adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

If your organization stores customer data in the cloud, SOC 2 compliance is table stakes.

In the last two years alone, cloud-based cyberattacks[ more than doubled](https://www.trustwave.com/en-us/resources/library/documents/2020-trustwave-global-security-report/) — even though SaaS spending[ grew just 18%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/). 

While these numbers are merely a correlation from a statistical standpoint, it does indicate that if your business stores customer data in the cloud, it’s more important than ever for your business to take measures to secure that data. Especially given SaaS spending is[ expected to increase an additional 36%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) between 2020 and 2022. 

A SOC 2 certification from the AICPA is a foundational step that will help every service provider reduce security risks. Below is a guide to SOC 2 compliance requirements and certification.

## What Is SOC 2?

SOC 2 is an independent audit report that evaluates the security controls a tech service business uses to protect the data they process in the cloud. Possession of a SOC 2 report is considered table stakes in the SaaS industry, as the answers to most security questions a customer may have about their business’s security posture can usually be pulled from this report.

### SOC 1 vs. SOC 2 vs. SOC 3

“SOC” stands for “System and Organization Controls” and was created by the American Institute of Certified Public Accountants (AICPA). SOC 2 is one of three SOC reports, each with different purposes and/or levels of transparency:

1. **SOC 1.** Used to audit internal controls relevant to a customer’s financial systems. Report usage is “restricted,” meaning its use is limited to auditors, the service organization, and authorized users.
2. **SOC 2.** Used to audit the overall management of customer data. Report usage is also “restricted” the same way SOC 1 is.
3. **SOC 3.** The same as SOC 2, but the report is simplified and publicly available to increase transparency.

![What Is SOC 2](https://images.ctfassets.net/23aumh6u8s0i/5LsphelbdnIZtLBd7NOrZQ/3e05f625deb2ff6588f9bffbf2dc3449/sep_compliance_02.jpg)

## Why SOC 2 Compliance Matters

SOC 2 compliance isn’t a legal requirement for a tech business. However, having a SOC 2 report is a common compliance objective for service providers that store their customers’ data in the cloud because it’s a necessity from an assurance (and therefore[ competitive](https://www.forbes.com/sites/forbesbusinesscouncil/2019/10/09/using-cyber-security-as-a-competitive-advantage/?sh=260c85237ff7)) perspective.

For many small to medium-sized operations that store marginally-sensitive data (for example, information that’s already publicly available), a SOC 2 report usually provides enough assurance of their controls and procedures to their customers. 

However, for businesses whose data is considered[ sensitive](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en) (health data, for example), a SOC 2 report is the minimum a business should have in order to assure their customers they’ve taken steps to protect their data.

![Why SOC 2 Compliance Matters](https://images.ctfassets.net/23aumh6u8s0i/2gAtMudqliW2LiC3h7imD9/db7be0b8025f315b137a7744e7d5d469/sep_compliance_03.jpg)

## The SOC 2 Certification Process

SOC 2 certification is completed by a third-party auditor who assesses the extent in which service provider’s controls comply with one or more of SOC’s five Trust Services Criteria (TSC): Security, Privacy, Confidentiality, Processing Integrity, and Availability.

SOC 2 is different from other security certifications because it lets each business decide how best to implement the SOC 2 framework. The auditor evaluates how well the business has implemented controls relative to each of the TSC and its operations and gives their opinion of overall effectiveness.

The auditor then compiles their opinion and findings into a report (the SOC 2 Report) you can then use to assure your customers of the steps you’ve taken to manage their data.

The SOC 2 Report comes in two different types (Type 1 and Type 2), and each has an impact on how the certification process proceeds. However, since each requires an evaluation of your practices against the five Trust Services Criteria (TSC), we’ll address those first and explain how each of the report types affects certification in more detail afterward.

### SOC 2 Trust Services Criteria

Tech service businesses can choose to certify in as many or as few of the TSC as they like. Most businesses choose to earn a certification for one to three of the criteria. However, businesses that process sensitive data will benefit from earning certification in all five.

