEO and co-founder of Okta, the leading provider of enterprise identity, which he co-founded in 2009 with Frederic Kerrest. Under Todd’s leadership, Okta has transformed the way millions of people access technology and put identity at the forefront of security.

Todd’s experience as a leader and technology visionary spans more than 25 years, with deep roots in enterprise software and cloud transformation. Prior to Okta, he led engineering at Salesforce.com, where he grew the team from 15 people to more than 250, and the service from two million daily transactions to more than 150 million. Todd started his career at PeopleSoft, where he held a number of engineering and leadership roles throughout his 8-year tenure.

Todd earned his bachelor’s degree in management and information systems from Brigham Young University and his master’s in computer science from Cal Poly San Luis Obispo. A Bay Area native, Todd is an advisor to Family House and an advocate for equality and inclusion. He is a husband and father, an exercise addict, and a mountain bike enthusiast.

Okta CEO and co-founder

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

Today marks one year since Okta and Auth0 officially teamed up to lead together in the customer identity and access management (CIAM) market.

Today marks one year since Okta and Auth0 officially [teamed up](https://www.okta.com/blog/2021/04/its-official-okta-joins-forces-with-auth0/) to lead together in the customer identity and access management (CIAM) market. While we’re still early in our journey, we couldn’t be happier with the momentum we’ve generated as a combined company over the last year. Here’s what we’ve learned so far and a look ahead at what’s next.

### Customers need Okta and Auth0

When we first announced the acquisition, the most-asked question we heard was, “which CIAM product are you keeping?” As we answered at [Showcase21](https://www.okta.com/resources/showcase21-content/), we’re keeping both — we partner with many customers who have unique requirements, and two solutions are better than one to meet these diverse customer needs. It’s one assertion coming from us, but industry analysts have likewise acknowledged Okta and Auth0 as leaders.

Gartner® named Okta and Okta (Auth0) as Leaders in their [2021 Magic Quadrant™ for Access Management](https://www.okta.com/resources/access-management-leader-gartner-magic-quadrant-2021/thankyou/). Together, we address a broad set of identity use cases for our customers in pursuit of the incredible $30B CIAM market opportunity.

Okta and Auth0 customers like [Larimer County, CO](https://www.okta.com/customers/larimer-county/) recognize our joint value. Larimer County partners with both Okta and Auth0 to bolster security and increase flexibility for its internal IT department and county residents. Our company values are each firmly rooted in customer success, and together, our identity platforms are robust and flexible enough to support the most innovative developers and the world’s largest organizations.


<script type="text/javascript" async src="https://play.vidyard.com/embed/v4.js"></script>


<img
style="width: 100%; margin: auto; display: block;"
class="vidyard-player-embed"
src="https://play.vidyard.com/NW12EDp5yHu7D4yxsXmfC8.jpg"
data-uuid="NW12EDp5yHu7D4yxsXmfC8"
data-v="4"
data-type="inline"
/>

<include src="QuoteCard" body="Okta and Auth0 coming together PB&J-style is an amazing thing for my developers, our IT staff as a whole, our county, and our residents." name="Gregg Turnbull" title="Director of Innovation and Insights" team="" company="Larimer County" />

### Our shared values and vision set the integration up for success

The success we’ve experienced together in the last year is due largely to our shared values — customer success being just one of them. Our joint commitment to innovation, transparency, integrity, and empowerment has allowed us to collaborate effectively and remain focused on our common vision to enable everyone to safely use any technology and establish identity as a primary cloud. On this strong, shared foundation, we’ve made considerable progress in bringing our teams, products, programs, and systems together.

Our employee ranks now exceed 5,000, and together, we support more than 15,000 customers. Although Auth0 remains a product unit within Okta, we’ve combined several functions to accelerate our ability to collaborate and innovate. Our integrated go-to-market team can support organizations across the globe with both customer and workforce identity.

We’ve united our cultures and rituals, coming together for our first joint [company kickoff event](https://www.linkedin.com/posts/activity-6900902245152509952-rv7p?utm_source=linkedin_share&utm_medium=member_desktop_web) in February and our first joint [Developer Day](https://www.okta.com/developer-day-2021-content) in August. We’ve stayed true to our weekly Company All Hands meetings and enjoy hosting a much larger and more global audience. We’ve combined and opened up our many offices so Okta and Auth0 employees can collaborate and build relationships worldwide. We are truly better together, and we continue to experience momentum across the Okta and Auth0 cultures and businesses.

Acquisitions require a ton of work — especially those taking place in fully remote environments! This reality has never been lost on us, and it’s why we’ve been thoughtful and intentional in leading the integration with our shared values and vision. We’ve made a ton of progress so far, but what excites us most is the future.

### Our path forward is bright

We are on a multi-year journey to build the most comprehensive, neutral identity platform in the market, become the standard for customer and workforce identity, and empower everyone to safely use any technology. We have already made great strides within this massive market – $80B TAM – but opportunity abounds ahead. The past year has reinforced one indisputable fact: identity is critical technology. As always, we’re squarely focused on empowering customers with identity, and we know we can go farther and faster together.

Thank you to employees, customers, and partners for making this an incredible first year. We’re still early in our joint journey, and we can’t wait to see what the next year brings.

Source: “Magic Quadrant for Access Management” by Henrique Texeira, [Abhyuday Data](https://www.gartner.com/analyst/85957) and Michael Kelley, Gartner, November 2021.

_Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose._

_Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved._

Raising the Bar on Identity: One Year of Okta + Auth0

Identity leaders combine developer and enterprise expertise, offering customers more flexibility

Okta, Inc, today (May 3, 2021) announced the successful completion of its acquisition of Auth0. Together, Okta and Auth0 address a broad set of digital identity use cases, providing secure access and enabling everyone to safely use any technology. 

Auth0 will operate as an independent business unit within Okta, led by Auth0 Chief Executive Officer and Co-Founder Eugenio Pace, reporting directly to Todd McKinnon, Chief Executive Officer and Co-Founder of Okta. Both Okta’s and Auth0’s platforms will be supported, invested in, and integrated over time — accelerating innovation and making the Okta Identity Cloud even more compelling for the full spectrum of customers and users. 

“Identity is one of the most strategic investments an organization will make today. A single, unified identity platform has the power to transform an organization by providing seamless and secure access for both customers and employees,” said McKinnon. “Okta and Auth0 have always shared a vision for the identity market. We’re also both cloud-first, customer-first companies. By joining forces, we’ll give our customers more choice and flexibility, driving tremendous value and enabling them to accelerate innovation. Together, we will shape the future of identity on the internet, empowering developers to build with identity at the foundation.”

"As Okta and Auth0 join forces today, bringing together two exceptional companies, I'm more confident than ever that we will deliver on our shared vision to secure access for everyone," said Pace. "Auth0's focus has always been on enabling product builders to innovate, and now as one company with a shared vision and combined resources, that innovation will only increase."

Okta’s and Auth0’s comprehensive, complementary, and flexible identity platforms solve every identity use case, regardless of the audience or user. Okta pioneered cloud-based identity, offering enterprise-grade reliability and world-class security while prioritizing customer success for organizations of all sizes. Auth0 was built by developers for developers. Application builders around the world are loyal to Auth0 for its extensibility, ease of use, scope of documentation, and developer-friendly experience. With combined expertise across developer communities and the enterprise, Okta and Auth0 will provide enhanced depth and breadth of identity solutions and will be even better suited to integrate quickly into the modern tech stack of today’s developers. 

“At Kiva, we’re on a mission to expand financial access to help underserved communities around the world thrive. Identity plays an essential role in making that happen," said Ken Leung, EVP of Engineering, Kiva. "Today, we leverage Auth0 to provide secure authentication to Kiva's partners and lenders, and Okta for workforce identity, giving our team access to the critical technologies they need to best serve the millions of global entrepreneurs in our network.  We trust both Okta and Auth0 to connect our people and technology, and are excited to see how they evolve and innovate together."

“Credence goes to those who can help us identify one another in a digital world,” said Jay Bretzmann, Program Director for Cybersecurity Products, IDC.  “Okta and Auth0 provide the cloud-ready, developer-friendly tools to help in the fight. They're building the platforms and technology we’ll need to take the next steps. Simple, elegant, and customer-centric." 

## Cautionary Language Concerning Forward-Looking Statements

This blog contains forward-looking statements relating to expectations, plans, and prospects including statements relating to the anticipated benefits that will be derived from this transaction, the expected acceleration of Okta’s growth as a result of this transaction, the impact to the Okta Identity Cloud, expected synergies resulting from the transaction and expansion of Okta’s customer base. These forward-looking statements are based upon the current expectations and beliefs of Okta’s management as of the date of this release and are subject to certain risks and uncertainties that could cause actual results to differ materially from those described in the forward-looking statements including, without limitation, the risk of adverse and unpredictable macro-economic conditions, the failure to achieve expected synergies and efficiencies of operations between Okta and Auth0, the ability of Okta and Auth0 to successfully integrate their respective businesses, the failure to timely develop and achieve market acceptance of the combined business, the loss of any Auth0 customers, the ability to coordinate strategy and resources between Okta and Auth0, and the ability of Okta and Auth0 to retain and motivate key employees of Auth0. Additional factors that could cause actual results to differ materially from these forward-looking statements are detailed from time to time in the reports Okta files with the Securities and Exchange Commission, including in Okta’s Annual Report on Form 10-K for the fiscal year ended January 31, 2021. All forward-looking statements in this press release are based on information available to Okta as of the date hereof, and Okta disclaims any obligation to update these forward-looking statements.

<include src="asides/AboutAuth0" />

Okta Completes Acquisition of Auth0

Recognizing the efforts of the Okta and Auth0 teams during 2021

As 2021 starts to draw to a close, we all find ourselves reflecting on the year. We’ve all been through a lot — both inside and outside of work — and I know how hard our employees have worked this year to provide the best possible product, innovations, and service for our customers.

So to say thanks for all their efforts — and to ensure everyone has the chance to spend time with family, go on an adventure, or just kick back on the couch with ice cream — both Okta and Auth0 teams will have the week of US Thanksgiving and the week following Christmas as a company holiday.

While these weeks are designated holidays, business continuity and reliability are our first priority. All support, customer success, engineering, and communications teams will rotate weeks away to ensure there is no disruption for our customers. We’ve also implemented an extended period of code freeze during the holiday season, with an elevated approval process for exceptions to limit any risk of service disruption. For all of the details on our ongoing resiliency efforts, [please visit here](https://auth0.com/blog/improving-our-platform-resiliency-and-upcoming-holiday-plans/).

Too often in our industry, we overvalue work and undervalue rest. We don’t work so we can rest. We rest so we can work — and grow and change, which lets us continue to provide our customers the best possible experiences.

We are committed to bringing our very best to you all in the coming year.

Thank you,

Eugenio Pace

We Are Thankful for Our Team

CEOs Todd McKinnon and Eugenio Pace highlight the exciting opportunities ahead for the combined company

Today, we’re bringing you Okta’s third [**Showcase**](https://www.okta.com/showcase/), joining forces virtually with teammates, customers, and partners from around the world for our annual fall event that provides an inside look at how the company is innovating. 

This year, it’s not just Okta taking the stage: it’s **Okta + Auth0**. Six months ago, we officially embarked on a mission to join our two companies and lead together in the customer identity and access management (CIAM) market with our shared worldview for a neutral, independent identity cloud. While we came from very different backgrounds, we both built our companies to innovate on identity from the ground up and prioritize customer success—so we connect on helping customers drive outcomes that matter most to them. Our cultures are strongly aligned with a strong focus on transparency and innovation, all with trust at the center. 

Since the acquisition closed in May, we’ve learned so much about our teams, companies, and technology. This partnership (eight years in the making!) has exceeded expectations beyond what we’ve imagined and has reinforced our commitment to continue investing in both platforms. We’ve invited both teams here today to share our joint story of growth, momentum, and strategy in the CIAM market. 

## The World Is Shifting to Identity-First

It has become clear that the role of identity in the world has evolved, and we’re here to address that shift. Together, Okta and Auth0 are reimagining identity’s role in every organization’s technology strategy. Cloud, mobile, and Bring Your Own Device (BYOD) have transformed the dynamics of the digital world over the past decade. At the same time, IT is struggling to keep up with all of these changes, and developers are more burdened than ever to build more applications quickly and without sacrificing security and user experience. Identity is the perimeter, and it’s at the heart of every technology choice and transformation. Governments globally are shifting to identity-first through initiatives like MFA mandates with Zero Trust security architecture. Customer experiences must be identity-first as companies rush to secure platforms and provide seamless, personalized experiences amidst a growing number of data breaches in the wake of the pandemic. 

This Showcase, we’re thrilled to introduce product innovation and joint momentum on the heels of the acquisition—all with the goal of helping organizations thrive in an identity-first world.

## Adopting an Identity-First Strategy with Okta + Auth0

The digital world is heterogeneous: we all work across multiple stacks, many clouds, and myriad applications. Digital experiences are connecting more companies, customers, and employees than ever before. Okta understands this need to connect. Through the [Okta Integration Network](https://www.okta.com/okta-integration-network/), we have the broadest and deepest set of independent and neutral integrations to securely connect to everything. And through our Workflows technology, we empower companies to weave the best employee and customer experience throughout those integrations and applications.

Okta Workflows is the key to simplifying and automating identity processes in an identity-first world at scale. We first introduced this technology to customers with democratization at the heart. Democratizing identity means providing everyone with the choice of tools and technology needed to harness it. Today we’re excited to announce **Workflows for Any Identity Use Case**, meaning our identity automation and orchestration solution is now available as a standalone product for all customers, including a no-cost option for up to five flows. We really mean anyone: anyone at any company, development or non-development teams alike, can now leverage the power and extensibility of identity in a low or no-code user interface. 

What’s more, we’re also introducing new connectors, including Jamf, Microsoft Teams, ITSM (FreshService), and alert management (OpsGenie), along with new templates such as app access requests with Slack. Okta Workflows helps customers solve highly complex use cases and now enables even more innovation to happen more securely and faster. 

We are also announcing the availability of the **Auth0 Identity Platform on Microsoft Azure**, offering customers the ability to choose Azure as a private cloud deployment option from Auth0. This addition provides customers with another secure cloud deployment option that better aligns with their technology stack and supports regional data residency needs, unlocking a comprehensive CIAM solution for organizations in regions where Azure has a larger infrastructure presence. Ultimately, more flexibility means more ways to deploy identity in the way that works best for each business. 

## Accelerating Momentum & Innovation in the CIAM Market

Every company connecting directly with customers must manage customer identities and the massive volumes of data and insight accompanying them. An identity-first, CX strategy is critical in a world where businesses feel increased urgency around digital transformation, security threats, and growing user experience demands.

As a joint Okta + Auth0 team, we can better meet the demands of a fast-growing CIAM market. When we look closely inside our customers’ technology environments, we see a wide range of situations—some are digital natives, others are building their first apps to connect with customers. While some live fully in the cloud, others choose a hybrid model, and some still manage massive legacy on-premises deployments. It’s within this diversity of technology environments that we see the biggest opportunity to make a difference.

To further our offerings in this space, we’re rolling out new CIAM capabilities across Okta’s CIAM offering, including **Device Authorization Grant, Branding**, and **Custom Administration Roles** to deliver universal customization from internal management and compliance to devices and customer-facing applications. These features address critical pain points across IT, security, and engineering when implementing identity and are rooted in choice and extensibility. Together, Okta and Auth0 now enable end-to-end customer journeys and address every use case imaginable, driving better digital customer experiences. 

With our combined company, we have one vision for identity. We’re ready to create solutions for all, offering more opportunities for current and future customers. The world now is identity-first; it ensures our environments are kept safe and secure and that every digital experience fits each customer’s needs. We’re just at the beginning of our journey together—we can’t wait to see what the future holds.

If you missed the live event, you can watch the [**on-demand content**](https://www.okta.com/showcase/) beginning on October 14.

<include src="asides/AboutAuth0" />

Okta + Auth0 Showcase 2021: Identity for All

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 integrates netID to support customer privacy needs in Europe

**London/Montabaur, Germany – August 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, and the [European netID Foundation](https://enid.foundation/en/) today announced the availability of netID Single Sign-On on [Auth0 Marketplace](https://marketplace.auth0.com/), a catalog of trusted technology integrations to extend the functionality of Auth0’s identity management platform. 

[netID](https://marketplace.auth0.com/integrations/netid-single-sign-on) enables users to sign into apps and websites with their netID account and to decide privately and transparently which data to share. As an independent European identity provider with more than 38 million active user accounts in Germany, netID provides the necessary infrastructure for [Single Sign-On (SSO)](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) but does not store any user data itself. Users can manage the consents they’ve given at any time in netID’s Privacy Center.

“Whether in finance, e-commerce, or online publishing, engaging with users in an all trusted and transparent way is key to driving success. We are excited about the partnership with Auth0 and the availability of the netID Single Sign-On integration. Joint customers can now seamlessly integrate our product and offer users a European alternative to U.S. social login providers,” says Achim Schlosser, board member, and chief technology officer of the European netID Foundation.

“After speaking with many customers, we have identified the integrations that matter to them. The availability of netID on [Auth0 Marketplace](https://marketplace.auth0.com/) is a direct response to the growing need for privacy-enhancing technologies in Europe and part of our continued commitment to international markets,” said Cassio Sampaio, SVP of Product at Auth0. “We are thrilled to have netID as a vetted and valuable vendor in Auth0 Marketplace.” 

Auth0 reviews partner integration functionality and makes available integrations that are easy to discover and integrate for customers. Partners can participate in the growing demand for digital identity solutions and increase their visibility as part of the Auth0 Marketplace and can learn more here: [https://auth0.com/partners](https://auth0.com/partners).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## About the European netID Foundation

The European netID Foundation was established in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1, and United Internet with its brands WEB.DE and GMX. With an independent market solution, the foundation supports Internet offerings from all industry sectors with the implementation of the new European data protection law and, for this purpose, has created the open login standard netID. The initiators of the foundation together reach around 50 million unique users every month and together have more than 38 million active accounts. The foundation is explicitly open to additional partners and initiatives. Further information is available at [www.enid.eu](https://enid.foundation).

<include src="asides/AboutAuth0" />

### Media Contacts
Alexandra Roszkowski<br />
[presse@enid.eu](mailto:presse@enid.eu) <br />
+49 162 25 27-188<br />

Sarah Konarski & Nele Mascher<br />
Finn Partners for Auth0, DACH<br />
[auth0de@finnpartners.com](mailto:auth0de@finnpartners.com)<br />

Auth0 Marketplace Now Offers netID Solution

Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

Auth0 is preparing new documentation for its customers with European users.

At Auth0, our continuing mission is to secure the world’s identities so innovators can innovate. The core to delivering this mission is trust, including Auth0’s commitment to security and privacy.  

Auth0 welcomes the new Standard Contractual Clauses (“new SCCs”) issued by the European Commission, and is happy to see that they reflect a broader set of transfer scenarios and the European Court of Justice’s (ECJ) decision in the Schrems II case last year. 

As required by the European Commission’s decision, Auth0 will begin using the new SCCs for new customers on or before September 27, 2021 (with a goal of late July / early August). Once we have a generally available version of a new Data Processing Addendum (DPA) that incorporates the new SCCs, we will also be able to make this available to existing customers.

