# Security Certifications

Auth0 maintains compliance with major security standards and industry certifications, providing assurance for enterprise and regulated industry deployments.

## Security Standards

### ISO 27001

Information Security Management System (ISMS)

Scope:
- Comprehensive security management
- Risk assessment and treatment
- Security controls implementation
- Continuous improvement

Verification:
- Annual independent audits
- Certification renewal
- Continuous compliance

Benefits:
- Internationally recognized
- Systematic security approach
- Risk-based framework

### ISO 27017

Cloud Security Controls

Scope:
- Cloud-specific security controls
- Shared responsibility guidance
- Cloud service provider requirements

Additional to ISO 27001:
- Cloud-specific extensions
- Provider/customer responsibilities
- Cloud security best practices

### ISO 27018

Protection of Personal Data in Cloud

Scope:
- Personal data protection
- Privacy controls
- Cloud processing requirements

Focus Areas:
- PII protection
- Transparency
- Customer control
- Data handling

### SOC 2 Type 2

Service Organization Controls

Trust Services Criteria:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy

Type 2 Significance:
- Tests over extended period
- Operating effectiveness verified
- Not just point-in-time

Audit Cycle: Annual

Access: Report available to customers under NDA

### CSA STAR

Cloud Security Alliance Security Trust Assurance and Risk

Features:
- Cloud security assessment
- Transparency registry
- Industry-recognized

Assessment Type:
- Self-assessment (Level 1)
- Third-party audit available

Access: Publicly available self-assessment

## Industry-Specific Certifications

### FAPI (Financial-grade API)

OpenID Foundation Certification

Certified Profiles:
- FAPI 1.0 Advanced OP
- mTLS client authentication
- Private Key JWT authentication

Purpose:
- Financial services security
- Open banking compliance
- High-security applications

Requirements Met:
- Strong authentication
- Sender-constrained tokens
- Secure authorization

### HIPAA/HITECH

Health Insurance Portability and Accountability Act

Auth0 Role: Business Associate

Features:
- BAA available upon request
- Technical safeguards implemented
- Required controls in place

Customer Requirements:
- Execute BAA with Auth0
- Implement required controls
- Maintain compliance program

### PCI DSS

Payment Card Industry Data Security Standard

Coverage:
- Compliant deployment models
- Security controls documented
- Customer guidance available

Customer Responsibility:
- Follow Auth0 guidance
- Implement required controls
- Maintain own compliance

## Regional Compliance

### GDPR

General Data Protection Regulation (EU)

Status: GDPR ready

Features:
- Data processing documentation
- User rights support
- Data export capabilities
- Deletion support

Role: Data Processor (customer is Data Controller)

### Privacy Regulations

Various jurisdictions:
- CCPA (California)
- Regional privacy laws
- Industry-specific requirements

Support:
- Privacy controls
- Data handling documentation
- Compliance features

## Compliance Access

### Auth0 Support Center

Available Materials:
- Certification certificates
- Audit reports (under NDA)
- Compliance documentation
- Security questionnaires

Access Requirements:
- Customer account
- Appropriate access level
- NDA where required

### Available Documents

Upon Request:
- SOC 2 Type 2 report
- ISO certificates
- Penetration test summary
- Security questionnaire responses

## Verification

### Third-Party Audits

Audit Providers:
- Independent auditors
- Recognized firms
- Annual assessments

Scope:
- Controls testing
- Compliance verification
- Continuous monitoring

### Certification Maintenance

Continuous Compliance:
- Ongoing control operation
- Regular internal audits
- Gap remediation
- Certification renewal

## Customer Benefits

### Risk Reduction

Using Certified Platform:
- Proven security controls
- Regular audits
- Known security posture
- Reduced assessment burden

### Compliance Support

For Customer Compliance:
- Inherit platform compliance
- Documented controls
- Audit evidence
- Compliance mapping

### Due Diligence

Vendor Assessment:
- Certification evidence
- Audit reports
- Security documentation
- Risk assessment support

## Best Practices

### Leveraging Certifications

For Your Compliance:
- Reference Auth0 certifications
- Request relevant reports
- Map to your requirements
- Document in your assessments

### Compliance Documentation

Maintain Records:
- Auth0 certification copies
- Shared responsibility documentation
- Configuration evidence
- Compliance mapping

### Regular Review

Annual Activities:
- Review Auth0 compliance status
- Update certifications
- Verify continued compliance
- Update documentation

## Requesting Documentation

### Process

1. Log in to Auth0 Support Center
2. Navigate to compliance section
3. Request specific documents
4. Execute NDA if required
5. Access documentation

### Contact

For specific compliance questions:
- Auth0 Support
- Account team
- Security team