Below is what earning certification in each of the SOC 2 Trust Services Criteria entails:

1. **Security.** An evaluation of both the electronic and physical controls a business uses to protect the customer data they process. Auditors will examine security measures, like, network security, vulnerability management, and security monitoring, as well as the steps you’ve taken to secure any access to the physical devices and locations your customers’ data, is stored on in order to prevent unauthorized access.
2. **Privacy.** An evaluation of how a service business collects and uses customer data. Auditors will compare a company’s privacy policy(ies) to the actual operational procedure(s) to ensure they’re in alignment with the AICPA’s Privacy Management Framework ([PMF](https://www.aicpa.org/interestareas/informationtechnology/privacy-management-framework.html)).
3. **Confidentiality.** An evaluation of how data is stored, accessed and shared. Auditors will examine the procedures and access controls you have in place to restrict who has access to customer data, as well as any technical measures, like encryption, you’ve implemented to keep data safe.
4. **Processing Integrity.** An evaluation of your quality assurance and processing-monitoring practices. Auditors will examine whether data is called from your servers in the same state it was stored — and that it’s only called for the people who are authorized to access it.
5. **Availability.** An evaluation of whether your customers have access to your system as outlined in their contractual agreement(s). Auditors will examine controls and procedures-performance monitoring, business continuity, disaster recovery, and incident management to ensure they match what was promised.

![SOC 2 Certification Process](https://images.ctfassets.net/23aumh6u8s0i/3lefYYa9FsqqIVecGGpIlV/88a934fa5d9dbb876787096be7536747/sep_compliance_04.jpg)

## The SOC 2 Report

Once an auditor completes their evaluation of the security measures you’ve implemented, you’ll receive either a SOC 2 Type 1 Report or a SOC 2 Type 2 Report (depending on which you chose to certify for). Both reports contain an explanation of everything you’ve done to keep your customers’ data safe:

1. The controls you’ve implemented
2. How they align with the Trust Services Criteria
3. An explanation of your company’s operations
4. How the auditing process was conducted
5. How you’ve implemented controls to secure the user environment

However, the differences between each report type mean that obtaining a SOC 2 Report can create a substantial increase in the effort and work required to comply.

### SOC 2 Type 1 Report

A SOC 2 Type 1 Report is an evaluation of the design of your controls at a specific moment in time. This means the certification process required for a Type 1 Report can occur relatively quickly (in the time it takes for an auditor to evaluate your systems and procedures).

### SOC 2 Type 2 Report

A SOC 2 Type 2 Report is an assessment of the operational effectiveness of your controls. The evaluation is done over a period of time to observe how effective those controls are in practice instead of just at one specific moment, as in a Type I Report.

A SOC 2 Type 2 Report typically requires months of auditing to obtain. But the increase in assurance it provides is often worth it for service organizations that process sensitive data. Traditionally a SOC-2 Type 2 covers a 6-12 month period. 

![Additional Security Certifications That Are Worth Pursuing](https://images.ctfassets.net/23aumh6u8s0i/Xb8Z3o1JWLQE9ZlM2vcQw/303397e92ee5a143b23112d7f055e4cb/sep_compliance_01.jpg)

## Additional Security Certifications That Are Worth Pursuing

A SOC 2 Report helps you demonstrate a baseline of security to your customers, and the more Trust Service Criteria you certify for, the more assurance you can provide (it’s why Auth0 meets all 5). 

But given[ the rate](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf) at which cloud-based cyberattacks are increasing in the wake of the pandemic (and[ the average cost of a data breach](https://auth0.com/blog/what-is-data-security/) across most industries), doing more than the minimum to secure your customers’ data is in your best interest.

Auth0 has earned certifications in several additional information security frameworks for this reason. We’ve created guides to earning certification with the ones we’re experienced with via the links below:

* **[ISO/IEC 27001](https://auth0.com/blog/auth0-achieves-iso-27001-certification/).** The International Organization for Standardization’s framework for building an information security management system (ISMS).
* **[ISO/IEC 27018](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/).** The International Organization for Standardization’s cloud-specific controls that cloud-based businesses should follow when certifying for ISO 27001.
* **[CSA STAR](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/).** The Cloud Security Alliance (CSA) offers some of the most relevant and cutting-edge controls for cloud security in the industry.