Once we have had an opportunity to consider final guidance on the new SCCs to be provided by the European Data Protection Board, we will update this post to summarize the transition program, including issues such as:

* Whether we anticipate making changes to our form of Subscription Agreement
* What changes we will be making to our DPA (“new DPA”)
* How existing customers will be able to transition to the new DPA and new SCCs 

During this transition period, we will continue to adhere to existing contractual obligations set out in the existing Standard Contractual Clauses (“old SCCs”) that are available [here](https://auth0.com/legal).

Lucy McGrath
VP, Privacy, and Data Protection Officer
Auth0, Inc 

Auth0 Statement on New Standard Contractual Clauses issued by European Commission

Auth0 CEO’s on being the change we want to see when it comes to racial injustice

On May 25, 2020, George Floyd, a Black man, father, son, brother, and friend, was murdered by someone whose job it is to protect us: a police officer, who in broad daylight and the presence of many others calling for him to stop, knelt on Floyd’s neck until he breathed his last breath.

And we witnessed this almost in real time. The entire world saw it. We knew this was not an outlier event. It was not a rare exception in our society, but another in a long string of violent acts against our own people—a shameful, entrenched, recurring racism that leads to violence and police brutality disproportionately directed towards the Black community. This community has endured this injustice for too long. Far too long.

In the months since Floyd’s death, many of us around the world have stood up in a renewed, heightened protest against hundreds of years of systemic racism—demanding justice and real change. Yet, despite the worldwide focus and all the video evidence and witnesses of Floyd’s murder, history taught us we could not be confident in a conviction or justice.

Yesterday, the police officer was found guilty on all three counts against him, including murder. 

With this verdict, we exhale and find some relief, some peace in knowing the right thing happened. With this verdict, we also remember Emmett Till. Rodney King. Sandra Bland. Daunte Wright and **_thousands_** of others who have endured, suffered, and were victims of injustices and violence like this. Far too many.

And for this reason, this verdict also adds fuel to our commitment to getting real justice and lasting change. We feel new energy and optimism that racism will truly be a thing that we can shed forever. Because no one is born a racist. We learn to become one. 

I also hope this is a sign of hope for the Black community, that the U.S. understands the burden you carry, often silently and without hope for justice. 

We know today’s victory has power and meaning for all people who face discrimination, prejudice, and hate. To quote Chris Stewart, one of the Floyd family’s attorneys, _“The whole world should not have to rally to get justice for one man. But that’s what happened. This wasn’t a city case. This wasn’t one family’s case. This was the entire world’s case. And justice finally came... But it shouldn’t be this hard... And that’s the change we all want.”_ 

So, for all who are discriminated against and for us all, I recommit to being the change I want to see, speaking up when I could be silent, and taking action. Although today is only one step, we see that our protests, demands, and actions matter.

Silence and inaction make you an accomplice. Don’t be one.

Rest in power, George Floyd. 


Commitment to Real and Lasting Change

Auth0’s CEO on his commitment to #StopAsianHate

I signed a pledge to **[Stand with Asian Americans](https://standwithasianamericans.com/)**. In doing so, I join more than 7,000 business leaders and executives who are dedicated to fighting for change and supporting the Asian community—a community that has tragically experienced an unacceptable increase in hate, harassment, and violence in the past year. 

I believe that words matter and that actions matter even more. We are what we do. Vitriolic language labeling the global pandemic as the “China virus” or “Kung flu” has triggered and emboldened those who subscribe to hateful thinking and reinforced the systemic racism that we witness far too often with underrepresented groups.

Racism has been a shameful part of history, but the past year, in particular, has made it abundantly clear how much it is part of our present. As an immigrant who came to the U.S. from Argentina nearly 20 years ago, it pains me that the country I love and call home has such division and hatred. Even while writing this, the tragedy of Daunte Wright leaves me speechless, and once again, underscores the systemic racism that is so profoundly entrenched.

But I have hope. I believe that there is still plenty of good, that people desire change, and strive for a more equitable and kind society now and for generations to come. In order for this to become a reality, we all must take part in affecting change, even if small, because silence and indifference make you complicit. At a minimum, do the work to learn, share knowledge with those in your life, and take action.

Inclusivity is something I am passionate about. It has been a tenet of Auth0’s since our inception in 2013 and is the foundation for our [social impact organization](https://auth0.com/social-impact). Whether it’s inclusivity for technology access or for marginalized groups within any institution, we as company leaders have a responsibility to offer inclusive access to our products and services, inclusive workplaces, as well as a responsibility to demand fair and equitable treatment of our employees inside and outside the office. 

It’s much easier said than done, but we have to start somewhere, and there is great power in numbers. Thousands have signed the pledge thus far, and that alone signals commitment. I signed the pledge not only because I wholeheartedly stand with the Asian community but also because it represents a commitment to clear and meaningful action. We are taking action, too: 

* **Financial commitment: **The leaders who started this pledge committed to donating $10M in the next year to Asian support groups. We will also continue to promote and match all contributions our employees make to community-based organizations fighting anti-Asian hate through our online giving platform. 
* **Support and awareness:** Communication, community, and awareness are critical for enacting change. One of the ways we support our Asian employees is with an Employee Resource Group (ERG) that provides a safe forum for open communication, connection, and support. It is one of many ERGs at Auth0 that I’m proud to say are mainly employee-driven and maintained. 
* **Volunteer: **We know there is also power in giving our time, energy, and gifts to causes we care about. As such, we encourage our employees to volunteer in their local communities or with specific organizations that can be found through our online giving platform. 
* **Representation**: Being Asian is representative of a broad and diverse group of peoples, nations, and cultures. We believe all should be represented across all levels at Auth0. We are in the process of identifying ways to responsibly collect and manage data necessary for diversity reporting.

As CEO and as an individual, I bear the responsibility to formally join this commitment and encourage my fellow employees, industry associates, and leaders to do the same. It is every human’s right to feel safe and free. We know there is much to do, and we will never stop working to make Auth0 and this world better for all marginalized people. 

Silence makes you complicit. Speak up and take action. 

<include src="TweetQuote" quoteText="Silence makes you complicit. Speak up and take action." />

For more information on the pledge and to sign, please go to **[Stand with Asian Americans](https://standwithasianamericans.com/)**. The donations from this pledge will support these worthy organizations: 

* [StopAAPIHate](https://stopaapihate.org/) allows victims to report and document hate incidents, which is critical because hate crimes against Asians have historically been underreported.
* [AAPI Women Lead](https://www.imreadymovement.org/) and [NAPAWF](https://www.napawf.org/) recognize that the fight for Asian American justice is intersectional, and therefore protect and support Asian American women.
* [Asian Americans Advancing Justice](https://advancingjustice.org/), a national network with a presence in Atlanta, defends those impacted by hate crimes and ensures that they have proper legal representation. Their work empowers Asian Americans and creates a more just America for all.
* [Association for Asian American Studies](https://aaastudies.org/) conducts research and education on the causes and solutions to Asian racism.

I Stand with All Asians

Series F funding and what it means for Auth0



Auth0 announced a [Series F round](https://auth0.com/blog/auth0-announces-120m-seriesf-funding) of funding today. This is our sixth capital raise (seventh if you count our seed round) and I am filled with as much gratitude with this round as when we secured our first $50,000 from our first angel investor six years ago. The past few weeks have given me pause to reflect, not only on the appreciation I feel for our investors, but also on the sea of change I have witnessed in the first half of the year. 

We are in a very unique moment in our world’s history, and 2020 has begun to experience change that may have taken decades to occur otherwise, socially, systemically, and technologically. But meaningful change is never easy, and history has shown that momentous steps like these oftentimes result in difficult transitions.

COVID-19 has forced companies and societies into transition, whether they were ready or not, making them reinvent themselves in ways they didn’t previously think were possible. Retail stores, for example, have had to envision a future where physical spaces may no longer exist, or might have a different role. They have to reconcile the fact that maybe their ‘new normal’ means interacting with customers via a screen online more often than across a cash register in-store. And while they have spent decades perfecting how to protect a store with security cameras, locks, and guards, they now need to secure the online world. And securing the digital world can be exponentially more complex.

Not only is change difficult, but it naturally induces fear. There is fear of the unknown, and these evolving times are forcing the transitions at a speed where not everyone is comfortable. 

I am proud that Auth0 serves as a key enabler in these transitions. We not only help companies in every industry keep pace with inevitable change, but allay their concerns and serve as an innovative, adaptable, and trustworthy technology partner along the way. Transformational growing pains hit every industry and use case, whether it’s a consumer brand, a financial institution, a B2B software company, or any other market. The shift from old to new has many twists and turns, but the reality is that the old paradigm isn’t working anymore—whether it’s mandating that employees work in a physical office, or by using antiquated, legacy applications that don’t have the capability to keep up with today’s digital demands.

<include src="TweetQuote" quoteText="Luck is “opportunity meeting preparedness” and we are ready."/>


Security breaches are a daily occurrence, [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) is rising exponentially, and identity management plays more of an important role than ever before. Every business wants to secure their digital applications, keep their customers safe, and offer a frictionless experience, but don’t know how to do it. Because of that, there is a massive digital shift that is happening.

We are excited to be a key part of this change, and this is where we see considerable opportunity. In a way, we feel fortunate that the world situation seems to have accelerated the need for our service: digital transformation and security. But luck is “opportunity meeting preparedness” and we are ready. 

The capital from this round and the confidence that our investors have in us not only reinforce the immense business need we are solving, but also empower us to be bolder and take more risks. We will use these funds to fuel transformation in the world, explore new regions, new markets, and tap into industries that have now been unlocked by this sea of transformation. Our mission is to secure the world’s identities so innovators can innovate, and we are so proud to serve as the technology that enables teams to do that. 

We are indebted to all of our investors for supporting this vision and providing us with the capital to make big bets. Salesforce Ventures making a bet on us is a huge reinforcement that what we’re doing matters. Salesforce has been a trailblazer in SaaS, and exuded confidence in the cloud as a business enabler when few others did. Being supported by a company that has been on the bleeding edge of new paradigms is a humbling endorsement.

But of course, great responsibility comes with what we do. We want to provide secure access for everyone. We work with thousands of customers worldwide, and our customers’ end users amount to **tens of millions** of people who indirectly rely on us to be wholly secure and reliable. This dependence is an enormous responsibility and honor that I feel every day. 

There is a lot of uncertainty in the world right now. But I have so much hope that we are on a path towards a better future, and that after the tumult, we will emerge stronger than before. Hope is what this country is built upon, and as an immigrant who came to the U.S. from Argentina 16 years ago, hope was my driving force then and continues to be now. 

I want to thank our investors for supporting Auth0, thank our customers and partners for trusting Auth0, and thank the entire Auth0 team for believing in what we do on a daily basis. 

Here’s to the next exciting phase of our company’s growth and to Auth0 being a change agent for the future. 


---


Auth0 Helping Navigate through Times of Transformation

Okta and Auth0 address a broad set of identity use cases and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet



Okta, Inc. (NASDAQ:Okta) announced on 3/3/2021 that it has entered into a definitive agreement to acquire Auth0 in a stock transaction valued at approximately $6.5 billion. Together, Okta and Auth0 address a broad set of identity use cases, and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet. 

Auth0 will operate as an independent unit inside of Okta, and both platforms will be supported and invested in. As a result, organizations will have a wider breadth of identity solutions to fit their unique needs. Okta and Auth0’s comprehensive, complementary identity platforms are robust enough to serve the world’s largest organizations and flexible enough to address every identity use case, regardless of the audience or user.  

“Combining Auth0’s developer-centric identity platform with the Okta Identity Cloud will drive tremendous value to both current and future customers,” said Todd McKinnon, Chief Executive Officer, and co-founder, Okta. “In an increasingly digital world, identity is the unifying means by which we use technology — both at work and in our personal lives. With so much at stake for businesses today, it’s critical that we deliver trusted customer-facing identity solutions. Okta’s and Auth0’s shared vision for the identity market, rooted in customer success, will accelerate our innovation, opening up new ways for our customers to leverage identity to meet their business needs.”

“I started my career as a developer,” McKinnon added. “Over the years, I’ve seen developers become more important than ever. They are the ones building every experience on the internet. Auth0’s DNA is rooted in developers, and I’ve always admired their sharp focus and leadership in developer-led identity.”

With continued global market tailwinds of cloud and hybrid IT, digital transformation, and zero-trust security, an identity platform has become one of the most critical technology investments an organization will make. These trends have accelerated over the past year as companies of all sizes and across every industry had to pivot quickly to deliver engaging customer experiences online. Organizations everywhere are rapidly leveraging identity to streamline processes, reduce costs, maintain the highest levels of security, and improve customer experiences to drive business growth. Okta and Auth0 are both committed to delivering innovation and value to organizations navigating those transformations. 

“Okta and Auth0 have an incredible opportunity to build the identity platform of the future,” said Eugenio Pace, Chief Executive Officer, and co-founder, Auth0. “We founded Auth0 to enable product builders to innovate with a secure, easy-to-use, and extensible customer identity platform. Together, we can offer our customers workforce and customer identity solutions with exceptional speed, simplicity, security, reliability, and scalability. By joining forces, we will accelerate our customers’ innovation and ability to meet the needs and demands of consumers, businesses, and employees everywhere.”

Learn more about this announcement: [https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/](https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/)


Okta Signs Definitive Agreement to Acquire Auth0

Auth0’s CEO on renewal and being prepared to take on a new year



_A gem cannot be polished without friction, nor a man perfected without trials._ - Seneca

There is no denying that 2020 presented a seemingly endless barrage of challenges that were fraught with frustration, stress, and hardship for so many. While adapting to the “new normal” (definitely one of the most widely-used phrases of the year), many of us at Auth0 were flanked by homeschooling kids, caring for family members, and/or just trying to adhere to the rigors of quarantined life. And very sadly, some faced untimely and terrible losses. 
 
This constant friction, while incredibly stressful, presented us with many opportunities to learn and grow. No one was fully prepared for what 2020 threw at us, but the obstacles we had to overcome made us stronger as individuals, managers, and as a company. Our society also learned, arguably the hard way, about new possibilities and new opportunities.
 
I am so proud of how we adapted and supported each other, how we supported our customers through their own struggles and ambitions, whether they were ready or not, and our dedication to making a larger, longer-term impact. I have tremendous hope for the year ahead and beyond and would be remiss in not recognizing key milestones from 2020, which are instrumental in how we approach this new year. 
 
### Auth0 Grew in Many Ways

Despite the economic climate of 2020, we are very grateful for our continued growth, which really underscores identity management as a critical technology for digital transformation initiatives. We anticipate these transformation efforts will continue to accelerate in 2021, and thanks to the support of our investors with a [$120M round of funding](https://auth0.com/blog/auth0-announces-120m-seriesf-funding/), we are even more poised to support all current and future customers around the world. 
 
Of course, this growth would not have been possible without the tireless work of the entire 800+ person Auth0 team, 213 of whom joined us in 2020. It is the dedication and commitment to excellence of every single employee that will help propel the company even further this year.  
 
In 2021, we will continue to focus on growing our business in existing markets and expanding our presence in new markets. We will continue to be a resource for millions of developers worldwide who have supported us throughout the years, welcome all new developers, and educate the industry on how our identity management solution is different and ready for tomorrow’s requirements.
 
### Auth0 Supported its Team

Speaking of employees, our “**One Team. One Score**” and “**Give a Shit**” company values could not have been more apparent than in 2020. We were lucky to have been 60% remote prior to the pandemic, which made it much easier to transition to a fully 100% remote workforce. Beyond that, we supported each other in ways that make me proud to be CEO&mdash;whether simply covering for each other, offering more flexible working schedules, or designating the U.S. Thanksgiving week as a company holiday for rest and recovery. 
 
We rose to the challenge and acted as one team. We supported our leaders and employees through the stresses of balancing work and caregiving, and in place of the annual in-person offsite (a heralded Auth0 tradition), our incredible People team organized and managed a two-week long virtual extravaganza of collaboration, learning, external speakers, and fun experiences for the entire company. 
 
In 2021, we will continue to invest in every team member. We will give all employees the resources, flexibility, tools, and support needed to be successful at Auth0, so we can collectively serve our customers in the best ways possible. 
 
### Auth0 Supported its Customers

Auth0’s customers cover the globe and are representative of every industry, all reliant on Auth0 to improve the security and seamlessness of logging into their services. We sit at the front door to millions of consumer experiences every day and are grateful to be part of their digital journeys. A customer like [BioReference Laboratories](https://auth0.com/case-studies/bioreference/), in particular, used Auth0 to scale to accommodate a 25x increase of users who needed a secure and easy way to monitor their COVID-19 test results. This is significant for obvious reasons. This example, along with [customer success stories](https://auth0.com/customers/) from Jersey Mike’s, Siemens, Signify, Babylon Health, Toast, Blackboard, Dunelm, and THE ICONIC, is just a sampling of how diverse and far-reaching identity management is and the impact it makes in everyday life. 
 
We were also very excited to launch [Auth0 Marketplace](https://marketplace.auth0.com/) in 2020, a trusted partner integrations catalog that enables customers to extend our platform for multiple identity and access management needs. Auth0 Marketplace will be an integral hub for customers as their identity needs become more complex. 
 
In 2021, we will continue to work on being a highly trusted partner to our customers. We will welcome new customers of all sizes, from all industries. We will listen to our customers’ needs, continue to improve our platform functionality, be a valuable technology expert, and help provide our customers’ end-users with a secure and seamless digital experience. 
 
### Auth0 Gave Back

We have always prioritized giving back as a primary pillar of Auth0 but took it to another level in 2020 with the launch of [Auth0.org](https://auth0.com/social-impact), a social impact program committed to secure, inclusive access for all. We helped fund Auth0.org by joining the [Pledge 1%](https://pledge1percent.org/) initiative and committing to contribute 1% of the company’s equity over the next 10 years to help pursue philanthropic initiatives. Balancing [profit and purpose](https://www.forbes.com/sites/forbestechcouncil/people/eugeniopace/?sh=4fdad9284ef1) is something that I am especially passionate about. [Auth0 for Startups](https://auth0.com/startups) and [Tech for Black Founders](https://www.notion.so/TechforBlackFounders-ced8852e37514bcaac6a82bec9dc8087#56971fa0ea894a29bc47f67c6ec69fcf) are other programs we launched to pay it forward and use technology for good. 
 
In 2021, we will go deeper with Auth0.org and identify organizations that we want to partner with. We will continue to volunteer our time, resources and commit to being a force for positive change. 
 
### Auth0 Looks Ahead

While 2020 has officially ended, tomorrow we will wake up in the same world and encounter seemingly the same challenges. There will be no “back to normal” because “normal” evolves continuously, even without a global pandemic. 
 
But tomorrow, we will also wake up with the same super-power endowed to us. The super-power to adapt, learn, build, create, and improve everything around us. The super-power to turn ideas and thoughts that only exist in our imagination into action and reality. The power to change ourselves and our lenses on the world around us. We have the privilege of being front-row witnesses of this super-power in action every day as we build Auth0.
 
We have lofty goals for another successful year of high growth and will continue to focus on investing in our team, technology, operations, customer base, and global reach. (Stay tuned for more details on new office openings...) I have the highest level of confidence in my leadership team and staff and will continue to rely greatly on the counsel of Auth0’s amazing Board of Directors, into which we recently [welcomed three SaaS superstars](https://auth0.com/blog/auth0-adds-three-key-saas-leaders-to-its-board-of-directors/): Sue Barsamian, Sameer Dholakia, and Simon Parmett. 
 
