GDPR compliant authentication for your product
GDPR compliant authentication means that the part of your product that signs users in treats their personal data the way the regulation asks: it keeps the data where you said it would be, and it lets you hand it over or erase it when a user asks. The Skycloak Platform is planned so that sign-in gives you those controls without your team building them.
What the GDPR asks of a sign-in system
A sign-in system holds some of the most personal data in your product: names, contact details, password hashes and a record of where and when each person signed in. Under the GDPR you are the controller of that data, and the company that runs your sign-in is your processor, so its contract, its locations and the other companies it relies on become part of your own compliance.
No product makes you compliant by itself, because compliance depends on how your whole product uses personal data. What a sign-in provider can do is give you the controls the regulation expects: a choice of where the data lives, a way to give a user their data, a way to delete it, and a clear list of everyone else who touches it.
Where your users' data lives
On the Platform's plan, each tenant runs in the United States or in the European Union, and its region is fixed when you create it. A tenant in the EU region is planned to keep its users, their credentials and their sign-in records in the EU, in a database that runs in Germany.
In that design every record carries its region, and nothing joins data across regions. The console you will use to manage your tenants holds no end-user data, and sign-in in a region keeps working even when the console cannot be reached.
Export, deletion and the paperwork
The Platform's planned Management API covers your users, so a request to see or erase one person's data can be handled from your own support tools instead of by hand. A tenant's export is planned to run inside that tenant's own boundary, so it can never read another customer's data.
Skycloak signs a data processing agreement, with standard contractual clauses for international transfers, and its subprocessors page lists every company that processes data on its behalf. We describe a Platform feature as available only once it has shipped, so a demo is the place to see what you can use today.
Frequently asked questions
Can I move a tenant from the US region to the EU region later?
No. On the Platform's plan, a tenant's region is fixed when you create it, so choose the EU region from the start for users whose data should stay in the EU. A workspace can hold several tenants, so you can run one per region if your users are spread across both.
Does using an EU tenant make my product GDPR compliant?
It covers where sign-in data is stored and processed, which is one part of compliance. Your lawful basis, your privacy notice and the rest of your product's data handling remain your responsibility as the controller.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.