Learn more about how Auth0’s IDaaS platform can help you better secure and scale your authentication process[ here](https://info.auth0.com/video-platform-overview.html?_ga=2.10769394.753376883.1611345990-439625938.1611345989).

SOC 2 Compliance and Certification: What SaaS Businesses Need to Know

Learn how to accelerate your sales cycle through the CSA STAR Program.

The pandemic [accelerated the adoption of cloud-based technology](https://www.pwc.com/us/en/industries/tmt/library/covid19-cloud-infrastructure.html) and brought a sharp increase in cloud-based cyberattacks with it &mdash; 630% between January and April of 2020 alone, according to [a report by McAfee](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf). And since cloud usage is expected [to continue to increase](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) well beyond the pandemic, taking additional steps to reduce security risks will be essential to protect the data you process in the future.

Earning a certification from the Cloud Security Alliance (CSA) STAR Program is an effective way for cloud service providers to reduce the [security risks](https://www.mcafee.com/blogs/enterprise/cloud-security/9-cloud-computing-security-risks-every-company-faces/) that cloud computing often introduces because few organizations offer more relevant or powerful controls than the CSA.

As a cloud service provider, Auth0 has been through the STAR certification process and [earned a certification](https://auth0.com/blog/auth0-achieves-gold-csa-star-certification/). Below is what you need to know about the STAR Program and how to earn a certification.

## What Is a CSA STAR Certification?

A CSA Security, Trust, Assurance, and Risk (STAR) certification is a powerful third-party attestation of a cloud service provider’s security practices. A cloud service provider that earns a STAR certification can assure their customers that they’re using industry-leading best practices to secure data in cloud applications.

The CSA’s STAR Program combines the controls and best practices laid out in other information security standards (ISO/IEC 27001:2013, for example) with the CSA’s own [Cloud Controls Matrix](https://cloudsecurityalliance.org/research/cloud-controls-matrix/) (or CCM, their proprietary cybersecurity control framework that covers all aspects of cloud technology) to create one of the most comprehensive cloud security control sets in the industry.

Being STAR-certified is not as important as being [GDPR-compliant](https://auth0.com/docs/compliance/gdpr), for instance (or being compliant with other data privacy regulations like GDPR). However, since its controls map back to global information security standards and regulations, being STAR-certified does help reduce audit complexity for many organizations, in addition to helping them better secure their data.

## The Benefits of a CSA STAR Certification

A CSA STAR Certification means the data you process is protected using a security framework designed specifically for cloud computing. Simply put, this reduces security risks for everyone involved &mdash; cloud service providers (CSPs), their customers, and the owners of the data.

Below are specific benefits that both CSPs and their customers will also gain through certification (or working with a STAR-certified provider).

### Benefits For Cloud Service Providers

For cloud service providers, earning a STAR certification demonstrates to your customers that your business is a mature security organization. [This is a competitive advantage](https://home.kpmg/xx/en/blogs/home/posts/2019/09/cyber-as-a-competitive-advantage.html) for you within your market and helps you grow your business in two main ways:

1. **It helps accelerate your sales cycle**. A rigorous third-party assessment of your security practices by the CSA or certified third-party auditors helps reduce the work corporate security teams need to do in order to sign off on a new partnership.
2. **It helps you find new business faster**. Once your business is certified, it is included in the [STAR Registry](https://cloudsecurityalliance.org/star/registry/), where potential customers can quickly find cloud service providers that adhere to the STAR Program’s controls (more on the registry here).

### Benefits For Cloud Service Customers

Since the STAR Program increases transparency into the security practices of any business that has earned certification, it helps would-be CSP customers quickly find a provider that offers the level of security assurance their business needs.

It also helps existing CSP customers ensure better alignment on security practices between them and their CSPs, simplifying the process of building an effective Governance, Risk, and Compliance ([GRC](https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html)) program.

## CSA STAR Certification Levels

The CSA STAR certification is [divided into three levels](https://cloudsecurityalliance.org/star/levels/), each providing CSPs with the ability to offer a greater degree of transparency and assurance than the level before it.