For these opportunities, and for a promise of a new year that we can create for ourselves, I am grateful and renewed with the will to continue this journey, however challenging it might be. 
 
2020 presented us with relentless friction and was a year we had to work even harder for every milestone and achievement. But it is from these challenges that our greatest gems emerged, and I am looking forward to a brilliant year ahead.


A Reflection on Auth0’s 2020 and Hope for a Brilliant 2021

Why the 'solved problem' of customer identity access management continues to be unsolved



You see something you want on the internet, provided you have the funds, you click, and you buy. From the business side, you receive the data from the click and provide the goods or the service.

Whether you understand the underlying technology or are not, this can seem like a problem that's been solved for a long time, especially when you've had years of Amazon packages reaching your doorstep.

(Gentle spoiler: Part of the reason we created Auth0 was that we didn't see this as a "solved problem;" We saw a lot of potential for the experience to be improved, and we also saw a world becoming more complex and subject to threats.)

<include src="ebook-ads/EvolutionCiam" />

## From 'Nobody' to 'Target'

In the beginning, I think consumers tended to see the process of registering for a website or logging in as an annoyance rather than something that was front and center. "Of course, I need to log in, but who cares? I'm going to use my very original password.' And who's going to check that I'm using the same password for ordering tasty sandwiches, for ordering off eBay, and for my bank account. After all, nobody knows me." Most people in the world are not famous, and so they believed that anonymity would keep them safe because who would target an unknown person?

This clearly changed over time. Consumers suddenly started having problems remembering passwords, having their accounts hacked, dealing with getting locked out of an account, having multiple accounts for a website, or experiencing problems logging in. As our lives transition to all things being digital, and consequently, with more online accounts than ever, the problem got worse.

I believe we have proved that old problems have a nasty tendency to appear again. History will repeat itself, and in some cases, with new force. 

So [Customer Identity Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) was a solved problem that got unsolved again as our context evolved.

In fact, it was becoming worse every day because, in the process of creating strong customer experiences, organizations had been gathering and keeping a lot of data… and bad actors had realized that you didn't have to target a famous person to see a return on nefarious deeds &mdash; average people could be lucrative targets, too.

And as a lot of people &mdash; famous and average &mdash; turned to the internet for business, and for all things in life: education, healthcare, food, and entertainment, more value was out there to be stolen. This year has only accelerated this process.

![Future of CIAM 1](https://images.ctfassets.net/23aumh6u8s0i/4Qg4oGOVMcUz7islVLUnuO/dc72f7a985f919dc643de96fe4565c41/ciam-separator)
<br />

## Mix in Complexity

Another aspect of today's reality is that an average middle-class house is also becoming more complex with crisscrossed and interconnected systems.

Just pause and think about all the devices and software you likely interact with on a daily basis.

You wake up. Your watch might have been monitoring your body all night. If you're like me, you head out for a run. Your watch or other wearables keep track of your running stats, or if you were going to the gym, your phone knows you are going there, so it shows the fastest route. Then take a shower and jump on the scale, which is WiFi enabled and sends your weight to your phone. Then you likely check your email or Slack; or have an early Zoom with colleagues. Then maybe you log into your bank. Then your kids' school assignments. Maybe it's getting chilly, so you alter the temperature in your home from your phone and send some music to get your day going through your home speakers.

There's a whole myriad of systems that are part of my daily routine, and they are all different. They are also all built, designed, and marketed by different companies. According to Think with Google, [the average person has 35 apps on their phone](https://www.thinkwithgoogle.com/marketing-strategies/app-and-mobile/average-number-of-apps-on-smartphones/), plus apps that may be on other devices. 

And while they're all supplied by different vendors, they all have one thing in common:

They need to know who I am.

And who my family is. And what is the relationship between all the members? What is each person allowed to do (and not do, like rearrange my favorite playlist)? As well as those outside people and organizations that we deal with. 

It's pretty sensitive. 

The cameras in my home are watching my family, and my bank has my financial information. My health records, even my gym schedule &mdash; everything is pretty sensitive information.

The problem space has exploded in complexity. The old ways of solving these problems don't work anymore.

Even if you go with a password that is more complex than "_password_," we're dealing with literally tens or dozens or hundreds in some cases of applications that we need to interact with all the time. Now people are conscious that everybody is a target. That awareness of the situation is actually influencing the nature of the problem to be solved.

## The Case of the Flawed Candy Surprise

Thankfully, the mindset of consumers is changing. It's a funny story and a good example of how consumer behavior and expectations are changing (for good). This is what happened recently when I tried to surprise my mother.

My mom lives in Argentina. With travel restricted, I haven't been able to see her for a while, so I ordered a box of chocolates online and had them shipped to her home.

Remember, this is meant to be a surprise. A good one, but instead, it turned into a somewhat scary moment for her. When a random guy appears on her doorstep at 7 p.m. at night saying, "Ma'am, I have your chocolates.", she simply says, "No, I didn't order any chocolates. I'm not going to fall for that." Here we have someone involved in a relatively minor transaction rejecting it as suspicious. She knows she didn't order anything, it's kind of late, and I've never done that before. The context of all this raises some alarms.

Now it's pervasive. We are all on the watch. My mom rejected my chocolates and called me very proud, saying, "You know what happened to me? Somebody tried to trick me by pretending that I had ordered chocolates, and they wanted me to sign for them and show my identity card, so I rejected the package."

So now I have to do "multi-factor authentication" to send my mother a gift, "No, Mom," I say. "That was me. I was trying to send you a surprise. I'm going to send you another gift, and it will arrive on this day, and you can accept it."

I ended up sending another present. This particular use case also presents some interesting challenges from a user experience perspective, but that would probably require its own blog post. 

The bottom line is, like, it's very complex. It's not solved from a technical point-of-view or from a consumer end-user point-of-view.

## The Future Is Already Online

A recent Twilio survey found that COVID-19 has [accelerated organizations' digital transformation by an average of six years](https://www.twilio.com/hub/covid-19-myths-enterprise-digital-transformation-twilio-engagement-report). Some of our customers have said as many as seven or even 10. What does that mean for the average person?

The world that we're in has forced a lot of interactions in our lives to happen through a computer; whether the computer is an actual computer or a phone, it is irrelevant. And this has reached all levels of societies.

The digitalization of interactions has accelerated. Everybody &mdash; organizations and end-users &mdash; need to drive more and more with systems and software. And they all have one thing in common. It doesn't matter what they do &mdash; they need to know who you are to perform their function.

Are you a subscriber of this newspaper? Do you own this account in this bank? Do you have this Insurance policy? Are you a member of this club? A member of this gym? Are you a student from this class? Are you entitled to contribute to this particular campaign? Identity permeates everything. It has become a fundamental construct in all systems.

These completely unrelated systems all need to know who you are and then decide what you can do.

And businesses are now expected to not only keep pace with this change but remain ahead of it.

![Future of CIAM 2](https://images.ctfassets.net/23aumh6u8s0i/4zLAixTnRIBaqPFq55HI7A/efeedd42f5dfebd4876b10123fa3de99/ciam-separator)
<br />

## Immediate CIAM Challenges for Businesses

Because Auth0's been in identity for a while, I get asked a lot of questions about where the identity industry is going, in particular CIAM. It's really fun to think about things like intelligent agents having authorization to do things on your behalf and other topics, but faced with the rapid pandemic-induced shift online; I see a handful of immediate challenges for businesses.

* **Companies will have to continue to fine-tune security and user experience**. Shaping the customer experience often means exploring trade-offs between [security and user experience](https://auth0.com/blog/balancing-ux-and-security-at-auth0/). Finding that unique balance for a particular use case is part of why extensibility is such a large part of Auth0. But with the increase of Zoom classes and meetings, the number of bad actors coming for customer data has also increased. Given options, consumers will naturally migrate to the one who is more protective. 

* **Companies that know their customers best will succeed**. Understanding your customer is key to delivering experiences to keep them returning to your brand. With increasing data privacy laws, that means securing customer consent to share information. [PwC research](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) found that providing great experiences means access to more information &mdash; 63% of respondents said positive experiences made them more willing to share information. But not understanding your customers' expectations can have rapid negative effects. A third of those surveyed said a single bad experience would cause them to abandon a brand they love.

* **Only companies who don't make it hard to onboard or login, will be successful at retaining customers**. With COVID-19's acceleration of digital transformation, customers have accelerated expectations. As companies expand partnerships, they're drawing data from multiple sources and often asking customers to traverse multiple brands during their buying journey. Partnering with other businesses often means introducing [legacy challenges](https://auth0.com/blog/how-to-improve-customer-experience-in-your-mixed-environment/) at a time when it's increasingly important to get your product to market to deliver seamless experiences across brands and loyalty programs. Customers expect your solution to suit their needs &mdash; in real time.

* **Privacy will be paramount**. The ironic silver lining of data breaches is that they have raised awareness for the average person that their personal data is valuable and deserves to be protected. For organizations, this means starting to think of [data as a liability](https://auth0.com/blog/avoid-sinking-your-code-by-treating-data-as-a-liability/). But at the same time, customers expect organizations to recognize them and only pause their interactions during key moments &mdash; like when they need to make a payment or share sensitive health care information. There's a lot of complexity around how much data to gather, how long to store it, and when you might need to ask your customer to interrupt their experiences with additional verification. Data privacy laws, in effect, shift the power back to the consumer because breaches aren't just about accidentally letting someone into the database, but neglectful care of the consumer data and trust.


As Dave Limp, Amazon Senior Vice President, Devices & Services, said at the [2019 Geekwire Summit](https://www.geekwire.com/special-coverage/geekwire-summit-2019/), "Sometimes there are gray areas, and then you don't know how to write code." Figuring out the right mix of security, privacy, and convenience that provides the ideal experiences for your current and future customers isn't easy, but that's part of why we created Auth0.

## Code vs. No Code

Solution architects and developers are tasked with building things from scratch. The key is choosing the right building blocks. With very few exceptions, no one would build a database from scratch. Or re-invent a new communications protocol. And this is true for the vast majority of applications that businesses need &mdash;. The role of the application builders has become deciding what they are going to build on and what they will make themselves.

There isn't one out-of-the-box solution that will satisfy every legacy, security, privacy, convenience requirement that allows you to rapidly scale for the future. While many CIAM solutions are consolidating, there is a real risk that the solution only solves for the challenges the solution sees at the moment and not for a future when you might need to send your mother in Argentina a box of chocolates during the pandemic.

The power of Auth0 is that it provides developers with out-of-the-box power for the most common requirements **_and_** the building blocks of identity that allow them to build on the foundation of a [modern approach to application development](https://auth0.com/resources/whitepapers/state-app-assembly-2020). 

But application builders are a skilled bunch, and sometimes your marketing team wants to test rapid changes, like, for instance, altering the color of the login box to adjust to a brand change. These kinds of changes can easily be handled by the marketing team and allow you to save your developer for more complex problems, like solving for future needs. There will always be things that we think of as advanced features that every customer will come to expect.

But the very best CRM (customer relationship management) systems operate completely behind-the-scenes. And this is not to be underestimated. This kind of invisibility doesn't just happen naturally. It requires grace and skill on the part of an organizations' team as well as the identity vendor (ideally Auth0) they choose to help deliver that experience because the best identity experience for your customer is the one that pretends not to exist so that your customer doesn't have an annoying interaction with a login box but signs in directly to your brand.

<include src="asides/AboutAuth0" />


The Evolution of CIAM



_“Waste no more time arguing what a good man should be. Be One.” – Marcus Aurelius_ 

As a believer in [Stoic principles](https://www.forbes.com/sites/forbestechcouncil/2018/12/26/can-philosophy-influence-business-heres-what-the-stoics-have-taught-me/#486941151537), this quote from Marcus Aurelius, one of the most respected emperors in Roman history, really resonates with me. The stoics believed in action over words. And the first action is to stand up for your beliefs and values. 

When I moved to this country from Argentina nearly 17 years ago, I came with a strong belief in the institutions and the principles this country was founded upon. I believed that the United States’ core values of freedom, justice, courage, equality, and pursuit of dreams represented the most powerful forces for human advancement. I still do today and feel so fortunate to have been able to reap the gifts of these virtues and establish a life for myself, my family, and my company. 

I eventually became an American citizen because I was committed to these principles. And because I had great intent to be an active participant of our society and not just a spectator.

As an American, I care **deeply** about what happens to the place that now is my home. I want to see it improve, and I want to contribute to that improvement. As we approach perhaps one of the most important elections in history, I stand up for what I believe in as a man and as a lover of this great country.

In the last four years, our elected leaders have not lived up to the values that drew me here. They have **not** moved the country forward, nor have they unified the American people. Quite the opposite. Thankfully, our democracy is in place to allow for replacement and renewal. Four years is a very short time in the life of a nation, even though it has felt like a very long time in my personal life.

I have always held true to my core beliefs, but feel like they have been even more reinforced in recent years, which is why I choose to stand with those whose views are aligned with mine—like those expressed in [this post](https://www.k9ventures.com/blog/2020/10/15/i-believe/) by [Manu Kumar](https://twitter.com/manukumar), entrepreneur, friend, and one of the first investors in Auth0. His integrity, passion, dedication, compassion, and extraordinary human qualities are truly admirable.

Without being too redundant, I want to reiterate and emphasize what I believe so strongly in: 

* I believe in facts, science, and the truth. 
* I believe in global warming.
* I believe in universal healthcare. 
* I believe in equal rights and justice for all. 
* I believe women are still not afforded the same opportunities and that they have the right to choose what they do with their own bodies.
* I believe that [Black Lives Matter](https://auth0.com/blog/its-time-to-speak-up/) and that racism is still an unfortunate, sad, not fully resolved, and unacceptable issue. 
* I believe in a true democracy and local government.
* I believe in open markets, open networks, and an open internet. 
* I believe that [access to education](https://auth0.com/blog/announcing-auth0-s-social-impact-program-for-secure-inclusive-access/) is one of the most powerful methods to unleash human potential. And that education should be a right afforded to everyone.
* I believe that anyone aligned with the nation’s foundational values should be welcome.
* I believe in the deep power of human potential regardless of disabilities, mental or physical. I believe it is our responsibility to find ways to realize that potential and improve our communities.
* I believe that businesses’ success should be measured by their financial outcomes and their social responsibility actions simultaneously. And that businesses with outstanding economic success without social impact are not truly successful.
* I believe silence makes you complicit.
* I believe our country has risen to the occasion and has worked in unity when previously confronted with big challenges. And prevailed.
* I believe we can fix things. We can learn from mistakes, and that technology, a uniquely human capability, plays an important role. 

I believe that those in power should lead by example, be held accountable, and be used as a measure of what we all aspire to be. We need leaders who will work for an equal, inclusive, empathetic, humane society and do so with integrity and honesty. They will be human and imperfect, but they should strive to improve themselves towards the ideals that we set for ourselves&mdash;the ideas that resonate with us as American citizens.

Most importantly, I believe we all have a duty to actively participate. To voice our opinions and convictions. And perhaps the most powerful act of civic responsibility is voting. It’s a power and a right I will never take for granted. Nor should you. I believe that every individual has the ability to make a positive impact at a community, state, and national level. 

**I believe each of us can be part of the change we want to see.**

![I Believe](https://images.ctfassets.net/23aumh6u8s0i/6Qqlbn3qJt3VmjOpHmODZH/b71cef0a498e50d38e460c24df39c8e2/vote_elections_usa)


I Believe

The launch of Auth0.org and our ongoing commitment to philanthropy



Today is the starting point of a significant journey for Auth0. We are excited to announce the launch of [Auth0.org](https://auth0.org), our social impact program that is committed to secure, inclusive access for all. Extending our company mission of ‘Secure Access for Everyone’ (SAFE), Auth0.org is dedicated to various philanthropic efforts, including secure access to technology and equal access to education. 

When Matias Woloski and I started Auth0 in 2013, we had high hopes but could never have expected (and only wished for) the journey we have experienced thus far. Our team has grown to more than 700 employees, our customer and partner base has increased, and we continue to expand into new markets. The trajectory of our company often makes me reflect on all the amazing people and companies that have supported us along the way.

Now, we have the opportunity to make a significant impact on the global community. As a more mature company, we have a responsibility to leverage our product, resources, knowledge, and reach to support the amazing nonprofit organizations and social enterprises around the world that are using technology as a force for good. Technology is a powerful change agent—used for good and bad—and it is up to all of us to use these powerful tools in the most beneficial ways possible. We are launching Auth0.org with three main programs to achieve this: [Auth0 for Nonprofits](https://auth0.com/social-impact/nonprofits), the [Auth0 SAFE Fund](https://auth0.com/social-impact/fund), and [Auth0 Employee Giving](https://auth0.com/social-impact/employee-giving). 

Making a meaningful impact is at the heart of Auth0 and giving programs have been a part of our culture since our early days as a tiny startup. Auth0 Gives has been our internal program for giving back to the community with our donations, our time, and our commitment to doing good. We have also launched programs like [Startup Relief](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/) for qualifying companies most affected by COVID-19. A culmination of more than seven years in the making, and with a greater need accentuated by the pandemic and current social issues, we are extremely proud to expand the work that we have been doing with Auth0 Gives and launch Auth0.org. Auth0.org reflects our strong belief that inclusivity and broad access to knowledge and education are core tenets to prosperity and progress, unlocking human potential, and elevating the human experience. 

By leveraging the reach, support, and products of Auth0, Auth0.org will facilitate various philanthropic efforts that align with the program’s goal of connecting and improving the lives of people worldwide, regardless of location, race, gender, sexual orientation, disabilities, or religion. 

We are grateful for our launch partners [Pledge 1%](https://pledge1percent.org/) and [Tides Foundation](https://www.tides.org/) for their help in executing our mission and fulfilling our long-term commitment to affect positive change. We will pledge 1% of our equity towards social causes over the next 10 years and will lean on the counsel of Tides to identify the organizations that align with our mission and are in the greatest need. 

Now, more than ever is time to give back. I am personally invested in Auth0.org and am dedicated to supporting its depth and reach to help as many people as possible as the program grows. We invite anyone who is willing to collaborate, give feedback, or participate in any way to reach out to [info@auth0.org](mailto:info@auth0.org). We would love to hear from you. 

We look forward to joining forces with nonprofits and social enterprises around the world to make even more powerful change, together. 

Secure Access for Everyone.


Announcing Auth0’s Social Impact Program for Secure, Inclusive Access

T025590N6-U48JV4JQ3-c1e97676ac13-512 avatar

T025590N6-U48JV4JQ3-c1e97676ac13-512

General Counsel

Jeremy Freeland



## Schrems 2 Ruling 
The European Court of Justice (ECJ) ruled on July 16, 2020, that the EU-US Privacy Shield framework is no longer valid as a means of ensuring adequate protection for transfers of personal data from the European Union to the United States, on the basis that US national security requirements do not meet EU privacy standards.
 
Importantly, the ECJ also decided that the Standard Contract Contractual Clauses (SCCs) are a valid transfer mechanism.
 
The ECJ deferred to national EU data protection supervisory authorities to determine the lawfulness of transfers to countries such as the US where the ECJ has determined there is a conflict between national laws and EU data protection laws.
 
This post advises Auth0 customers who process EU personal data of the likely immediate effects of the Schrems 2 decision on their use of the Auth0 Platform.
  
