Auth0: DPA, subprocessors and data location

Where to find the Auth0 DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: authentication and user identity. The table is the short version; the sections below add detail.

Auth0 at a glance

Notes on Auth0

Auth0 has no DPA page of its own. Its support article sends you to Okta's Trust & Compliance documentation and says the Okta DPA applies to both Workforce Identity Cloud and Auth0 Customer Identity Cloud. The DPA is pre-signed by Okta and you sign and return it (email or the digital form).

You only get notice of a new sub-processor if you subscribe by email with an executed copy of the DPA (section 7.3), and no number of days is stated. The objection window is 30 business days (section 7.4), not calendar days.

Okta's sub-processor page lists the regions you can select at deployment: USA, Canada, United Kingdom, European Union, Japan and Australia. The DPA text names the SCCs plus Swiss and UK terms and does not mention the Data Privacy Framework.

Auth0 DPA: where to find it and how it is accepted

Read the DPA on www.okta.com. Okta's DPA is pre-signed by Okta. You complete the signature box and either email the signed copy to DPA@okta.com or complete it digitally through the Okta Trust & Compliance page. The PDF shows no version number or date..

Plans covered: Okta's Workforce Identity Cloud and Auth0 Customer Identity Cloud

Auth0's support article "Copy of Data Processing Addendum (DPA)" says: "This DPA applies to both the Okta Workforce Identity Cloud (WIC) and the Auth0 Customer Identity Cloud (CIC)." It does not list pricing plans, and the DPA PDF itself does not name Auth0.

Auth0 subprocessors: the list and how change notices reach you

Auth0's subprocessor list (11 entries on the check date).

The Auth0 table on the Okta sub-processor page lists 11 entities (AWS, DataDog, Microsoft, Salesforce, Snowflake, MongoDB, Aiven, SendGrid, Twilio, Computer Generated Solutions and Cloudflare). Separate tables for Fine-Grained Authorization and add-on features are not counted. The page shows an effective date of May 2026.

How changes are announced: Email, only if you subscribe by emailing subprocessors@okta.com (section 7.3).

Not stated in the source we checked (2026-10-17).

Section 7.3: you subscribe by emailing subprocessors@okta.com (with your name, address, an executed copy of the DPA and your email), and Okta then notifies you before authorizing a new sub-processor. No number of days is stated.

Okta tries to offer a change in the Service or a recommended configuration change to avoid the objected-to sub-processor. If that takes longer than 30 business days, you may terminate the affected Order Form(s) for the aspects of the Service that depend on it, with a refund of prepaid fees (section 7.4).

Where Auth0 stores data

• USA
• Canada
• United Kingdom
• European Union
• Japan
• Australia

You can choose the region.

The Auth0 table on Okta's sub-processor page says that during deployment customers may select from regions such as "Public Cloud: USA, Canada, United Kingdom, European Union, Japan, Australia". The DPA itself names no regions.

How Auth0 moves data outside the EU and UK

• SCCs (Modules 2 and 3)
• UK Addendum
• Swiss FADP terms

The DPA incorporates the Controller to Processor (Module 2) and Processor to Processor (Module 3) SCCs by reference, with a Swiss annex (Annex III) and a UK addendum (Annex IV). The DPA text we read does not mention the Data Privacy Framework.

Is Auth0 a processor or a controller?

Processor: it handles your customers' data on your instructions.

Roles clause 2(i): Okta is the processor and you are the controller, unless you are the processor, in which case Okta is your sub-processor.

Is Auth0 GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Auth0's own documents say:

• A DPA is published: Okta's DPA is pre-signed by Okta. You complete the signature box and either email the signed copy to DPA@okta.com or complete it digitally through the Okta Trust & Compliance page. The PDF shows no version number or date.
• A subprocessor list is published.
• Transfer mechanisms named: SCCs (Modules 2 and 3), UK Addendum, Swiss FADP terms.
• Data locations named: USA, Canada, United Kingdom, European Union, Japan, Australia.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Auth0 to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Auth0, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Auth0 | Authentication and user identity | USA; Canada; United Kingdom; European Union; Japan; Australia | SCCs (Modules 2 and 3); UK Addendum; Swiss FADP terms | [DPA](https://www.okta.com/legal/trustandcompliance/) | [Subprocessors](https://www.okta.com/legal/trustandcompliance/subprocessors/) |

Add to my list

If you add or replace Auth0: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

In the source we checked, Auth0 doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Okta's DPA PDF, Okta's sub-processor page (effective May 2026) and Auth0's DPA support article.

2026-10-17

Re-checked the notice, objection, location and transfer clauses against the full text; no changes.

Related vendors

• Authentication
• Clerk (clerk.com) User authentication and management
• Supabase Database hosting and authentication
• Firebase App backend, database and authentication
• All vendors

Sources and method

• https://www.okta.com/legal/trustandcompliance/ checked 2026-10-17
• https://support.auth0.com/center/s/article/DPA checked 2026-10-17
• https://www.okta.com/legal/trustandcompliance/subprocessors/ checked 2026-10-17
• https://www.okta.com/content/dam/okta-www/en_us/legal/trustandcompliance/Okta-customer-data-processing-addendeum.pdf checked 2026-10-17

Facts come from Auth0's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: auth0.com.