Levels 1 and 2 also offer a continuous certification that organizations can obtain, as well (Level 3 is a continuous certification), in order to provide additional transparency to their customers through periodic self-assessment.

### CSA STAR Level 1

A Level 1 certification is a freeway for any CSP to provide their customers with the security assurances that a STAR certification offers. To earn a Level 1 certification, cloud service providers must self-assess their security practices and controls against the CSA’s best practices (using either the Consensus Assessments Initiative Questionnaire [[CAIQ](https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-1/)] or the Cloud Controls Matrix) and send their assessment to the CSA for verification.

According to the CSA, a Level 1 STAR certification is best for CSPs that are “operating in a low-risk environment” and need a cost-effective way to document their security controls for their customers.

Certification is an annual process. However, businesses that update their self-assessment every 30 days are eligible for a STAR Continuous Level 1 Certification, which helps them assure their customers that CSA controls are always being followed (not just when it’s time for certification).

### CSA STAR Level 2

CSA STAR Level 2 helps cloud service providers offer more transparency and assurance than Level 1 in two ways. First, it requires an assessment of a CSP’s security controls to be completed by a CSA-certified third party ([a list of which they maintain on their website](https://cloudsecurityalliance.org/star/certified-star-auditors/)).

Second, it’s designed to enhance the security controls of other standards and certifications that a CSP might follow (ones that are industry or geographically specific to their business) for the cloud. This means there are a number of ways a cloud service provider could earn a “certification” for Level 2, depending on the other standards they already follow:

1. **AICPA SOC 2 → CSA STAR Attestation**. Adding the CSA’s Cloud Controls Matrix to those you’ve implemented for the American Institute of Certified Public Accountants’ (AICPA) SOC 2 Report helps you make SOC 2 controls more robust and earns your business a CSA STAR Attestation.
2. **ISO/IEC 27001 → CSA STAR Certification**. If you follow the controls laid out in ISO 27001, adding the controls from the CSA’s Cloud Controls Matrix helps you make your information security management system cloud-specific and earns your business a CSA STAR Certification.
3. **GB/T 22080-2008 → CSA C-STAR Assessment**. For businesses that operate in China, adding the controls from the CSA’s Cloud Controls Matrix to the controls laid out in the GB/T 22080-2008 management system, as well as 29 additional controls from both GB/T 22239-2008 and GB/Z 28828-2012 standards earn your business a CSA C-STAR Certification.
4. **GDPR → GDPR Code of Conduct Certification**. If you’re complying with GDPR, adding the controls from the CSA’s Cloud Controls Matrix helps you offer cloud-specific security assurance in addition to those required by the GDPR and earns your business the GDPR Code of Conduct Certification.

A **CSA Level 2 Continuous Certification** is also available for businesses that have earned either an Attestation or Certification and complete a self-assessment every 30 days in the same way that is required for a Level 1 Certification.

CSA Level 2 is best for organizations that are already following one of the standards or regulations listed above or operate in a risk environment where the independent assurance that a third-party assessment offers would be beneficial.

### CSA STAR Level 3

Where STAR Levels 1 and 2 offer a continuous option to increase transparency and assurance through periodic self-assessment, CSA STAR Level 3 takes “continuous” one step further by automating the process of validating security control effectiveness in real-time.

According to the CSA’s website, STAR Level 3 is listed as “Coming Soon,” which indicates that it’s not officially available for certification at the moment. However, the CSA explains that continuous assessment will be achieved through real-time data collection from “monitoring tools like log analytics, network statistics, and monitoring, process statistics or resource utilization.”

Given the complexity of continuous monitoring, STAR Level 3 certification will be best for businesses that operate in high-risk environments.