## European Customer Data is Stored in the EU 
Unless a European customer has opted to establish its Auth0 tenant(s) in an AWS region outside the EU, the data of Auth0's European customers is stored on AWS infrastructure located in the AWS EU region (Germany, with failover to the Republic of Ireland). This means that this data is not transferred out of the EU – in other words, the Schrems 2 decision has no effect on this data, and customers will not need to make any changes. This applies both to Auth0's public cloud customers and private cloud customers.
 
As disclosed in our contracts with our customers, Auth0 conducts some limited processing of personal data outside the EU. This involves:

* _Management dashboard:_ For public cloud customers, Auth0 may temporarily process tenant data in the US for display on the Auth0 Management Dashboard. Dashboard web servers are located in the US. This data is not automatically transferred but is only served up when a tenant dashboard administrator requests it for viewing. When this occurs, the data itself is ephemeral, is not permanently stored on these systems, is fully encrypted during transit, and is only used to display information on the dashboard to the requesting administrator. This data can include any information that can be viewed through the Auth0 Management Dashboard, which typically includes the user's e-mail address or other UID and basic metadata about that user, such as creation date, last login time, user agent, and the identity provider used. Note that this dashboard processing occurs within the AWS region the customer has selected for its tenant for private cloud customers.
 
* _Support tickets and logs:_ If a customer includes personal data in a support ticket, then this may be viewed by Auth0 support personnel outside the EU. In order to resolve the ticket, Auth0 personnel may review activity logs to help understand the underlying error. Personal data in those logs typically consists of a user ID (e.g., e-mail) and IP addresses. 
 
## Auth0's DPA has Triggered the SCCs 
For transfers of personal data from the EU to the US, the SCCs will now apply.

Auth0's form of Data Processing Addendum (DPA) anticipates the invalidation of the EU-US Privacy Shield framework as a transfer mechanism. Under Section 6.1 of the Auth0 DPA, Auth0 and customers who are a party to the DPA have agreed that the SCCs will apply in these circumstances. Thus, although Privacy Shield has been invalidated, transfers by Auth0 of European customer personal data are now subject to the SCCs.

Although the DPA contemplates that no further action should be required for the SCCs to apply, we expect to post a pre-signed set of SCCs for customers to countersign early next week. Auth0 customers looking for additional assurance beyond the DPA may use this method to apply the SCCs to transfer their data.

## Next Steps
This is an evolving situation, and we will be monitoring developments closely. In particular, we expect the cloud service provider sector to consolidate on an approach to the invalidation of the EU-US Privacy Shield framework over the coming weeks. We expect national EU data protection supervisory authorities to begin to communicate their position on determining the lawfulness of transfers to countries such as the US, where the ECJ has determined there is a conflict between national laws and EU data protection laws.
 
We will update this blog to reflect key developments – please check in regularly.

<include src="asides/AboutAuth0" />


Schrems 2 – EU-US Privacy Shield Ruled Invalid

Standing in solidarity against racism and police violence against Black people.



Far too many incidents, including the recent murder of George Floyd, the tragedies of Ahmaud Arbery, Christian Cooper, Breonna Taylor, and many other injustices, continue to spotlight the deeply rooted racism, prejudice, and discrimination in our country. Watching in despair over what’s happening in this country – the country I have called home for the past 16 years – I simply can’t stay silent any longer. **We** cannot and should not stay silent.

These human beings, these tragedies, not only represent lives lost, but lives lost unnecessarily and without any justifiable cause. We could be angry, but just being angry is useless. We must come together and fight for justice and equality because it is the right thing to do.

## Racism is Wrong

We don’t need anyone to tell us that racism is wrong. No one is born a racist. We slowly become that way, whether it is intentional or not. But the harsh reality is that it exists. These horrible killings and racist actions serve as a sobering reminder of what millions live through every day in America and around the globe. It also calls to light the privilege that many of us experience each and every day. I reflect on my own privilege with these simple things that can easily be taken for granted: 

* I go for a run without any consideration that something bad might happen to me.
* I go to public parks without any worry that someone will call the police just because of how I look. 
* I don’t live in constant fear from those who are supposed to protect me (despite them bearing the power to inflict disproportionate harm).

I grew up in Argentina in the ’70s and ’80s, during one of the worst military dictatorships in the country’s history. And while I was also privileged then, fear was widespread in everything we did, however mundane. There was always a chance of being caught in the middle of violence, even if you were simply getting groceries or going to school. This occurred throughout my elementary school years. As a parent now, I can only imagine the anguish and fear my mother, father, and grandmother must have felt each time I left the house. But the fear of my childhood was real and founded. More than 30,000 people are estimated to have been murdered during those years, most of them were arrested and simply disappeared without a trace.

I vividly remember two phrases that were repeated during those years, known later as the “Dirty War”: _algo habran hecho_ (“they probably did something”) and _no te metas_ (“mind your own business”). The first phrase referred to the assumption that those arrested (killed and disappeared) were guilty of something, and therefore deserving of what happened to them. And the second was a call to keep your head down. An effective intimidation method.

Those phrases come to mind yet again when I see the horror of recent events. Civilized societies have written agreements on the consequences of committing crimes. One of which is that everyone, even a criminal, is equal in front of the law and deserves a fair process. Second, is that silence, not “speaking up”, makes us all guilty by omission. Silence makes you an accomplice.

It is time we speak up.

## We Can’t Accept This Reality

What is happening in this country is sad, unfair, below us, and crazy. It is just plain WRONG. We know it is wrong. 

It is unacceptable that a large percentage of our communities live in fear just because they are Black.
 
And, while the United States is a great country in many respects – and I am grateful and proud to be a citizen here – I find it disgraceful that the poison of racism still exists and is rampant. 

It is shameful to see the rest of the world looking at us, and wondering how a country that claims to stand up for democracy, the rule of law, and “out of many, one” could tolerate this. A country that on one hand provides so many incredible growth opportunities to people (like me), and on the other, oppresses and discriminates against large groups of others. It is shameful that in the age we live, the U.S. cannot shake this cruelty.

What makes it worse is that this cruelty is embedded in “good people,” like the woman walking her dog in NY threatening a Black man with ”I’ll call the police.”

It is made exponentially worse when some of the authorities to whom we delegate the power to protect us, are racist, bigots, equally cruel, and unfortunately taint and cast mistrust towards all the members of the organizations they belong to.

Any “good” law enforcement officer who doesn’t speak up against racism and bigotry and hate is complicit of the actions of “bad” ones. Their intentions might be good, their vocation for service might be genuine, but they will be guilty in the eyes of everyone else.

Law enforcement needs to be held to very high standards because we delegate to them an enormous amount of power to do harm. We empower them to terminate people’s lives. We give them that power with the assumption they will unleash that violence **only when absolutely needed**. Not freely at the whim of their emotions.

Ahmaud Arbery. Breonna Taylor. George Floyd. (And hundreds more). They were someone's child, parent, sibling, friend, co-worker… "they" are "us." Those of us with whatever privilege and power we have must make real change, and starting with our voices, stand up for those who don’t have a voice anymore to say, loud and clear:  

* Racism is wrong. 
* This must stop. 
* We want justice and equality. 
* No more fear. 
* Black lives matter.

I will use my voice and take action as a citizen to help in any way I can. And so will Auth0. Through Auth0 Gives, our philanthropic program, we pledge to commit time, money, and resources to reinforce our voices and play an active and ongoing role in seeing change happen. What will you do?

Here are some recommendations I’ve found in my research:

* Donate money to or volunteer with organizations like the [ACLU](https://www.aclu.org/press-releases/aclu-responds-minneapolis-police-killing-george-floyd), [NAACP](https://naacp.org/campaigns/we-are-done-dying/), [Color of Change](https://colorofchange.org/), [Black Lives Matter](https://blacklivesmatter.com/), [Minnesota Freedom Fund](https://minnesotafreedomfund.org/), and [Fair Fight](https://fairfight.com/). 
* Sign petitions by groups like Change.org or MoveOn. 
* Call your city council members and demand better oversight of the police department.
* Call the offices of progressive candidates to volunteer.
* Make sure you're **registered to vote** so you can elect candidates who share your beliefs about rooting out systemic racism.


It’s Time to Speak Up

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees


  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</strong></div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers.  

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
<br>
<br>
<span style="color:#EB5424;"><a href="https://auth0.com/pricing/">Find out more here about how to get started today</a></span>

<include src="asides/AboutAuth0" />


Auth0 Makes Workforce Authentication Free Through August 2020

We are offering free services to startups to help innovators tackle the challenges we are all facing



I know how difficult it is to start a business when the world is relatively calm, let alone the one we all find ourselves in now. Nothing is the same as it was. Between scrolling through rolling news channels and worrying about ourselves and loved ones, we are all looking for ways to help one another. For those companies trying to make progress during these times, I know how much harder it must be. 

We already offer a free tier of service to thousands of customers to help them innovate, but starting today, if you are a startup battling the impact of COVID-19 and meet our program criteria [1] , then you are eligible to get a **year of Auth0 Startup Relief for free**. From Single-Sign-On (SSO) to anomaly detection, we are making it easier to manage all of your users’ identities, however, they access your applications.

The “Auth0 Startup Relief” is designed for those who are doing any one of the following:

* Fighting the virus 
* Helping those who can’t work due to travel restrictions
* Enabling distance learning
* Helping small businesses who are struggling 

We want the best minds thinking about how to make things better, not worrying about authentication or authorization. And we are going to continue finding ways to make our technology available to those who need it most, as well as actively engaging with anyone who wants our help and advice during these times. [We also just announced free workforce authentication for businesses](https://auth0.com/blog/auth0-makes-workforce-authentication-free-through-august-2020/), through to August 31st, for up to 500 employees as well.

We at Auth0 hope this will further help these innovators fight COVID-19; we are rooting for you! 

## How It Works

1. Fill out your information [here](https://auth0.com/contact-us?utm_source=blog&utm_medium=oc&utm_campaign=businesspost&place=blog%20post&type=link&text=here) and don’t forget to include a mention in the message field that your startup is applying to the “Auth0 Startup Relief”
2. Our team will get back to you in less than 2 business days to confirm your eligibility and, assuming you meet the requirements, to help you start using Auth0 services for free for a year.

![Free Auth0 to help innovators fight COVID-19](https://images.ctfassets.net/23aumh6u8s0i/6n2zNChmRNytjOyp58cb0M/502f54c3101011828211819bcbda58d1/value-customer)

[1] In addition to meeting one of the Auth0 Startup Relief criteria, your company must meet these requirements as of the date of your application

* Less than $1M in Annual Recurring Revenue (ARR)
* Less than $2M in raised funding
* Less than 2 years old

<include src="asides/AboutAuth0" />


Auth0 Startup Relief: Helping Innovators Battle COVID-19


At Auth0, we care deeply about ensuring that our employees, customers, partners, and their families are safe. This does not change during times of uncertainty, it only becomes a stronger commitment. We also know that Auth0 provides critical functions for all of our global customers, and we hold our responsibility with the utmost business ethical importance.

In light of COVID-19, Auth0 is taking all necessary precautions to conduct and maintain business-as-usual during this tumultuous time. We are closely following guidelines set forth by national and local government agencies, and have internally put actions into place to ensure our employees limit their risk of exposure. 

Auth0 has maintained a Business Continuity Plan for many years that details steps for comprehensive action in the event of any emergency or crisis – including this pandemic. This plan is reviewed and updated regularly. This pre-planning enables us to be vigilant and focused no matter the circumstances, and provides concrete action to ensure the security of our business and customers. 

One of the biggest disruptions being felt at the moment across the world is the transition to remote working. Thankfully, Auth0 has been designed as a remote-centric company since our inception in 2013 (Matias Woloski and I were building the business while living 7,000 miles apart), and we have a robust and tested infrastructure in place to support a fully-remote workforce for all 650+ Auth0 employees, if need be. This ensures that every employee and team is able to operate at the same level of responsiveness and service that our customers are used to. 

Additionally, intentional cross-training of staff means that there will always be more than one person to handle key tasks or escalations without any disruption to our customers’ business. From an infrastructure perspective, all of our primary services are cloud-based and should not be impacted by COVID-19, ensuring that the same level of performance, innovation, customer support, and partnership will be maintained regardless of how long we are impacted by this virus.

Finally, we have prepared an [FAQ](https://info.auth0.com/coronavirus-customer-FAQ.html) that contains answers to a range of questions. If the answer to your question isn’t included, then please contact us directly at [bcp@auth0.com](mailto:bcp@auth0.com) and we will help find it. We are ready to tackle any challenge with our customers and will always put our extended team first. 

These are not easy times, but that’s why we prepare for them. We are deeply committed to taking care of our employees, customers, and partners, especially in times of uncertainty like these. 


Business Continuity at Auth0: Our Response to COVID-19

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Pace honored at Washington’s most acclaimed C-Suite executive leadership awards


**BELLEVUE, Wash. – January 30, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its CEO and Co-founder, Eugenio Pace, was honored at Seattle Business magazine’s [Executive Excellence Awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards), one of the Pacific Northwest’s most prestigious business leadership events, for his exceptional leadership practices and successes in the business community. 

[Pace](http://seattlebusinessmag.com/executive-profiles/2020-executive-excellence-awards-eugenio-pace-co-founder-chief-executive-officer), one of 16 award recipients – along with some of the state’s most respected business leaders from corporations and nonprofits including Zillow Group Inc., Rosetta Stone Inc., Textio, and Washington Women’s Foundation – was honored for his principled leadership practices, and commitment to his team and business community. 

“I am truly humbled to receive this prestigious award and be recognized alongside such a distinguished lineup of professionals, who I look up to for their exemplary leadership,” said Pace. “This award is truly the accomplishment of my entire team – a team that pushes me to be a better leader day in and day out, and never stops pushing boundaries to innovate and deliver only the best to our valued team, customers, and communities.” 

The eighth annual awards ceremony held on January 23, 2020, received nearly 100 applicants this year, a record-breaking year for entries. After a lengthy review process, only 16 individuals were selected by a judging panel based on which leaders have shown outstanding leadership in guiding their companies to success.

“Regardless of industry, successful executives share several traits,” said Seattle Business magazine Editor in Chief Rob Smith. “According to ghSMART's 10-year study of 17,000 C-suite executives, called the CEO Genome Project – featured in Harvard Business Review – top-level leaders excel at four behaviors: the ability to make quick decisions with conviction; achieving buy-in from employees and stakeholders; the ability to adjust to a rapidly changing environment; and producing results.”

The 2020 Executive Excellence Awards are featured in the magazine’s February print issue and online: [http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards).

## About the Executive Excellence Awards 

The Executive Excellence Awards is considered to be one of the Pacific Northwest’s most prestigious business leadership events of the year. Over the years, this awards program has hosted C-suite executives from companies and organizations such as Starbucks, Amazon, Alaska Airlines, Expedia, Seattle Seahawks, Seattle Symphony, Ste. Michelle Wine Estates, the Bill & Melinda Gates Foundation, and many more.

<include src="asides/AboutAuth0" />

### Media Contacts:
Kaycie East<br>
Auth0 Communications<br>
[press@auth0.com](mailto:press@auth0.com)
 
Alexandria Plew<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Eugenio Pace of Auth0 Honored for Executive Excellence by Seattle Business Magazine

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Leading media companies choose Auth0 to authenticate and monetise digital subscribers



LONDON  ** June 3, 2019 ** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced rapid customer growth in Northern Europe. In the last year alone, Auth0 has tripled its customer base in the region, signing on well-known enterprises Elsevier and Atea Norge; as well as prominent media leaders, such as TV 2 Danmark, broadcaster of the Danish "X-Factor" show; Danish Broadcasting Corporation; and Alma Media.

Northern Europe boasts the EU's [top five most advanced digital economies](https://ec.europa.eu/digital-single-market/en/desi), and the Nordic countries lead the world in [paying for online news](http://media.digitalnewsreport.org/wp-content/uploads/2018/06/digital-news-report-2018.pdf?x89475) through subscription, membership, donations, or per-article payments, according to Reuters. The digitisation of the media industry in the region has created an urgent need for identity management, as media companies seek to reduce friction for their users to sign up and access content, and turn free users into subscribers.

"What if an extra 10 percent of visitors to your app or online publication decided to spend money with you? Identity makes this possible, giving companies the tools to streamline their login, collect first-party data, and personalise experiences for their customers, which drive additional revenue opportunities," said Steven Rees-Pullman, GM of EMEA at Auth0. "Northern European companies understand this value, and turn to Auth0 for a modern identity platform and a roadmap for getting started."

Danish Broadcasting Corporation (DR), Denmark's largest media company and producer of a broad variety of Danish content, uses Auth0 to authenticate users of their various video, audio, and live voting apps. Auth0 supported both the implementation and assisted DR in mapping out an identity strategy for the near-and far-term.

For more on how Auth0 supports the media sector, including a case study with [Finland-based Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), please visit: <https://auth0.com/media-publishing/>.

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
(auth0@racepointglobal.com)[mailto:auth0@racepointglobal.com]<br/>
+44 (0) 77 1124 4113


Auth0 Expands European Presence with Customers in Benelux and the Nordics

The Economist honoured for Best Identity Platform Project



LONDON  **May 16, 2019** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that one of its valued customers, The Economist Group, has won the [2019 European Identity & Cloud Award](https://www.kuppingercole.com/events/eic2019/award) in the inaugural Best Identity Platform Project category.

![The Economist Group won the 2019 European Identity & Cloud Award](https://images.ctfassets.net/23aumh6u8s0i/2GU6aaiw4v1NhpTJlIfyhY/a9b0d379124eff5681c67b2a38fe9ede/the-economist-wins-2019-kuppingercole-european-identity-and-cloud-award_best-identity-platform-auth0-economist)

The prestigious award from global analyst firm, KuppingerCole Analysts AG recognises outstanding identity management and cloud computing projects. The Economist was selected by KuppingerCole analysts for their deployment of Auth0 to provide secure, one-click login across their online platforms, and better understand the relationship between their users and the publication.

Andrew Williams, Chief Digital Officer at The Economist said "It is an enormous honour to have been given this award. Identity management is a major step on our journey to ensure that our digital solutions match the excellence of our journalism, hence to have our achievements recognised in this way is a great validation that we are on the correct course."

The Economist have traditionally hand-crafted and built all their digital services themselves. Upon recognising the need to outsource identity management and focus on innovation, they choose Auth0. Using Auth0's Universal Identity Platform, The Economist supports up to two million active consumers, and will soon extend the same, seamless access to universities, corporations, and nonprofits that offer subscriptions to the publication as part of their benefits packages.

"The Economist took a leap of faith in asking Auth0 for help, at a time when media companies were under immense pressure to do things differently. That risk has paid off," said Steven Rees-Pullman, GM of EMEA at Auth0. "The Economist is not only surviving in the digital world, but has leapfrogged the competition. We are proud to support them in making the transition from print to digital easier for their readers worldwide and congratulate them on this honour."

Winners were celebrated at an award ceremony on Wednesday, May 15, 2019 during the European Identity & Cloud Conference (EIC) in Munich, Germany. See the full list of winners [here](https://www.kuppingercole.com/20190516_eic_awards_2019). 

## About The Economist Group

The Economist Group is built on high-quality, independent analysis which runs through all of its businesses. Based in London and serving a global readership and client base, the group publishes print and digital products, produces global events, and offers a range of subscription and other services for clients and readers. Its flagship businesses include The Economist newspaper, and research and analysis division The Economist Intelligence Unit.