## The CSA STAR Registry

The STAR Registry is a public record of cloud service providers that use the STAR Program’s controls and have earned certification. The registry [is located on the CSA’s website](https://cloudsecurityalliance.org/star/registry/) and allows anyone to download a copy of a certification that a cloud service provider has achieved:
 
![Cloud Services by Auth0](https://images.ctfassets.net/23aumh6u8s0i/6kS2dCnNm1lGATz3WDCDZQ/932b562fd88832b074048c21ff5c978a/cloud-services-by-auth0)

From a business perspective, the STAR Registry helps cloud service providers market themselves directly to customers that need the type of assurance and transparency that the STAR Program offers. The registry also provides CSP customers with the ability to submit a request for the CSA to [verify a specific provider’s certification](https://cloudsecurityalliance.org/artifacts/star-provider-verification-template/) if they do not see them on the registry.

## How Much Is Data Security Worth to Your Business?

The average [data breach costs $3.86M](https://www.ibm.com/security/data-breach), and the damage to your brand often lasts [for years to come](https://auth0.com/blog/what-is-data-security/). So the more you can do to reduce the security risks associated with cloud computing, the better off your business will be.

Following the CSA’s STAR Program (or working with a STAR-certified service provider) is [an effective way](https://www.bsigroup.com/en-IN/CSA-STAR-Certification/CSA-STAR-Certification-Case-Studies/) to reduce the risk of a data breach for both cloud service providers and their customers. And the transparency a STAR certification offers makes it easier for CSPs and their customers to keep data safe together.

Auth0’s [IDaaS](https://auth0.com/blog/what-is-idaas/) platform is [STAR Level 2 certified](https://cloudsecurityalliance.org/star/registry/auth0/) and can help you simplify the controls you need to implement to improve both the security and user experience of the authentication process. [Learn more about Auth0 here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The CSA STAR Program: A Business Guide to Certification

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

After surpassing rigorous evaluation,  Auth0 has achieved the highest level of Gold for the Level 2 audit.

**BELLEVUE, Wash., – December 4, 2018 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has achieved Gold CSA Star certification from the [Cloud Security Alliance (CSA)](https://cloudsecurityalliance.org/), signifying that the company has surpassed rigorous third party independent assessment of its security as a cloud service provider.

CSA STAR is the industry’s most powerful program for security assurance in the cloud. There are 11 controls areas that dictate certification level, including compliance, data governance, facility security, human resources, information security, legal, operations management, risk management, release management, resiliency, and security architecture. Auth0 has achieved the highest level of Gold for the Level 2 audit. 

“In this predominantly cloud-centric environment, it is critical that companies can rest assured that their vendors have gone through all of the steps necessary to be as secure as they can be,” said Joan Pepin, CISO and VP of Business Operations at Auth0. “We are pleased to have achieved this level of CSA STAR certification and will continue to invest in standards like these to provide the most secure solution possible.” 

Auth0’s CSA STAR certification can be downloaded from the CSA Registry here: 
[https://cloudsecurityalliance.org/star/registry/auth0/](https://cloudsecurityalliance.org/star/registry/auth0/). For more information about Auth0’s approach to security, please visit: [https://auth0.com/security](https://auth0.com/security).

<include src="asides/AboutAuth0" />

## **Media Contacts:**
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Auth0 Achieves Gold CSA STAR Certification

Data security is top priority for Auth0. Introducing our latest information security certification: ISO 27001.

**BELLEVUE, Wash. -- July 31, 2018 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has achieved ISO 27001:2013 and ISO 27018:2014 certification, signifying Auth0’s ongoing commitment to providing its customers with the highest standards for information security. These certifications provide a more comprehensive way for Auth0’s customers to address their own privacy and security requirements.

ISO 27001 is a globally recognized standard and code of practice to ensure proper implementation of an Information Security Management System (ISMS). The standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented ISMS within the context of the organization’s overall business risks. It sets forth a risk-based approach that focuses on adequate and proportionate security controls that protect information assets and give confidence to interested parties. Auth0's certification is an independent testament of compliance to these rigorous standards by a certified third party.

"The time and investment it takes to gain these important certifications is completely worthwhile since they give us the ability to service our customers even better," said Joan Pepin, CISO and VP of Operations at Auth0. "The addition of ISO 27001 and 27018 gives customers assurance that Auth0 is complying to an internationally-accepted information security framework." 

The certification was performed by Schellman & Company, LLC, an ANAB and UKAS accredited Certification Body based in the United States. Details of ISMS certification are publicly available at [https://www.schellman.com/certificate-directory](https://www.schellman.com/certificate-directory).