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113

Lauren Hackett<br/>
The Economist Group<br/>
[laurenhackett@economist.com](mailto:laurenhackett@economist.com)<br/>


The Economist Wins 2019 KuppingerCole European Identity & Cloud Award

How Auth0 is striving to keep its soul while hiring for dramatic growth

Building Company Culture for Scale

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn about 3 tools to make the GDPR compliance process as efficient as possible.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR has arrived. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

The deadline to comply with GDPR has passed (5/25/18). As most know, if your business is audited and found to be irresponsible with its customer data, according to [GDPR regulations](https://www.gdpreu.org/compliance/fines-and-penalties/), fines are up to €20 million, or four percent of worldwide annual revenue. Moreover, GDPR does not just apply to EU companies; it extends to all those that process the data of EU residents.

The regulation is no joke. Activist groups, already outraged by how many companies have misused personal information, have [called out giants like Facebook and Google](https://www.cnet.com/news/gdpr-google-and-facebook-face-up-to-9-3-billion-in-fines-on-first-day-of-new-privacy-law/) for not creating tight enough protocol. If these titans, with cutting-edge resources at their fingertips, are struggling to adhere to the new law, how can small and medium-sized teams make sure their operations are efficient, secure, and worthy of their customers? 

Amid a variety of strategies to bring your company into compliance, specific tools can make this process less arduous and complicated by targeting several pain points at once. 

## Start With a Checklist

Before diving into tools to help you comply with specific parts of GDPR, it's important to keep the overall picture in mind.  
A team from Belgium created a handy [checklist](https://gdprchecklist.io/) that you can use as a guide throughout the process. It covers outlining the type of data your company holds, where, and why; the creation of a clear accountability and management policy for it, including your contracts with sub-processors; making the data clearly accessible to customers; new consent guidelines; and understanding what to do in special cases with high-risk data. 

For example, a breakdown of the level of detail that the checklist goes into to make sure you account for each important part of the regulation is below in its first section, “Your Data.”

![Your Data](https://images.ctfassets.net/23aumh6u8s0i/4cy7PCaaHybQN3fDwhredV/a9a14208bb378a8ff6d2b88d2facd5d1/gdpr-yourdata)

The list is interactive, so you can check off each task once it's completed in the circle on the left. If you're looking for more information on a particular bullet, you can use the drop down arrows for a longer description and links to further resources.

## 1. Improve Your Data Collection with Social Login

[Social login](https://auth0.com/learn/social-login/) is a single sign-on for end users that relies on existing information from a social network provider like Facebook, Google, or LinkedIn. This not only makes the registration process smoother for the customer, reducing onboarding friction and keeping them coming back over time, but also adds an additional layer of security to the information they provide. 

A customer will see this screen when they log in to your app:

![Social login with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3I1mh7IrVMQlLTdjqD0sc9/260b1c263f685e4d684ab1e0d99791dc/what-is-social-login)

Whichever social provider you've selected for the app will appear as an option for the customer up top, often along with the chance to choose email sign-in.

On the back end with [Auth0's social login feature](https://auth0.com/learn/social-login/), your team is able to choose from over thirty providers.

![Auth0 social login](https://images.ctfassets.net/23aumh6u8s0i/UCeigts6u0MM59HIJNcO2/e450315b596ef072144c4ec19e1c03fe/auth0-social)

If you're an e-commerce site, you might offer the chance to sign in with payment apps like PayPal, while a career platform might select LinkedIn. In each case, your team has the opportunity to view the public information that your customers have already shared on these apps. Since, in most instances, these apps have authenticated their users, incorporating social login into your operations helps ensure that the information you're pulling is authentic and up-to-date. 

Social login keeps your customer data organized in a single location from the start. This is key to all other facets of aligning with GDPR regulation. Being able to quickly recall and make changes to this data will set you up for success going forward.

## 2. Manage Your Users With Auth0's User Dashboard

[Auth0's user dashboard](https://auth0.com/gdpr) is a centralized view that clarifies in real-time who is accessing your customers' information, how, from where, and using what device.

![Auth0 user dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Lne57D8kZ3KFBrPQ4TKNm/f5ca63090985effaaee7c75ca0912bdc/auth0-users)

Administrators can rapidly scroll through current users for context (name, picture, and outside affiliation if they are a consultant or third party). 

Clicking on a particular user will enlarge their profile to provide an even richer view of details, including: their contact information; which sites they are working on; which devices they are using to do so; and a history of all prior activity in your system.

![Auth0 user info](https://images.ctfassets.net/23aumh6u8s0i/7298YiBzOtDvD9QFBA2iOH/8bfbfd2ba3a105676a479281e28f2084/auth0-user)

From here, it's simple to block anyone that is suspicious or not acting appropriately. It's difficult to understand how important this tool can be if you are assessed for GDPR compliance. It gives you a comprehensive understanding and clearly documented approach to track and control anyone touching the data of your end users. The user dashboard is more advanced than the manual methods that many teams are currently using to track this, such as adding information to spreadsheets.

The dashboard can help a team understand trends, set clear policies for its users, quickly communicate its process to customers, and facilitate customers that wish to access, modify, move, or delete their data.

## 3. Manage Your Workflow With Airtable

To organize your team, it could be useful to move your GDPR checklist into a workflow tool like [Airtable](https://airtable.com/) to track who will complete each task, by when, and note additional important details. 

For any major project like this, you can assign portions to individual teammates, set due dates, and customize it with notes.

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/5Fj4MbjwUEtUC8lVe81EAD/d167dab8d74fb4e45ac99984b0f191b6/pm)
_([Source](https://guide.airtable.com/project-management/))_

Airtable is far more than a black-and-white spreadsheet; it allows people who are more visual to upload photos for a multi-dimensional view. For example, if administrators are working through particular use cases, they can add screenshots to better explain processes or highlight any issues as they arise. 

The comprehensive abilities of Airtable allow for a clarity and depth of understanding of the nuances of complex projects like an operations overhaul or revamping IT policies to align with GDPR. Having everything specifically documented in this tool can allow you to quickly pull and analyze information in preparation for an audit.   

Other workflow tools that could help include [Asana](https://asana.com/guide/examples/project-management/project-management) (particularly helpful if a great calendar view is needed) and [Trello](https://trello.com/) (better for hitting the major points if your team is expert and well versed in GDPR details).

## It's Not Too Late to Comply!

Despite being past the deadline, your team still has time and tools at your fingertips to quickly get up to speed. Taking advantage of the tools above will make the transformation more efficient, transparent, and potentially even enjoyable as you uncover ways to better support your customers (e.g., creating a smoother onboarding experience) in addition to providing exceptional security.




Your Quick GDPR Compliance Checklist

Eugenio Pace joins ranks of mold-breaking entrepreneurs in B2B Software and Services category



**BELLEVUE, Wash. -- June 19, 2018 --** [_Auth0_](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that CEO Eugenio Pace has won the Entrepreneur Of The Year® 2018 Award in the B2B Software and Services category in the Pacific Northwest.

The award recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities. Pace was selected by an independent panel of judges, and the award was presented at a special gala event at the Westin Seattle on June 15, 2018.

“To say that I’m truly humbled by this recognition is an understatement,” said Pace. “This award is a culmination of so many things - Auth0, our incredible team, customers, and my support system both inside and outside of the company. I am incredibly honored to be selected for this award.”

Pace continues to lead Auth0 through rapid growth, including more than 100% increase in customers and revenue in 2017 alone. The company also recently announced $55M in Series D funding and is experiencing global momentum as the demand for advanced, modern, and flexible identity management accelerates.

Since 1986, EY has honored entrepreneurs whose ingenuity, spirit of innovation and discipline have driven their companies’ success, transformed their industries and made a positive impact on their communities. Now in its 32nd year, the program has honored the inspirational leadership of such entrepreneurs as:

- Howard Schultz of Starbucks Corporation
- Pierre Omidyar of eBay, Inc.
- Jodi Berg of Vitamix
- Robert Unanue of Goya Foods
- Reid Hoffman and Jeff Weiner of LinkedIn
- Andreas Bechtolsheim and Jayshree Ullal of Arista Networks
- Hamdi Ulukaya of Chobani
- James Park of Fitbit
- J.W. “Bill” Marriott, Jr. of Marriott International, Inc.
- Lonnie Moulder and Mary Lynne Hedley, PhD, of TESARO, Inc.

As a Pacific Northwest award winner, Pace is now eligible for consideration for the Entrepreneur Of The Year 2018 National Awards. Award winners in several national categories, as well as the Entrepreneur Of The Year National Overall Award winner, will be announced at the Entrepreneur Of The Year National Awards gala in Palm Springs, California, on November 10, 2018. The awards are the culminating event of the Strategic Growth Forum®, the nation’s most prestigious gathering of high-growth, market-leading companies.

### _Sponsors_

Founded and produced by EY, the Entrepreneur Of The Year Awards are nationally sponsored in the US by SAP America, the Kauffman Foundation, and Merrill Corporation.

In the Pacific Northwest Region, sponsors also include Woodruff Sawyer.

## About Entrepreneur Of The Year®

Entrepreneur Of The Year®, founded by EY, is the world’s most prestigious business awards program for entrepreneurs, chosen from an independent panel of judges including entrepreneurs and prominent leaders from business, finance, and the local community. The program makes a difference through the way it encourages entrepreneurial activity among those with potential and recognizes the contribution of people who inspire others with their vision, leadership, and achievement. As the first and only truly global awards program of its kind, Entrepreneur Of The Year celebrates those who are building and leading successful, growing and dynamic businesses, recognizing them through regional, national and global awards programs in more than 145 cities in more than 60 countries. ey.com/eoy

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Eugenio Pace of Auth0 Named EY Entrepreneur Of The Year® 2018 Award Winner in the Pacific Northwest

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Global companies need to ready GDPR-like compliance for a growing list of markets



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR has arrived. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

[When “GDPR” is getting searched more often than “Beyoncé](https://qz.com/1284738/gdpr-is-bigger-than-beyonce-according-to-google-search-traffic/),” you know things have gotten critical. 

<blockquote class="instagram-media" data-instgrm-permalink="https://www.instagram.com/p/BhmQ8ZVFfkV/" data-instgrm-version="8" style=" background:#FFF; border:0; border-radius:3px; box-shadow:0 0 1px 0 rgba(0,0,0,0.5),0 1px 10px 0 rgba(0,0,0,0.15); margin: 1px; max-width:658px; padding:0; width:99.375%; width:-webkit-calc(100% - 2px); width:calc(100% - 2px);"><div style="padding:8px;"> <div style=" background:#F8F8F8; line-height:0; margin-top:40px; padding:31.064814814814817% 0; text-align:center; width:100%;"> <div style=" background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACwAAAAsCAMAAAApWqozAAAABGdBTUEAALGPC/xhBQAAAAFzUkdCAK7OHOkAAAAMUExURczMzPf399fX1+bm5mzY9AMAAADiSURBVDjLvZXbEsMgCES5/P8/t9FuRVCRmU73JWlzosgSIIZURCjo/ad+EQJJB4Hv8BFt+IDpQoCx1wjOSBFhh2XssxEIYn3ulI/6MNReE07UIWJEv8UEOWDS88LY97kqyTliJKKtuYBbruAyVh5wOHiXmpi5we58Ek028czwyuQdLKPG1Bkb4NnM+VeAnfHqn1k4+GPT6uGQcvu2h2OVuIf/gWUFyy8OWEpdyZSa3aVCqpVoVvzZZ2VTnn2wU8qzVjDDetO90GSy9mVLqtgYSy231MxrY6I2gGqjrTY0L8fxCxfCBbhWrsYYAAAAAElFTkSuQmCC); display:block; height:44px; margin:0 auto -44px; position:relative; top:-22px; width:44px;"></div></div><p style=" color:#c9c8cd; font-family:Arial,sans-serif; font-size:14px; line-height:17px; margin-bottom:0; margin-top:8px; overflow:hidden; padding:8px 0 7px; text-align:center; text-overflow:ellipsis; white-space:nowrap;"><a href="https://www.instagram.com/p/BhmQ8ZVFfkV/" style=" color:#c9c8cd; font-family:Arial,sans-serif; font-size:14px; font-style:normal; font-weight:normal; line-height:17px; text-decoration:none;" target="_blank">A post shared by Beyoncé (@beyonce)</a> on <time style=" font-family:Arial,sans-serif; font-size:14px; line-height:17px;" datetime="2018-04-15T16:31:27+00:00">Apr 15, 2018 at 9:31am PDT</time></p></div></blockquote> <script async defer src="//www.instagram.com/embed.js"></script>

Searches for information on the EU’s data privacy regulation are outpacing Queen Bey’s more than 100 million Instagram followers.

Ready or not, GDPR comes into force today, bringing with it confusion and fine concerns. A recent Ponemon survey of 1,000 companies showed that [60% of tech companies would not be ready when GDPR came into force](https://www.theverge.com/2018/5/22/17378688/gdpr-general-data-protection-regulation-eu).

While many businesses appear to be making the calculated (or unprepared) decision to take their chances rather than complete GDPR readiness, [the EU isn’t the only place updating data regulations](https://auth0.com/blog/gdpr-effect/). For global businesses, the smarter play is to continue to refining compliance measures. Here’s an update based on other data privacy regulations since we last posted in March:

## Bermuda: [Personal Information Protection Act (PIPA)](https://www.gov.bm/privacy)

Noting that “many countries recognize this as an important human right and have developed laws to protect individuals’ personal information,” Bermuda’s Personal Information Protection Act (PIPA) comes fully into effect in Dec. 2018. Bermuda follows the global trend towards data protection, but follows a broad definition of personal information as any identifiable information about an individual. Transferred information to a third-party will remain the responsibility of the Bermudan organization performing the transfer, in recognition of the necessity of regular transfers of information in Bermudas financial and insurance markets. Fines for compliance offenses top out at $25,000 and up to two years imprisonment for the responsible individual and up to $250,000 in fines for companies.  

## Cayman Islands: [Data Protection Law (DPL)](https://www.dykema.com/resources-alerts-cayman_islands_seek_to_supplement_its_data_protection_law.html)

Coming into force in Jan. of 2019, the Cayman Islands Data Protection Law (DPL) sound a lot like GDPR with a “data controller,” division of data into personal and sensitive categories, and giving individuals rights to their information. However, violators could find themselves on the wrong end of a search warrant, and the DPL affords the ability to impose liability on corporate directors, secretaries, or officers, but a fine can’t go above $250,000 for a single offense and organizations get up to five days for breach notification. Information transfer to foreign governments will only occur if it is permitted under local laws or order of the Cayman Islands’ Grand Court. 

## China: [Information Security Technology – Personal Information Security Specification](https://www.huntonprivacyblog.com/2018/01/26/china-releases-national-standard-personal-information-security/)

In effect as of May 1, 2018, this voluntary specification addresses many of the same concerns as GDPR: How personal data should be collected, retained, transferred, and protected, as well as specifying breach notification and consent guidelines. Although voluntary, the specification is likely to become influential within China if widely adopted. 

## India: [Telecom Regulatory Authority of India (TRAI) Principles](https://www.livemint.com/Industry/1IqKNheVK8Si1v5oGLL2NM/Trai-to-draft-principles-on-privacy-of-user-data.html)

As of this writing, the Telecom Regulatory Authority of India (Trai) is expected to provide broad principles that will guide data ownership, privacy, and security, but will stop short of providing a complicated law because the space is rapidly evolving. The first draft of recommendations that TRAI hopes will lead to legislation should be drafted by June 2018. 

## Israel: [Privacy Protection Regulations (Data Security)](https://iapp.org/news/a/israel-enacts-landmark-data-security-notification-regulations/)

Enacted in 2017, Israel’s data privacy regulations provided protections with the private and public sectors. International Association of Privacy Professionals (IAPP) described the regulations as “unprecedented around the world for their scope, level of detail, and legal effect,” noting that violation can mean a criminal offense. Granular regulations require multifactor authentication and the rotation of passwords every six months. Most recently, Israel [increased fines to 3.2 million Israeli dollars](https://iapp.org/news/a/israel-japan-and-canada-talk-keeping-up-with-the-gdpr-2/) with the goal of increasing compliance.

## New Zealand: [2015 Cyber Security Strategy and Action Plan Refresh](https://www.opengovasia.com/articles/new-zealand-announces-comprehensive-refresh-of-cybersecurity-approach)

Cybersecurity is seen as foundational for protecting citizens and economic growth in New Zealand, with the announcement of a refresh to the country’s cybersecurity action plan.  Broadcasting, Communications and Digital Media Minister Clare Curran also cited goals to make make Information and communication technology (ICT) a major contributor to the New Zealand’s gross domestic product (GDP). A working group of various government institutions and non-governmental partners will start preparing guidelines in July of 2018 and will also involve the citizenry in formulating an updated plan.

## Thailand: [Data Protection Act](https://iapp.org/news/a/thai-data-protection-act-to-secure-data-privacy-standards/)
Approved at the beginning of May, Thailand’s Data Protection Act is expected to come into force within 2018. Enacted after mobile phone operator True Move exposed 46,000 records without repercussions, the new law will be in aligned with GDPR. 

## Viet Nam: [Law on Cybersecurity (Draft)](https://globalcompliancenews.com/vietnam-draft-law-cybersecurity-20180502/)
The latest draft of VIet Nam’s Law on Cybersecurity now requires offshore entities who provide telecom of internet services to comply with the law as well as have headquarters or representatives in country and store data there as well. But due to vague wording, there may or may not be a new restriction on storing data within Viet Nam. The law, which has been through 16 drafts at the time of this writing, remains open for comment.

## We Can Help You Protect Your Customers

Many organizations claim that they’re putting the customer first. For a global public growing increasingly aware of breach consequences, that will likely mean taking care of their data in alignment with government regulations. If you’d like help with compliant authentication or would prefer to get it done with a whole lot less hassle, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


Data privacy doesn’t stop at the EU border

The awards program recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities.




**BELLEVUE, Wash., May 7, 2018 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that CEO and Co-founder Eugenio Pace has been named a finalist by EY for its Entrepreneur Of The Year® 2018 Award in the Pacific Northwest. The awards program recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities.

“I am honored to be considered for this very prestigious award, alongside such outstanding entrepreneurs from the Pacific Northwest,” said Pace. “Auth0 is experiencing tremendous growth and success, none of which would be possible without the incredible people I work with. This award is an amazing recognition of the collaboration between our team, our product, and our valued customers.”

Pace was selected as a finalist by a panel of independent judges. Award winners will be announced at a special gala event on June 15 at the Westin Seattle. Now in its 32nd year, the program has expanded to recognize business leaders in more than 145 cities and more than 60 countries throughout the world.

Regional award winners are eligible for consideration for the Entrepreneur Of The Year National competition. Award winners in several national categories, as well as the Entrepreneur Of The Year National Overall Award winner, will be announced at the Entrepreneur Of The Year National Awards gala in Palm Springs, California, on November 17, 2018. The awards are the culminating event of the Strategic Growth Forum®, the nation’s most prestigious gathering of high-growth, market-leading companies.

Sponsors
Founded and produced by EY, the Entrepreneur Of The Year Awards are nationally sponsored in the US by SAP America, the Kauffman Foundation and Merrill Corporation.
In the Pacific Northwest, sponsors also include Woodruff Sawyer.

About Entrepreneur Of The Year®
Entrepreneur Of The Year®, founded by EY, is the world’s most prestigious business awards program for entrepreneurs, chosen from an independent panel of judges including entrepreneurs and prominent leaders from business, finance, and the local community. The program makes a difference through the way it encourages entrepreneurial activity among those with potential and recognizes the contribution of people who inspire others with their vision, leadership and achievement. As the first and only truly global awards program of its kind, Entrepreneur Of The Year celebrates those who are building and leading successful, growing and dynamic businesses, recognizing them through regional, national and global awards programs in more than 145 cities and more than 60 countries. ey.com/eoy

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Auth0 CEO Eugenio Pace Named EY Entrepreneur Of The Year® 2018 Award Finalist in Pacific Northwest

The growing list of new privacy laws outside the EU can be challenging. Auth0 provides a list of recently enacted laws or those under consideration.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

Governments around the globe are changing how they view privacy as a result of the EU’s deliberations on personal data protection and breach notification.

Those deliberations resulted in the General Data Protection Regulation (GDPR) coming into force on May 25, 2018. Meanwhile, many other governments, including two states in the U.S., have recently enacted or are considering similar regulations. These changes mean that organizations which have previously avoided the effort to become GDPR-compliant could still find themselves facing similar regulatory requirements and fines—or at least the need to get their data and processes in order to scale into new regions.

<include src="TweetQuote" quoteText="Keep up with the growing list of new privacy laws and amendments outside the EU with the help of Auth0"/>

## GDPR Whitelisting Influence

While GDPR applies directly to data from EU citizens, the EU also regulates whether or not personal data may [flow from within the EU to an outside country](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en).

These agreements allow for data to securely flow between two countries and often diminish or remove the need for additional contractual clauses.

The EU is also going to create a European Data Protection Board that will wield the power to influence large swathes of the digital data economy. Warnings about adequacy protections are already influencing other government’s data protection efforts.

The threat of removal from this whitelist is reportedly part of what influenced some changes in Argentina’s latest data protection bill. Canada is also looking to align data protection efforts with GDPR.

Most recently, the UK’s Prime Minister Theresa May made it abundantly clear that she’s seeking [more than an adequacy agreement with the EU](https://iapp.org/news/a/can-theresa-may-get-the-data-protection-deal-she-wants/), pushing for the UK’s Information Commissioner’s Office (ICO) to serve as GDPR’s UK enforcing agency, with the likely goal of having the ICO serve on European Data Protection Board. 
South Korea, as well as Japan, are also in white-list discussions with the EU. 
If you’re a global company like Auth0, it’s a good idea to keep up with the growing list of new privacy laws and/or amendments to existing privacy laws in countries outside of the EU. 

The countries listed below are currently "whitelisted" by the EU as having adequate protections, meaning that data may currently flow from the EU (and Norway, Liechtenstein, and Iceland) to one of these countries without additional protections: 

- Andorra
- Argentina
- Canada (commercial organisations)
- Faroe Islands
- Guernsey
- Israel
- Isle of Man
- Jersey
- New Zealand
- Switzerland
- Uruguay 
- United States ([Privacy Shield framework](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en) only)

### Argentina: [Draft Data Protection Act](https://iapp.org/news/a/gdpr-matchup-argentinas-draft-data-protection-act/#)

On Jan. 2017, after a public comment period, The Argentine Data Protection Agency (Dirección Nacional de Protección de Datos Personales) presented a draft of the Data Protection Act. The proposed bill offers several changes, including the elimination of registration databases and limiting the recognition of data subjects to individuals removing the current inclusion of legal entities. Like GDPR, the updated bill also revised legal definitions to include biometric and genetic data. Subjects must also be notified if a deal is canceled due to a credit report. The bill also seeks to make DPPA an independent entity to preserve GDPR whitelisting, since the EU raised objections to its current position under the National Ministry of Justice and Human Rights. The bill is expected to reach Argentina’s congress in 2018.

### Australia: [Notifiable Data Breach Scheme (NDB)](https://www.oaic.gov.au/privacy-law/privacy-act/notifiable-data-breaches-scheme)

This amendment to Australia’s Privacy Act of 1988 went into effect last month on Feb. 28, 2018. Under NDB, individuals must be notified if a data breach is likely to result in "serious harm" and requires that the notification indicate steps that harmed individuals should take to protect themselves. The Australian Information Commissioner must also be notified. NDB applies to organizations with an annual turnover of $3 million AUD or more, as well as businesses that trade in personal information, health information, and tax file number (TFN) recipients.

### Canada: [Personal Information Protection and Electronic Documents Act (PIPEDA)](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/)

At the end of Feb. [the Canadian government published a report](https://www.ourcommons.ca/DocumentViewer/en/42-1/ETHI/news-release/9691065) recommending an update to the Personal Information Protection and Electronic Documents Act (PIPEDA) in force since April of 2000. Including GDPR-familiar principles like consent and data portability, the recommendation also includes considering implementing measures to improve algorithmic transparency. Also striking is the inclusion of language that  demonstrates GDPR’s reach citing the intent to "work with its EU counterparts to determine what would constitute adequacy status for PIPEDA in the context of the new General Data Protection Regulation (GDPR)."

### Japan: [Act on the Protection of Personal Information (APPI)](https://iapp.org/news/a/matchup-gdpr-and-japans-act-on-the-protection-of-personal-information/)

Into force as of May 30, 2017, APPI, shares many GDPR similarities, including a "whitelist" of other countries with acceptable data protection regulations that may encourage safe data flow. 
But while GDPR’s purpose is to encourage the "free movement" of data while also providing protection, APPI focuses on protecting the rights of individuals and extends protections to include personal identifier codes, and aggregated information in the "business operator’s" database. The EU and Japan remain in discussions regarding mutual "whitelisting".

### UK: [Data Protection Bill](https://services.parliament.uk/bills/2017-19/dataprotection.html)

The UK’s third-generation Data Protection bill is intended to fill many of the gaps generated by Brexit and protect the free-flow of data between the UK and the EU, accounting for [75% of the UK’s cross-border data flows](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/639853/The_exchange_and_protection_of_personal_data.pdf), worth billions of pounds in trade. The bill also addresses data standards for social, health, law enforcement, and intelligence agencies as well as legal enforcement of GDPR standards. The portion of the bill seeking to [deny data access rights](https://www.theguardian.com/technology/2018/mar/05/home-office-immigration-data-access-eu-citizens-data-protection-bill) for "effective immigration control" came under fire during the first weekend of March 2018, with groups seeking to have the exemption removed and threatening legal action.

### CALIFORNIA: [California Consumer Privacy Act (CCPA)](https://www.caprivacy.org/inthenews/)

Targeting the November 2018 ballot in the state of California in the United States, the California Consumer Privacy Act seeks to limit companies’ ability to collect and sell consumer data and includes data breach notification requirements as well as the right to know what is being collected and the right to say "don’t sell my data." Also included is the right to be protected from discriminatory practices like denying services or charging higher prices, influenced by collected data. The bill faces [significant opposition](https://qz.com/1219254/california-democrats-are-trading-blows-with-silicon-valleys-libertarians-in-a-fight-for-the-left/), from within the tech industry.

### NEW YORK: [DFS Cybersecurity Regulation](http://www.dfs.ny.gov/about/press/pr1708281.htm), [The Stop Hacks and Improve Electronic Data Security Act (SHIELD)](https://www.nysenate.gov/legislation/bills/2017/s6933)

The U.S.’s New York State took the lead in new and proposed regulations last year with [cybersecurity regulations](http://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf) for all non-governmental agencies operating under banking law, including scrutiny of third-party vendors. Annual compliance reports for businesses providing financial services in New York State are due this March. But in the wake of the [Equifax breach](http://searchsecurity.techtarget.com/news/252436307/Equifax-data-breach-affected-24-million-more-consumers), New York is now considering more stringent regulations. Currently under review in the Senate Rules Committee, [The Stop Hacks and Improve Electronic Data Security Act](https://www.nysenate.gov/legislation/bills/2017/s6933) (SHIELD) provides breach notification requirements and protections for personal data. Breaches would be considered a violation of business law. SHIELD would also add the option of seeking remedies under the civil law. Like GDPR’s protection for EU’s citizens, the SHIELD Act would apply to any business holding sensitive data for New Yorkers, regardless of location.

<include src="TweetQuote" quoteText="Governments around the globe are taking a cue from GDPR. Check out @auth0’s list of countries and states with new privacy laws or amendments."/>

## Global Deployment and Compliance with Auth0

Auth0’s ability to deploy anywhere and remain current with constantly changing laws and regulations gives companies the flexibility to grow without having to worry about whether or not their authentication solution can scale. If you’d like insight into how Auth0 can help you deploy in particular regions, please reach out to [sales@auth0.com](mailto: sales@auth0.com).

Auth0, a global leader in Identity-as-a-Service (IDaaS), provides thousands of customers in every market sector with the only identity solution they need for their web, mobile, IoT, and internal applications. Its extensible platform seamlessly authenticates and secures more than 50M logins per day, making it loved by developers and trusted by global enterprises. The company's U.S. headquarters in Bellevue, WA, and additional offices in Buenos Aires, London, Tokyo, and Sydney, support its customers that are located in 70+ countries.


GDPR Effect?

krti_XnE_400x400

At Auth0 we ❤️ developers. Serving & giving back to the community is one of the most rewarding things we do. We want to empower others to join the mission!

Auth0 Ambassador

ngVikings brought the European Angular communities to Espoo, Finland for two days of networking and learning.



A big part of being an [Auth0 Ambassador](https://auth0.com/ambassador-program) and Evangelist is attending and speaking at conferences all over the world. Our ambassadors attend a very diverse set of events ranging from technology-specific conferences, like [Oracle Code](https://developer.oracle.com/code), to technology agnostic conferences like [CodeMash](http://www.codemash.org/), and everything in between.

The **Conference Recap** series will summarize our experiences at the various conferences we attend, sharing the big news, things we learned, things we liked, and more. We’ll kick the series off with [ngVikings](https://ngvikings.org/).

<AmpContent>

[Watch "ngVikings 2018 &mdash; Highlights"](https://www.youtube.com/watch?v=-wVodWS-9OU)


</AmpContent>

<NonAmpContent>


<iframe width="560" height="315" src="https://www.youtube.com/embed/-wVodWS-9OU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


</NonAmpContent>

## ngVikings 2018

![ngVikings Venue](https://images.ctfassets.net/23aumh6u8s0i/39jPAKVqu8vOejBL7XQTh2/b36446505b50304cdbb11d97532c8903/ng-vikings-2018-stage)

Dubbed as the "main Angular event in the Nordics — and the only traveling Angular conference in the world", ngVikings was a unique two-day conference organized by a coalition of Angular and GDG Meetups from the Nordic countries of Norway, Sweden, Finland, and Denmark. This year, the traveling conference was scheduled to be in Helsinki but found itself in close-by Espoo, Finland and was held at [Aalto University](http://www.aalto.fi/en/).

The conference brought together over 300 developers and speakers from all over the world.

The keynote address was delivered by a core member of the Angular team [Matias Niemelä](https://twitter.com/yearofmoo/) and focused on his journey to Angular, how Angular has evolved over the last five years, and where it’s headed next. [Angular Elements](https://github.com/angular/angular/issues/20891) and the new ngIvy renderer seem really promising additions to the already excellent framework. Watch the keynote here:

<AmpContent>
<amp-youtube
    data-videoid="WahpV6zn8lQ"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/WahpV6zn8lQ" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

After the keynote, the conference was split into two tracks with each speaker giving a 30-minute presentation. The talks featured at ngVikings focused mainly on Angular 2+ showing best practices, sharing lessons learned, and focusing on the future of the framework. You can view all of the talks [here](https://www.youtube.com/watch?v=WahpV6zn8lQ&index=1&list=PLVI0Ut22uwY4UC1v5fUvi2RIU4R4jPkba), and while all of the talks were great and worth checking out, a few that really stood out for me where:

### Deploying Angular and Node to the Cloud

<AmpContent>
<amp-youtube
    data-videoid="XmpEZN5TCjw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/XmpEZN5TCjw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [John Papa](https://twitter.com/John_Papa)

> Your Angular app is complete! Now it's time to deploy it to the cloud. But how? One key ingredient is determining our goals. Do you want to publish directly from your laptop or through source control and CI/CD? Do you worry that it may work differently on your machine than the cloud? What about locking down versions of node, packages, and OS? Is your head about to explode? We'll explore several good options as we discuss the pros and cons of each including direct deployments, GitHub hooks with CI, and docker. We'll demonstrate how to code, debug, and run docker locally to have confidence that what works locally will work in the cloud. The good news is that tooling has improved to make all of these deployment options within your reach to guide you to successfully deploy your Angular app to the cloud.

### Advanced Angular DI

<AmpContent>
<amp-youtube
    data-videoid="PRRgo6F0cjs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/PRRgo6F0cjs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Ward Bell](https://twitter.com/wardbell?lang=en)

> You Don’t Know DI? Go beyond Dependency Injection basics. Learn about the two parallel DI hierarchies and which one wins, what happens when you provide the same token twice … when multi is true, what’s the effect of lazy loading, what’s going on in forRoot and forFeature, what’s in a component’s injector, and how to talk to the components in content children when you don’t know their types. It’ll be fast, code-frontal, fun.

### 6 Apps One Codebase with Ionic

<AmpContent>
<amp-youtube
    data-videoid="4bGMXuPM_FI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/4bGMXuPM_FI" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Sani Yusuf](https://twitter.com/saniyusuf)

> You and your team have this great Idea and you have your users using different devices and operating systems to access the same application. Some users are on the Web, some on Mobile some of their Desktop and you also have to worry about what operating system they are on and also have to consider how your application is presented on each device & operating system. What if there was a way to code your app without worrying too much about operating systems/devices/screen sizes and just focusing on getting your idea across to your users regardless. Join me on a journey where I show you how to use Angular, Ionic & the PWA standard to build apps for IOS, Android, Windows, Web, Mac & PC with the same code all using just HTML5.

A big shout out to the organizers including [Maxim Salnikov](https://twitter.com/webmaxru), [Shahrzad (Sherry) Aziminia](https://twitter.com/sherrrylst), [Chris Noring](https://twitter.com/chris_noring), [Jussi Kinnula](https://twitter.com/jussikinnula), and the [rest of the team](https://2018.ngvikings.org/team/) for putting together such a great conference.

## Auth0 at ngVikings 2018

[Ado Kukic](https://ado.xyz), Developer Evangelist at Auth0, was the only Auth0 representative at ngVikings and gave a talk titled “A Token Walks Into a SPA…”, which focused on token-based authentication for single page applications and Angular in specific. You can watch the talk here:

<AmpContent>
<amp-youtube
    data-videoid="EoEOjQhSHNo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/EoEOjQhSHNo" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

The talk covered topics ranging from why you should consider token-based authentication, how JSON Web Tokens actually work, SPA architectures and security considerations they bring with them, and finally how to incorporate token based authentication using various Angular specific features like HTTP Interceptors, Route Guards, and more.

## ngVikings 2019

I am very hopeful that ngVikings makes a return next year, and the official conference website implies it will. Check out the [official site](https://ngvikings.org/) for updates on where the traveling conference is sailing to next!

![Over 300 developers attended ngVikings](https://images.ctfassets.net/23aumh6u8s0i/5ysl15Y4PNwYquLgpU7r3E/0a5ed58058f87f7c08effe5b1057022a/attendees)

If you are interested in learning more about or joining the Auth0 Ambassador program, check out the [Ambassador page on our website](https://auth0.com/ambassador-program).

<include src="asides/AboutAuth0" />


Conference Recap: ngVikings 2018

Pace to continue momentum of company's exponential growth



**BELLEVUE, WA -- Dec. 12, 2017** – Auth0, a global leader in Identity-as-a-Service (IDaaS), today announced that company co-founder Eugenio Pace will serve as its new chief executive officer, effective immediately. The company is grateful to Jon Gelsey, Auth0’s former CEO, for four years of outstanding service.

Pace has been integral to Auth0’s exponential growth since co-founding the company with Matias Woloski, CTO, in 2013. Most recently as chief customer officer, Pace has been part of the leadership team that has led to Auth0’s significant milestones, such as raising nearly $55M in total funding-to-date, and in 2017 alone:

* Doubling its customer base with 1,500 new companies;
* Increasing revenues by more than 100 percent; 
* Hiring more than 120 new people; and
* Opening offices in London, Tokyo, and Sydney.

With an extensive technical background and previous senior management positions at Microsoft, Pace will focus his efforts on continued product innovation, customer success, and global expansion. 


“I’m honored to be at the helm of Auth0 at such an exciting stage in the company’s evolution. The past few years of exceptional growth are a strong indicator of where we are heading, and I am very appreciative of Jon’s dedication to getting us to this stage,” said Pace. “We hold steadfast to our mission of providing the easiest-to-use IDaaS platform to solve the most complex and large-scale identity and access management challenges. Our amazing team has enabled us to stake our leadership claim in this market, and I’m thrilled to continue our mission as leader of this organization.”
 
<include src="asides/AboutAuth0" />


Auth0 Names Eugenio Pace as New CEO

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

A new global ransomware attack is affecting European countries and governments



In May, a ransomware called [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/) became famous around the world for holding computers' file systems as hostages. Today, government institutions (like [Ukraine's national bank](http://www.independent.co.uk/news/world/americas/petya-cyber-attack-us-pharma-merck-ukraine-ransomware-national-bank-power-wpp-ad-agency-wannacry-nhs-a7810906.html)) and companies from the private sector reported that another outbreak has started.

The ransomware responsible for haunting organizations today is called Petya, although this name originates from a [ransomware that attacked last year](https://blog.kaspersky.com/petya-ransomware/11715/). Similarly to WannyCry, today's Petya ransomware starts by encrypting a computers file systems and then it demands payments to restore access to these files.

## What Is a Ransomware?

The very definition of ransomware is a malware that blocks access to the victim's data until a ransom is paid. There are some ransomwares that lock the systems in a way that is not difficult to reverse, but the more advanced ones are using a technique called [cryptoviral extortion](https://en.wikipedia.org/wiki/Cryptoviral_extortion). This technique consists of encrypting victims files, makes them inaccessible. To regain access, the authors demand a ransom payment to reverse the encryption. Nowadays, most ransomwares are requesting [Bitcoins](https://bitcoin.org/) as ransom payment, to [take advantage of cryptocurrency's anonymity](https://bitcoinmagazine.com/articles/is-bitcoin-anonymous-a-complete-beginner-s-guide-1447875283/).

## What Is Petya Ransomware?

The real name of the ransomware that is striking today has not been defined. But, as this ransomware is supposed to be a variant of [Petya](https://blog.kaspersky.com/petya-ransomware/11715/), the name is being reused. Petya locks a computers hard drive as well as individual files stored on it. It's not easy to recover data from the computers affected by this malware.

One interesting fact is that cyber security experts at Kaspersky Lab have released a report that said the ransomware was not related to Petya but was in fact a new ransomware it called [NotPetya](https://www.forbes.com/sites/thomasbrewster/2017/06/27/petya-notpetya-ransomware-is-more-powerful-than-wannacry/#16c86cff532e). The contradictions are yet to be clarified.