For more information about Auth0’s approach to security, please visit: [https://auth0.com/security](https://auth0.com/security). 

## About Schellmann

Schellman & Company, LLC is a leading national provider of attestation and compliance services - and the only company in the world that is a CPA firm, an ANAB and UKAS accredited ISO Certification Body, a globally licensed be PCI Qualified Security Assessor Company, a HITRUST assessor, and a FedRAMP 3PAO. Schellman’s approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives using a single third party assessor. For more information visit [www.schellman.com](https://www.schellman.com/).

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

---

Auth0 Achieves ISO 27001:2013 Certification

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The new body of rules promises to tighten up data security for consumers in Europe.



We are happy to announce that effective today Auth0 is part of the EU-US Privacy Shield Program and publicly committed to comply with its requirements.
This certification enables Auth0 to transfer personal data from the European Union to the United States while complying with EU data protection requirements.

## Understanding Privacy Shield

The European Commission decided last year that the [Safe Harbor Principles](https://auth0.com/blog/safe-harbor-still-matters/), which outlined rules for the security of data transferred between the United States and EU by companies, were no longer robust enough. So they replaced Safe Harbor with the [EU-US Privacy Shield Framework](https://www.privacyshield.gov/welcome).

The Shield isn't a law, it's a system of rules that companies can comply with and get certification for. Therefore it's not a government mandate, but companies that comply will be authorized to transfer personal data from the EU to the U.S. 

This new body of rules promises more stringent protection of data and more oversight for those companies transferring data across the Atlantic.

## What's The Difference Between Safe Harbor And The Privacy Shield

The new EU Privacy Shield was agreed on in August this year with the intention of patching up the holes in Safe Harbor but also upgrading the security that American companies had to ensure.

The Shield is different from Safe Harbor mostly because it calls for the US Department of Commerce to play a larger role in monitoring and supervising compliance, including carrying out reviews and investigations of companies that participate. The Shield is pushing data legislation above and beyond Safe Harbor:

* Participating US companies are now required to post detailed privacy policies on their sites.
* US companies must allow EU citizens to opt out of data sharing with third parties.
* US companies can only process data that is “relevant” to the reason it was collected and must delete personal data that is no longer being used for the purposes it was collected for.
* EU citizens can file complaints via multiple avenues, more than under Safe Harbor.
* If a US company is found in violation by the Fair Trade Commission it has to publish the nature of its non-compliance.
* Even if they withdraw from The Shield, US companies might still have to comply with certain obligations.

Like Safe Harbor, American companies have to self-comply with the Privacy Shield. Doing so allows them to receive certification that their data transferral to the EU is secure. Auth0 is in the process of complying with the brand new EU-US Privacy Shield Framework. 

Auth0 follows the rules laid out in The Shield. In our [privacy policy](https://auth0.com/privacy) we demonstrate how discerning we are with data collection—we only ask for personal information we need to deliver our services and to ensure our site is running properly. We may also analyze your data through aggregated data pools, so that no individual is highlighted in our studies. This protects the privacy of our users.

## Why Was The Shield Introduced

With the constant business that flows between the European Union and the United States, sensitive data is moving back and forth across the two unions continuously. The goal with both Safe Harbor and the new EU Privacy Shield is to protect the data of [individual European consumers](https://medium.com/@nichchung/eu-u-s-privacy-shield-how-snowden-and-schrems-led-the-eu-to-armor-up-94207ee96702#.248ekl938). 

Safe Harbor was implemented in 2000. It was established after Google was launched and before Facebook came on the scene. Despite the fact that it was born before the internet looked anything close to what it does today, Safe Harbor wasn't updated until recently.