![NotPetya/Petya screenshot](https://images.ctfassets.net/23aumh6u8s0i/3YZyJ4v23esutsMRvDiiqf/04e819bd692dafe953ca066274fdfcf9/notpetya)

## How Petya Started?

[A Ukrainian software firm is alleged to be the source of today's outbreak](https://www.forbes.com/sites/thomasbrewster/2017/06/27/medoc-firm-blamed-for-ransomware-outbreak/#20ca49ae73c8). Although there is no confirmation about this, and that the company has denied these claims in a [Facebook post](https://www.facebook.com/medoc.ua/posts/1904044929883085), the outbreak is indeed striking Ukraine harder then any country.

![Petya/NotPetya attacks by country](https://images.ctfassets.net/23aumh6u8s0i/79338Jos1R3YU6mfYS64kT/dff234a5379b9d3a8e5cb66c029a5c72/by-country)

## How The Petya Ransomware Spreads?

Researchers are saying that the this new outbreak is hitting systems via the same leaked NSA vulnerabilities used by [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/). The analysis of some of Petya's samples confirmed that the malware author used the [EternalBlue exploits](https://en.wikipedia.org/wiki/EternalBlue), which targeted a vulnerability in Microsoft Windows. [Microsoft already created patches to solve EternalBlue vulnerability](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched), but many computers out there don't have this patch applied.

## How Do I Protect Myself?

Although no solutions were found for retrieving data from computers affected by Petya so far, you can review and [update your devices](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched) and also check that your approach to security is good. Recently we wrote a blog post that shares some good practices regarding [Personal Information Security Guide for Family and Friends](https://auth0.com/blog/personal-information-security-identity-guide/).

Be sure to check out this [guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as WannaCry, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Global Ransomware Strikes Again

jonathan-armstrong

Jonathan Armstrong

The data protection and security landscape is all set for change next year with the new EU General Data Protection Regulation (GDPR). Find out how this may affect your business and what to do next.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

## Introduction

The data protection and security landscape is all set for change next year with the new [EU General Data Protection Regulation (“GDPR”)](https://auth0.com/gdpr). There will be regulatory burdens, but you can also use GDPR to bring some focus on what you do and improve your security stance.  Remember...

* The new rules are part revolution/part evolution - the new system builds on the current one if you already comply with EU privacy laws you can build on those foundations;
* Don’t panic, plan instead - the full impact will come in 2018 but preparation now will pay off then.

![EU General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

At Cordery we’ve been working on GDPR projects since the first draft came out in 2012. GDPR is a long document but here’s some highlights:

## Reach

The new rules will apply to all those in the EU who control data and/or undertake data processing.

* All sectors are affected - the more robust your privacy compliance the better your market advantage;
* Non-EU businesses doing business in the EU are also affected.

Identity management has a role to play in GDPR to help you work out whether data subjects are who they say they are and whether they are in scope for different aspects of GDPR. Establishing identity is also essential when someone tries to exercise new rights which GDPR creates.

## What are those new rights?

New rights are being introduced and existing ones tweaked, including.

* A new Right To Data Portability;
* An extended Right To Be Forgotten (called the Right to Erasure);
* An enhanced Subject Access Right - to be free and with a shorter time to reply.

## Data Protection Impact Assessments ("DPIAs")

DPIAs will have to be undertaken for certain data processing operations.

DPIAs put the compliance assessment burden on those handling personal data - but, used as a wider tool they help you get a better handle on your data processes and reduce risk. This should help you build privacy and security into the heart of what you do. There’s no set format - the key thing is to pick a process that is simple to understand and helps you get to the real risks quickly.

### Security Breach Reporting

One of the most important changes is that there will be mandatory security breach reporting.

Breaches must be reported to a regulator within 72 hours and those affected by the breach must also be informed - to do this you must have clear, practical, effective and immediate procedures. You’ll also need to get your vendors and suppliers on board - this is business critical so you can’t afford to get it wrong.

### Greater Penalties

Increased enforcement will come about with the new regime, backed up by [greater sanctions](https://resources.auth0.com/whitepaper/gdpr-fine-determination/).

There are fines of up to €20 million or 4% of the global annual revenue of a business (whichever is the greater), with likely higher reputational damage resulting and the possibility of civil actions too. This is the big stick for data protection compliance, but, getting it right will avoid major headaches.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## What you need to do now?

Start preparing now and read our FAQs at [www.bit.ly/gdprfaq](https://www.bit.ly/gdprfaq) or watch our film on YouTube at [www.bit.ly/gdprfilm](https://www.bit.ly/gdprfilm). You might also be interested in our GDPR subscription service which includes films, checklists articles and a monthly call to help plan for GDPR. The details of this service are at [www.bit.ly/gdprnav](https://www.bit.ly/gdprnav).

<div class="alert alert-info">
<strong>About Jonathan Armstrong:</strong><br />
<p style="color: #097093;">Jonathan is an experienced lawyer with Cordery in the UK with a concentration on compliance and technology. His practice includes advising multinational companies on matters involving risk, compliance and technology across Europe. He has handled legal matters in more than 60 countries involving data breach, bribery and corruption, corporate governance, ethics code implementation, reputation, internal investigations, marketing, branding and global privacy policies.</p>

<p style="color: #097093;">Jonathan is one of three co-authors of the LexisNexis definitive work on technology risk, "Managing Risk: Technology & Communications". He is a frequent broadcaster for the BBC and other channels.</p>

<p style="color: #097093;">Jonathan was ranked as the 14th most influential figure in global data security by Onalytica in their 2016 Data Security Top 100 Influencers and Brands Survey.</p>

<p style="color: #097093;">In addition to being a lawyer, Jonathan is a Fellow of The Chartered Institute of Marketing. He has spoken at conferences in the U.S., Canada, China, Brazil, Singapore, Vietnam, Dubai and across Europe. Jonathan qualified as a lawyer in the UK in 1991 and has focused on compliance and technology matters for more than 20 years.</p>
</div>


Get Ready for GDPR

How to prevent criminals to mess with your accounts



Yes, definitely. It’s happened to a number of people I work with.

Imagine you’re walking down the street, checking Slack or Facebook, and someone on a bike rides by and grabs your phone. Guess what, your phone is unlocked and ready for the thief to start using it. The same thing can happen in a bar, the subway, or any other crowded place. Even Scotland Yard has started [using](http://www.bbc.com/news/uk-38183819) this technique (but that’s another matter).

![Getting robbed while phone is unlocked](https://images.ctfassets.net/23aumh6u8s0i/4Kr00xYZ8Z4iCkFPziAi6y/7f5e7c11ed2ede9a715a1ba481859d37/getting-robbed)

The average iPhone thief doesn’t care about your data, he just wants to wipe the phone so he can resell it. This kind of crime is especially prevalent in countries like [Argentina](http://money.cnn.com/2016/09/14/technology/argentina-iphone-black-market/), where there’s a large black market for Apple products. You might be thinking that the thief still needs to disable Find My iPhone to release Apple’s [Activation Lock](https://support.apple.com/en-us/HT201365). That’s true, but if the phone itself is already unlocked, all he needs is your iCloud password.

Do you get your email on your phone? Is it the same email address that’s tied to your iCloud account? Well, guess where iCloud password reset emails used to go? Before a recent update to iOS, it was possible to reset someone’s iCloud password directly from their unlocked phone, simply by virtue having access to their email account. Even if you use Apple’s [two-factor authentication](https://support.apple.com/en-us/HT204915) (which you absolutely should), that works over SMS or push notifications, which also go to your phone.

Previous, there was nothing blocking a thief from stealing your phone while it was in use (and unlocked), resetting your iCloud password via your email account, disabling Find My iPhone, and finally wiping it to be resold. Thankfully, Apple appears to have quietly fixed this loophole by making it more difficult to reset an iCloud password. If you attempt it from your phone (even via Safari), it will ask you for your unlock PIN.

I used to recommend taking an additional precaution to mitigate this risk, but it’s not really necessary anymore (although it can’t hurt). If you follow these steps, the iCloud account settings will be completely unavailable until you disable “Restrictions” with an extra PIN that you’ll set below. Go to *Settings > General > Restrictions > Enable Restrictions > [create a PIN, enter it twice] > Accounts > Don’t Allow Changes*

Now that Apple has added the necessary security checks to the iCloud password reset process, my recommendations are simpler: enable two-factor authentication for iCloud, and choose a hard to guess, 6-digit (or longer) PIN on your iPhone. With Touch ID, you rarely have to type it anyway.

![Apple's two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/1JZgMtXTm0TfSnGCab8MWK/c2a81630672de5ada598f83c417b2d2b/apple-2-factor-auth)

**Kudos to Apple for making this improvement. I believe it will help keep people safer by discouraging iPhone muggings.**

Now, if you’re a bit more paranoid and want to really limit what someone can access if they snatch your phone while you’re in the middle of using it, there is one more thing you can do.

An [engineer](https://twitter.com/radekk) on my team at Auth0 told me about [Guided Access](https://support.apple.com/en-us/HT202612), an iOS feature that lets you temporarily restrict the phone to a single app, and can even limit the actions available to the user within an app. With Guided Access configured (*Settings > General > Accessibility > Guided Access*), you can press the home button three times to enable it at any time, within any app. Once it’s on, you’ll need the Guided Access PIN or Touch ID to exit the app. It’s that easy.

Imagine you’re reading the news on your iPhone on the subway. You can quickly enable Guided Access, and lock it down to that one app only. Then even if someone grabs your unlocked phone, they’ll be stuck in the news app forever! (No one wants to read the news for too long nowadays.) Sure, the thief can always power it off, but then the phone will be really locked and essentially useless to them, even for reselling.

Guided Access is intended for situations like when parents let their kids play with their iPhones (or iPads), but it’s actually quite powerful. You could even use it if you think Scotland Yard might be after you…

Could your iPhone get stolen while it's unlocked?

The new body of rules promises to tighten up data security for consumers in Europe.



We are happy to announce that effective today Auth0 is part of the EU-US Privacy Shield Program and publicly committed to comply with its requirements.
This certification enables Auth0 to transfer personal data from the European Union to the United States while complying with EU data protection requirements.

## Understanding Privacy Shield

The European Commission decided last year that the [Safe Harbor Principles](https://auth0.com/blog/safe-harbor-still-matters/), which outlined rules for the security of data transferred between the United States and EU by companies, were no longer robust enough. So they replaced Safe Harbor with the [EU-US Privacy Shield Framework](https://www.privacyshield.gov/welcome).

The Shield isn't a law, it's a system of rules that companies can comply with and get certification for. Therefore it's not a government mandate, but companies that comply will be authorized to transfer personal data from the EU to the U.S. 

This new body of rules promises more stringent protection of data and more oversight for those companies transferring data across the Atlantic.

## What's The Difference Between Safe Harbor And The Privacy Shield

The new EU Privacy Shield was agreed on in August this year with the intention of patching up the holes in Safe Harbor but also upgrading the security that American companies had to ensure.

The Shield is different from Safe Harbor mostly because it calls for the US Department of Commerce to play a larger role in monitoring and supervising compliance, including carrying out reviews and investigations of companies that participate. The Shield is pushing data legislation above and beyond Safe Harbor:

* Participating US companies are now required to post detailed privacy policies on their sites.
* US companies must allow EU citizens to opt out of data sharing with third parties.
* US companies can only process data that is “relevant” to the reason it was collected and must delete personal data that is no longer being used for the purposes it was collected for.
* EU citizens can file complaints via multiple avenues, more than under Safe Harbor.
* If a US company is found in violation by the Fair Trade Commission it has to publish the nature of its non-compliance.
* Even if they withdraw from The Shield, US companies might still have to comply with certain obligations.

Like Safe Harbor, American companies have to self-comply with the Privacy Shield. Doing so allows them to receive certification that their data transferral to the EU is secure. Auth0 is in the process of complying with the brand new EU-US Privacy Shield Framework. 

Auth0 follows the rules laid out in The Shield. In our [privacy policy](https://auth0.com/privacy) we demonstrate how discerning we are with data collection—we only ask for personal information we need to deliver our services and to ensure our site is running properly. We may also analyze your data through aggregated data pools, so that no individual is highlighted in our studies. This protects the privacy of our users.

## Why Was The Shield Introduced

With the constant business that flows between the European Union and the United States, sensitive data is moving back and forth across the two unions continuously. The goal with both Safe Harbor and the new EU Privacy Shield is to protect the data of [individual European consumers](https://medium.com/@nichchung/eu-u-s-privacy-shield-how-snowden-and-schrems-led-the-eu-to-armor-up-94207ee96702#.248ekl938). 

Safe Harbor was implemented in 2000. It was established after Google was launched and before Facebook came on the scene. Despite the fact that it was born before the internet looked anything close to what it does today, Safe Harbor wasn't updated until recently.

![A brief safe harbor history](https://images.ctfassets.net/23aumh6u8s0i/7iEDm5ew1NOoSfcwn214xN/0a5d48a52c242229249da431472d1d6b/safe-harbor-history)

*Source: [iapp](https://iapp.org/resources/article/a-brief-history-of-safe-harbor/)*

Safe Harbor was overturned after Edward Snowden demonstrated how the [NSA was collecting and tracking data](http://www.wired.com/2015/10/tech-companies-can-blame-snowden-data-privacy-decision/). These revelations were compounded by Max Schrems, an Austrian law student who [brought a complaint to the European Court of Justice](http://www.businessinsider.com/ecj-safe-harbor-ruling-bots-expected-2015-10) about Facebook's data collection. He asked the Irish Data Protection Commissioner to stop allowing Facebook, an American company, to transfer data from EU citizens to America. 

It soon became clear to EU citizens that their data could also be mined by the American government body without the consent of EU citizens.

After that one-two punch from Snowden and then Schrems, the European Commission was determined to create a new body of rules that would improve on Safe Harbor and make it even more transparent. And so the EU-US Privacy Shield Framework cracks down on insecure data collection and increases government oversight. 

## What Do I Have To Do To Join The Shield

The Privacy Shield requires self-compliance. That means there's no law demanding that you follow the rules set out by Shield, rather your company can opt to do so and receive certification. In complying with The Shield, organizations will be authorized to transfer the personal data of EU residents to the U.S. 

There are four requirements to joining Shield:

1. The company must be under the authority of the FTC or another U.S. agency (i.e. should be an American company or doing business in America) so these groups can ensure compliance
2. The company must make public its commitment to follow the rules laid out in Shield
3. The company must publicly post its privacy policy
4. The company must implement the Principles laid out in Shield

Any company that wants to be certified by the Department of Commerce for Shield must give them a very detailed description of how the company will be using the personal data of EU citizens. The certificate has to be renewed annually.

Auth0 is now part of the EU-US Privacy Shield Program and we are [already SOC 2 Type II certified](https://auth0.com/security). We also conform to the OpenID Connect protocol and offer HIPAA BAA agreements for companies transferring sensitive personal health information.

We follow a series of verified identity standards and have built our services around them, including LDAP, SAML, OAuth, and JSON Web Tokens. We also maintain the integrity of the data we collect and ensure [security](https://auth0.com/security) through encryption and password hashing. With Auth0 you can ensure up to five levels of password complexity and even opt into custom rules that implement the [OWASP recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls). Through Auth0 you can harness these powerful standards to protect your own applications. When we receive Shield-certification, that too will be available.

## The Future Of Data Protection

As soon as Shield landed on August 1, companies like [Microsoft](https://blogs.microsoft.com/eupolicy/2016/08/01/microsoft-signs-up-for-privacy-shield/) and [Workday](http://blogs.workday.com/workday-self-certified-on-day-one-of-privacy-shield/) were already signed up. But Shield is just the beginning for the new generation of data legislation in the EU. 

The EU-US Privacy Shield Framework promises to improve on current data collection practices and companies that get certified within it are signaling to their consumers that they value privacy and data protection. In 2018, data legislation within the EU is scheduled to expand again with the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation). Shield is almost a primer for the new Regulation.

Data flow should always be secure no matter where in the world you're located. We are stringent in ensuring all the data we're trusted with remains protected. The EU-US Privacy Shield Framework will make sure that American companies are responsible for all the data they collect so consumers remain safe.


Announcing Auth0's Certification in the EU-US Privacy Shield Framework

The Auth0 Logs to Sumo Logic extension helps you deal with security incidents and performance issues

If you're a user of both Auth0 and Sumo Logic, you can use this awesome [Auth0 extension](https://github.com/auth0/auth0-logs-to-sumologic) to send your tenant logs to Sumo Logic. Having all your logs centrally located makes them more valuable and easier to correlate when dealing with something like a security incident or a performance issue. Amazingly, you can sign up for a free [Sumo Logic](https://www.sumologic.com/pricing/) account and collect up to 500MB of data per day! That is more than enough to get started.

<include src="TweetQuote" quoteText="Having all your logs centrally located makes them more valuable and easier to correlate."/>

It's super easy to install the "Auth0 Logs to Sumo Logic" extension right from your Auth0 account [Dashboard](https://manage.auth0.com/#/extensions). Simply login, click on Extensions, then find and click on the Sumo Logic icon to configure and enable the extension.

![Sumo Logic extension icon](https://images.ctfassets.net/23aumh6u8s0i/49s5Wz1y7xmfRkGjmJ2Jgc/c83d0ab7c096c57594153fceeeaf20bc/sl-ext-icon)

Once enabled, the extension configuration screen will be displayed. You'll need to decide on a few simple settings, but the defaults are all reasonable. One piece of information you will need to supply is the URL of your Sumo Logic HTTP collector endpoint. If you don't already have one, follow the [Sumo Logic instructions](https://help.sumologic.com/Send_Data/Sources/HTTP_Source) for creating an HTTP source and paste the URL it generates into the Auth0 extension configuration settings. We recommend naming the source category `auth0_logs`.

![Sumo Logic extension configuration screen](https://images.ctfassets.net/23aumh6u8s0i/WhqZ1Ie4B3RDnTtOqqnZv/414d4ec1db1eb58734ddfcd01cc41542/sl-ext-config)

Data should begin appearing in Sumo Logic a few minutes after you enable the extension. A simple search like `_sourceCategory=auth0_logs` will show you the most recent log events. Getting the top 10 users for a given time period is as easy as this query:

```
_sourceCategory=auth0_logs | json auto
| count user_name | top 10 user_name by _count
```

Want to create a chart showing the popularity of a particular client based on the number of logins per hour over a few days? Sure, you can do that in Sumo Logic with just a few commands:

```
_sourceCategory=auth0_logs salesforce | json auto | timeslice 1h
| count by _timeslice, client_name
| transpose row _timeslice column client_name
```

The resulting chart will look something like this:

![Sumo Logic trend chart sample](https://images.ctfassets.net/23aumh6u8s0i/4UE51x5WhGtPHVIQodVzW1/05bd07e9f8b9bce31297b1edfff1e88b/sl-chart-sample)

We have been using the Auth0 to Sumo Logic extension ourselves since it was first released, and it's proven to be very useful for staying on top of what's happening with our own Auth0 accounts and our internal users (employees). Sumo Logic makes it easy to see the latest failed logins, find and alert on error messages, create charts to visualize trends, or even do complex statistical analysis on your data.

To help us (and our customers) visualize these logs, we spent some time creating a couple of dashboards. The Sumo Logic for Auth0 dashboards show you the output of several saved searches all on one easy to read screen, and makes it easy to zoom in or drill down when something looks interesting.

![Sumo Logic dashboard for Auth0 logs](https://images.ctfassets.net/23aumh6u8s0i/47lOGxI5x1ad90yP32hyQA/9faac6b90588020458e9594ffa2ee991/sl-db-screenshot)

If you're a Sumo Logic customer and are interested in trying out these dashboards, just let us know via [Support Center](https://support.auth0.com) (be sure to include your Sumo Logic account name) and we will gladly share it with you. Once it's available through your account, you're free to customize it, add to it, create alerts based on the searches, or really anything else that you find useful!

Here are the saved searches we've created so far:
![Sumo Logic saved searches for Auth0 logs](https://images.ctfassets.net/23aumh6u8s0i/539k6z8N5pEhhbcXEWzFA4/8844fe55472670e0374734776c2dc252/sl-saved-searches)

We'd love to hear what you think, especially if you've got a great idea that we should incorporate back into our original version. Our goal is to eventually publish these dashboards via a real Sumo Logic app, so that it's automatically available to all users.

Have fun analyzing and visualizing those logs!

Visualize and Search Your Auth0 Logs Using Sumo Logic

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.



A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?


Data Breach Response Plan - Your Startup Needs one

Jose-Romaniello

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Head of Engineering

Jose Romaniello

The Auth0 Australia Region joins the US and EU regions, extending our ability to offer the lowest login latency and allow subscribers to meet any applicable compliance requirements.



---

**TL;DR**: The Auth0 Australia Region launches to join the US and EU regions in helping subscribers lower login latency and meet compliance regulations for data residence.

---

We’re happy to announce that the Auth0 Australia Region has launched! Auth0 is on a mission to make identity simple for developers and IT professionals everywhere - something we’re already doing for more than 30,000 subscribers across more than 150 countries worldwide. Now those in and closest to Australia will enjoy even lower latency logins.

![auth0 australia](https://images.ctfassets.net/23aumh6u8s0i/70hRYE1NWs2kEwEYHNy1H2/45e813ff330cf6e85d8db38d985ad9cc/australia-map)

## One Auth0, three continents

The Auth0 Australia Region joins the [US and EU regions](https://auth0.com/blog/2015/04/27/auth0-europe-launches/) previously available, extending our ability to offer the lowest login latency and allow subscribers to meet and exceed any applicable compliance requirements. Respective to all of the regions in which we operate, Auth0 is committed to following all legislation governing data regulation, privacy and consumer law.

Auth0 subscribers can specify their preferred location by simply choosing from a dropdown when they create a free developer account. Existing subscribers who are running from the US or EU regions and want to switch should just [let us know](https://support.auth0.com) and we’ll help with the migration. Several Auth0 subscribers have already made a quick and successful transition.

![auth0 australia](https://images.ctfassets.net/23aumh6u8s0i/1TD9R5r9f1Xs3jm0HD4jfY/4efd61311d5e176452cda6ffa79a90ca/australia-region)

## Even faster

When you choose a service region closer to where your customers operate, you can experience some great login latency improvements. Subscribers who migrated from the US to the EU Region saw [latency improvements of nearly 2x](https://auth0.com/blog/2015/04/27/auth0-europe-launches/); the same is true for those now migrating to Auth0 Australia.

<include src="TweetQuote" quoteText="Choosing a service region closer to where your customers operate can improve login latency."/>

## We’re here to help

As always, we’d be happy to answer any questions or provide any assistance related to the new Australia region, or anything else. [Open a support ticket](https://support.auth0.com), chat with us at [https://chat.auth0.com](https://chat.auth0.com) or ask anything at ask.auth0.com.

We look forward to hearing from you!


G’day, Mate! Auth0 Australia Launches

Providing an always-on, highly secure identity service is core to the Auth0 brand promise.

Providing an always-on, highly secure identity service is core to the Auth0 brand promise. As such, all our systems, controls and processes have always been designed with security and availability as critical design points.  

Today, we are going one step further and we are pleased to announce that we have achieved SOC 2 Type 1 certification. 





Here are a few examples of what you can read about in the report:

* Auth0 security policies 
* Auth0 encryption protocols for data at rest and in motion
* Auth0 logical and physical access controls
* Auth0 change management process
* Auth0 data backup and disaster recovery strategies
* Auth0 system monitoring, alerts and alarms

Protecting the data and privacy of our customers is a non negotiable aspect of what we do. Our SOC 2 certification provides you with an additional assurance that we have all the right controls in place to protect your data and ensure the availability of our service.

To request a copy of Auth0 SOC 2 report, please email <trust@auth0.com>

Auth0 Achieves SOC 2 Certification

Auth0 SDKs make it really easy to add SSO to any app, on any platform. But sometimes, apps cannot be modified. What to do then? A very simple solution is to

Auth0 [SDKs](https://docs.auth0.com) make it really easy to add [Single Sign On (SSO)](https://resources.auth0.com/definitive-guide-to-single-sign-on/?utm_source=blog) to any app, on any platform. But sometimes, apps cannot be modified. What to do then?

A very simple solution is to front any web content with a web server that itself is capable of negotiating authentication for users. One web server with the extensibility required for plugging-in any auth is Apache server.

In this post, we'll learn how to install and configure `mod_auth_openidc` to work with Apache and Auth0.



##How it works
Apache has [plugable authentication modules](http://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicprovider) that you can use to protect specific routes. One such module is [mod_auth_openidc](https://github.com/pingidentity/mod_auth_openidc) written by [Hans Zandbelt](http://hanszandbelt.wordpress.com/).

> __mod_auth_openidc__ is an authentication/authorization module for the Apache 2.x HTTP server that allows users to authenticate using an OpenID Connect enabled Identity Provider.

When a user first attempts to access protected content behind Apache, the module will first redirect the user to the configured OpenID Connect identity provider. After the user is authenticated, access is granted to the actual resource:

![image](https://images.ctfassets.net/23aumh6u8s0i/4Tz0lvc5MlWvs8ydbEj319/0d3b9e38b264ced1ed6a2f835ad18176/pub_w_811_amp_h_340)

Since Auth0 supports the OpenID Connect protocol (among [many others](https://docs.auth0.com/protocols)), it is straight forward to configure the module with it:

```
OIDCProviderIssuer https://contoso.auth0.com
OIDCProviderAuthorizationEndpoint https://contoso.auth0.com/authorize
OIDCProviderTokenEndpoint https://contoso.auth0.com/oauth/token
OIDCProviderTokenEndpointAuth client_secret_post
OIDCProviderUserInfoEndpoint https://contoso.auth0.com/userinfo

OIDCClientID 3g6d6c..........mXNxkAE
OIDCClientSecret _8sCbkTNhYk4..........8u3mdvRFWBx

OIDCScope "openid email profile"
OIDCRedirectURI https://your_apache_server/example/redirect_uri/
OIDCCryptoPassphrase <password>
OIDCCookiePath /example/

SSLEngine on
SSLCertificateFile /home/your_cert.crt
SSLCertificateKeyFile /home/your_key.key

<Location /example/>
   AuthType openid-connect
   Require valid-user
   LogLevel debug
</Location>
```

##How to configure it

First, you need to [register a new app](https://app.myauth0.com/#/applications/create) in Auth0. You will get a `clientId` and a `clientSecret`. These two go to the `OIDCClientID` and `OIDCClientSecret` params respectively. Then you need to setup SSL certs and define the protected locations (e.g. `/example` in the config file above).

Of course you will have to replace the Auth0 auth URLs with your actual account (__contoso__ is used in the example above).

Any of [Auth0 supported identity providers](https://docs.auth0.com/identityproviders) would work: __Active Directory__, __LDAP__, __ADFS__, __SAML-P__, __custom databases__ or any of the __30+ social providers__. Auth0 will bridge any protocol implemented by these identity systems with OpenID Connect.

It is also very easy to configure a _specific_ connection in Auth0 if you add the `connection` parameter to the `OIDCProviderAuthorizationEndpoint` parameter:

```
OIDCProviderAuthorizationEndpoint https://contoso.auth0.com/authorize?connection=linkedin
```

Users will be sent directly to LinkedIn for authentication in this case.

That's it!

[Want to learn more about Single Sign-On? Get The Definitive Guide on SSO (74-page free eBook) here.](https://resources.auth0.com/definitive-guide-to-single-sign-on/?utm_source=blog)

SSO for Legacy Apps with Auth0, OpenID Connect & Apache

A few days ago we released integration between Auth0 and New Relic. You can now login to New Relic with your Github, Google, Amazon, Twitter, Active Directory

A few days ago we released integration between [Auth0](http://developers.auth0.com/newrelic) and [New Relic](http://newrelic.com/auth0). You can now login to New Relic with your Github, Google, Amazon, Twitter, Active Directory or LDAP accounts. [See here for a complete list of supported identity providers in Auth0](http://docs.auth0.com/identityproviders): Consumer and Enterprise.

As with other integrations we have published, setup takes just a few minutes and it is straight-forward:

### Add New Relic from the dashboard:

![](https://images.ctfassets.net/23aumh6u8s0i/29zM6x62oj9AjgSzxKSdrr/03590a98d87624844943f67fb8ff52b0/newrelic-create)



### Enter your New Relic Account and follow a few simple steps:

![](https://images.ctfassets.net/23aumh6u8s0i/6lsrh4GtJ6KwldsocrXQEb/00af68613b1a83c262eda897b1bc7c51/newrelic-tutorial)

Here's a quick end to end demo that shows login into New Relic with a Github account (use full screen):

<iframe width="710" height="399" src="//www.youtube.com/embed/pmMkm0Zh2o0?rel=0&vq=hd1080" frameborder="0" allowfullscreen></iframe>

And the best news: __New Relic integration is free for all our editions.__

[Try Auth0 yourself!](https://auth0.com)

SSO with New Relic

We are very excited to announce the release of the Auth0 Component for Xamarin. As with the other SDKs we released (and available on Github)


We are very excited to announce the release of the [Auth0 Component](http://components.xamarin.com/view/Auth0Client/) for Xamarin. As with the other SDKs we released (and [available on Github](http://github.com/auth0)), its goal is to streamline authentication with any of our [supported identity providers](http://docs.auth0.com/identityproviders). Consumer or Enterprise.

![](https://assets.ctfassets.net/23aumh6u8s0i/4VJXbZvHF4tYhc6O83Yqi5/109a72edc6de43f358f0979ee9edabd6/Auth0-Xamarin-iOS-602-400-slideshow-resize)

The API is straight forward and very easy to use. It works with iOS and Android:

```
    var auth0 = new Auth0Client(
        "{subDomain}",
        "{clientID}",
        "{clientSecret}");

     auth0.LoginAsync (this)
           .ContinueWith(t => {
              var facebook_token = t.Result.Profile["identities"][0]["access_token"];
              var email = t.Result.Profile["email"].ToString();
 	          });
```

The code above will display the [Auth0 login widget](https://docs.auth0.com/login-widget) as seen in the picture above.

It is delivered as a [component](http://components.xamarin.com/), so you can get it straight into Xamarin Studio.

What you get back after login is the [normalized user profile](https://docs.auth0.com/user-profile) and [Json Web Token](https://auth0.com/learn/json-web-tokens/) you can use to authenticate calls with your API.

Here's a quick end to end demo (use full screen):

<iframe width="700" height="315" src="//www.youtube.com/embed/7enbd_BQRdE?rel=0&vq=hd1080" frameborder="0" allowfullscreen></iframe>

Last but not least, if you have **Windows Azure Mobile Services** enabled in Auth0, then you can use the token to call WAMS endpoints with no changes or additional code. Auth0 will generate [the right JWT](https://docs.auth0.com/jwt#5) for you.

We want to thank the folks at Xamarin for their support and great experience!

The sample image was generated with the awesome [placeit](http://placeit.breezi.com/).

[Try Auth0 yourself!](https://auth0.com)


Xamarin Component just released

You probably noticed that we are adding apps at a very fast pace. This past week we added SpringCM and EchoSign.

You probably noticed that we are adding apps at a very fast pace. This past week we added [SpringCM](http://www.springcm.com) and [EchoSign](http://www.echosign.com). And we have a few more in the pipeline, as customers request them. There's no magic here, and we are a small team. So, how we do it? The secret is that it really takes very little effort. Auth0 ships with a generic __SAML App__ that is completely configurable:

![](https://images.ctfassets.net/23aumh6u8s0i/5gryzbD9bCDQz8nMENZoz4/07006ec99cc55807d25b3928e9f9b22c/saml2-config)

Supported apps like Box, Dropbox, Zendesk, Salesforce, SpringCM, EchoSign, etc. are just _templates_ to simplify and streamline configuration. But they are not strictly needed.

###Any app that supports __SAML__ is automagically supported by Auth0.

The integrations that have taken longer to publish, are with those companies that have chosen not to offer a self-service experience, and require us to call their support and enable/setup the feature for us. Human intervention adds a lot of latency in the process.

> Special kudos to [SpringCM](http://www.springcm.com) and [EchoSign](http://www.echosign.com) for a fantastic onboarding experience and great support.



##Setup

Configuring a SAML aware app is usually a matter of tweaking a few parameters. We've chosen to surface these as a Json object that you can edit online:

![](https://images.ctfassets.net/23aumh6u8s0i/2RR5VG7cYH4AR0JFBuSAPL/c66d0885a484e42bc7491fe0f1782aca/saml2-config-param)

We've even included an online __SAML debugger__ that shows exactly the `SAMLResponse` (encoded and decoded) that we generate. One step forward in simplifying troubleshooting of integrations. When you click on __Debug__, we will initiate the authentication process to whatever identity providers you have configured. After successful authentication we will return and display the result:

![](https://images.ctfassets.net/23aumh6u8s0i/3a2JzhvpM5xyp9WlyNzUAK/1e05595a27b1d83921100077844ee4fb/saml-debugger)

You can easily look for attributes, mappings, signatures and other SAML artifacts to quickly identify mis-configurations.

So, if you don't see the app you need on our list, fear not! Use this feature or let us know:
[open a support ticket](https://support.auth0.com)

[Try Auth0 yourself!](https://auth0.com)

[Want to learn more about Single Sign-On? Get The Definitive Guide on SSO (74-page free eBook) here.](https://resources.auth0.com/definitive-guide-to-single-sign-on/?utm_source=blog)

SSO with any SAML App

Another great app is added to the Auth0's portfolio. You can now setup SSO with Box. As usual, it will take just a few, very simple steps.

Another great app is added to the Auth0's portfolio. You can now setup SSO with [Box](http://www.box.com). As usual, it will take just a few, very simple steps.

Any of our [supported Identity Providers](https://docs.auth0.com/identityproviders) would work of course, including Active Directory, LDAP, SQL, Google Apps, Office365, or any social ones.

##How does it work?

As many others, Box implements the SAML Protocol for authentication and identity federation. Auth0 bridges SAML-P with whatever your preferred Identity Provider implements: SAML, OAuth 1, OAuth 2, LDAP, a SQL database, __anything__.



##Setup

Configuring Box in Auth0 takes just a single checkbox. That's all!

![](https://images.ctfassets.net/23aumh6u8s0i/5gNEbLVzuq5qPXuKB7MDnW/7a26b4b83c9d1de65c856122c329ed95/3sjU4)

You will need to contact Box support team to enable SAML on your account. To make things simpler for you, you will find all the information they will request from you on the Auth0 Dashboard:

1. The signing certificate.
2. The EntityID.
3. The claim that identifies your users.
4. The redirectURL.

Once configuration is completed on their side, you are done!

We want to thank Arif Shenoy, Nick Lee & Weisen Li from Box, for their help, and great support.

[Try Auth0 yourself!](https://auth0.com)

SSO with Box

A new sample is now available on our repo for Android developers. The sample demonstrates integration with Auth0 for authentication

A new sample is now available on [our repo](https://github.com/auth0/Auth0-Android-Sample) for Android developers. The sample demonstrates integration with Auth0 for authentication and uses the standard techinque of delegating the authentication process to an embeded web view (extending the `WebViewClient` class).

All interactions are encapuslated in an `Activity` that you can call like in this example below:

    Button login = (Button) findViewById(R.id.login);
    login.setOnClickListener(new View.OnClickListener() {
        public void onClick(View v) {
            Intent authActivity = new Intent(MainActivity.this,
                    com.auth0.sdk.auth0sample.AuthenticationActivity.class);

            AuthenticationActivitySetup setup;
            setup = new AuthenticationActivitySetup(Tenant, ClientID, Callback, Connection);

            authActivity.putExtra(AuthenticationActivity.AUTHENTICATION_SETUP, setup);

            startActivityForResult(authActivity, AuthenticationActivity.AUTH_REQUEST_COMPLETE);
        }
    });



The result is returned using the standard method of overriding the `onActivityResult` method:

    @Override
    protected void onActivityResult(int requestCode, int resultCode, Intent authActivityResult) {
        super.onActivityResult(requestCode, resultCode, authActivityResult);

        switch(requestCode)
        {
            case AuthenticationActivity.AUTH_REQUEST_COMPLETE:
                if(resultCode==RESULT_OK)
                {
                    AuthenticationActivityResult result;
                    result = (AuthenticationActivityResult) authActivityResult.getSerializableExtra(AuthenticationActivity.AUTHENTICATION_RESULT);

                    ((TextView) findViewById(R.id.access_token)).setText(result.accessToken);
                    ((TextView) findViewById(R.id.jwt)).setText(result.JsonWebToken);
                }
                break;
        }
    }

The `AuthenticationActivityResult` class is just a container for the two tokens you can use to call APIs:

    public class AuthenticationActivityResult implements Serializable {
        public String accessToken;
        public String JsonWebToken;
    }

If your app in Auth0 is created as __Windows Azure Mobile Services__:

![](https://images.ctfassets.net/23aumh6u8s0i/11pfRkwRbhDV4tofatoZ37/6c608fe4355f26f0cb367692693f7f41/3kCLH)

Then the [_Json Web Token_](https://auth0.com/learn/json-web-tokens/) will be compatible with what __Mobile Services__ expects. See [this previous](http://blog.auth0.com/2013/03/17/Authenticate-Azure-Mobile-Services-apps-with-Everything-using-Auth0/) post for more details.

An end to end tutorial is available [here](https://docs.auth0.com/android-tutorial).

> We are working on a similar sample using Xamarin. Stay tuned!

[Try Auth0 yourself!](http://developers.auth0.com)

A New Android Sample

Мы очень рады сообщить, что мы недавно добавили в Auth0 поддержку аутентификации в вКонтакте! Теперь пользователь может использовать свой вКонтакте логин для

Мы очень рады сообщить, что мы недавно добавили в Auth0 поддержку аутентификации в вКонтакте! Теперь пользователь может использовать свой вКонтакте логин для входа в любое из поддерживаемых Auth0 приложений, включая SharePoint, Salesforce, RMS, Azure Mobile Services, Dropbox, Zendesk или специально-разработанных приложений в .NET, Java, Node, Ruby и т.д.



Достаточно просто подключить Auth0 к вКонтакте. Вы найдёте все настройки под __Social Connections__:

![](https://images.ctfassets.net/23aumh6u8s0i/1uYdM5FoY72bKzjoRbaNHv/740c811d61244d3920a4d528c36599ec/vk-social)

Единственное, что необходимо, так это __Application Id__ и a __Secret Key__, которые нужно получить от вКонтакте.

Также в Auth0 поддерживаются уровни разрешений и доступа вКонтакте (к примеру, видео, фото, стена), так что Вы можете запросить соответствующий уровень доступа для Вашего приложения:

![](https://images.ctfassets.net/23aumh6u8s0i/5fRSMG54pgFJUGAfJpDRNH/27d5cd0e9b7ece2b178ffa60d7837ab0/vk-scopes)

[Попробуйте Auth0 сейчас!](https://auth0.com)

"eu"