![A brief safe harbor history](https://images.ctfassets.net/23aumh6u8s0i/7iEDm5ew1NOoSfcwn214xN/0a5d48a52c242229249da431472d1d6b/safe-harbor-history)

*Source: [iapp](https://iapp.org/resources/article/a-brief-history-of-safe-harbor/)*

Safe Harbor was overturned after Edward Snowden demonstrated how the [NSA was collecting and tracking data](http://www.wired.com/2015/10/tech-companies-can-blame-snowden-data-privacy-decision/). These revelations were compounded by Max Schrems, an Austrian law student who [brought a complaint to the European Court of Justice](http://www.businessinsider.com/ecj-safe-harbor-ruling-bots-expected-2015-10) about Facebook's data collection. He asked the Irish Data Protection Commissioner to stop allowing Facebook, an American company, to transfer data from EU citizens to America. 

It soon became clear to EU citizens that their data could also be mined by the American government body without the consent of EU citizens.

After that one-two punch from Snowden and then Schrems, the European Commission was determined to create a new body of rules that would improve on Safe Harbor and make it even more transparent. And so the EU-US Privacy Shield Framework cracks down on insecure data collection and increases government oversight. 

## What Do I Have To Do To Join The Shield

The Privacy Shield requires self-compliance. That means there's no law demanding that you follow the rules set out by Shield, rather your company can opt to do so and receive certification. In complying with The Shield, organizations will be authorized to transfer the personal data of EU residents to the U.S. 

There are four requirements to joining Shield:

1. The company must be under the authority of the FTC or another U.S. agency (i.e. should be an American company or doing business in America) so these groups can ensure compliance
2. The company must make public its commitment to follow the rules laid out in Shield
3. The company must publicly post its privacy policy
4. The company must implement the Principles laid out in Shield

Any company that wants to be certified by the Department of Commerce for Shield must give them a very detailed description of how the company will be using the personal data of EU citizens. The certificate has to be renewed annually.

Auth0 is now part of the EU-US Privacy Shield Program and we are [already SOC 2 Type II certified](https://auth0.com/security). We also conform to the OpenID Connect protocol and offer HIPAA BAA agreements for companies transferring sensitive personal health information.

We follow a series of verified identity standards and have built our services around them, including LDAP, SAML, OAuth, and JSON Web Tokens. We also maintain the integrity of the data we collect and ensure [security](https://auth0.com/security) through encryption and password hashing. With Auth0 you can ensure up to five levels of password complexity and even opt into custom rules that implement the [OWASP recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls). Through Auth0 you can harness these powerful standards to protect your own applications. When we receive Shield-certification, that too will be available.

## The Future Of Data Protection

As soon as Shield landed on August 1, companies like [Microsoft](https://blogs.microsoft.com/eupolicy/2016/08/01/microsoft-signs-up-for-privacy-shield/) and [Workday](http://blogs.workday.com/workday-self-certified-on-day-one-of-privacy-shield/) were already signed up. But Shield is just the beginning for the new generation of data legislation in the EU. 

The EU-US Privacy Shield Framework promises to improve on current data collection practices and companies that get certified within it are signaling to their consumers that they value privacy and data protection. In 2018, data legislation within the EU is scheduled to expand again with the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation). Shield is almost a primer for the new Regulation.

Data flow should always be secure no matter where in the world you're located. We are stringent in ensuring all the data we're trusted with remains protected. The EU-US Privacy Shield Framework will make sure that American companies are responsible for all the data they collect so consumers remain safe.


Announcing Auth0's Certification in the EU-US Privacy Shield Framework

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Providing an always-on, highly secure identity service is core to the Auth0 brand promise.

Providing an always-on, highly secure identity service is core to the Auth0 brand promise. As such, all our systems, controls and processes have always been designed with security and availability as critical design points. 

Today, we are going one step further and we are pleased to announce that we have achieved SOC 2 Type 1 certification. 





Here are a few examples of what you can read about in the report:

* Auth0 security policies 
* Auth0 encryption protocols for data at rest and in motion
* Auth0 logical and physical access controls
* Auth0 change management process
* Auth0 data backup and disaster recovery strategies
* Auth0 system monitoring, alerts and alarms

Protecting the data and privacy of our customers is a non negotiable aspect of what we do. Our SOC 2 certification provides you with an additional assurance that we have all the right controls in place to protect your data and ensure the availability of our service.

To request a copy of Auth0 SOC 2 report, please email <trust@auth0.com>

"certification"