Bradford Peirce

Product Marketing Manager, Retail

Artificial intelligence is here to stay in the retail industry. It must be secured.

Securing AI Agents: Retail's Next Big Challenge

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

Senior Product Manager

The Customer Identity Cloud platform can now reference NFTs as profile data and as a means to grant access.

The [Auth0 Lab team](http://labs.auth0.com/) has released a pair of [Marketplace integrations](https://auth0.com/marketplace) bringing more [Web3 capabilities](https://marketplace.auth0.com/categories/web3) to the Okta Customer Identity Cloud ecosystem. As the Web3 ecosystem matures, we’re finding that on-chain data, like NFTs (non-fungible tokens), can be used in the identity ecosystem. 

[Our integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) is a simple NFT fetch [Action](https://auth0.com/docs/customize/actions) that retrieves a list of NFTs the user owns. With them, you can make all sorts of IAM-based decisions. If you’re interested in the Auth0 Lab team’s continued Web3 research, come join the conversation on [Twitter](https://twitter.com/Auth0Lab) and [Discord](https://discord.gg/xkbkz9rZcD).

## NFTs in Identity and Access Management (IAM)

By now, you’ve probably heard of NFTs. If not, here [is a helpful explainer](https://www.nytimes.com/interactive/2022/03/18/technology/nft-guide.html). At their core, NFTs are digitally transferable tokens. Tokens have a long history in identity and access management. They are the keystone of authorization in many apps, primarily through the issuance of [JSON web tokens](https://jwt.io/). 

NFTs could be a big extension to token-based IAM. NFTs are flexible, secure, and easily transferable by their nature of using blockchain consensus algorithms to establish ownership and transference. Like with cryptocurrencies, only a specific private key in a wallet can prove ownership. They can help organizations manage capacity problems because you can limit the number of NFTs you mint. This scarcity helps manage supply while still allowing for a robust secondary market. This makes them ideal for ticketed events and venues, like stadiums, trains, and other physically limited spaces.

One of the biggest barriers to mainstream NFT adoption is the usability hurdle of working with blockchains. With our latest integrations, Auth0 Lab seeks to make it easy. Developers can query a user’s NFTs and incorporate them as identity data in their applications, even controlling access based on a user’s ownership of an NFT. We’re excited to see how developers use these new tools when implementing web3 functionality into their applications.

## Token Gating

[Token Gating](https://tokenizedhq.com/token-gating/) is the practice of managing access to resources based on a user’s Web3 NFTs. Notable examples include [‘members only’ communities](https://rarible.com/blog/9-membership-nfts/) of NFT collectors. This exclusivity extends to video games like [Alien Worlds](https://alienworlds.io/), the [largest web3 game](https://www.statista.com/statistics/1266486/blockchain-games-user-number/) at the end of 2022. NFTs are central to the game and unlock certain content, or game locations are only accessible with specific NFTs. [TravelX](https://travelx.io/) is working on another use case around airline tickets.

Token gating is interesting because of the openness of the attestation. Instead of IAM data being stored on a proprietary server, it’s on a public blockchain for anyone to use and see. We’re just witnessing the first experiments in how that data is used. 

## EVM Compatible, Open Source Coming Soon

The current integration works on all [Ethereum virtual machine (EVM) compatible](https://gocrypto.com/en/what-are-evm-compatible-blockchains/) blockchains. This means you’ll have access to NFTs available on some of the largest NFT marketplaces like [OpenSea](https://opensea.io/). You’ll be able to pull from [Ethereum](https://ethereum.org/en/), [Polygon](https://polygon.technology/), [Avalanche](https://www.avax.network/), [Binance Smart Chain](https://www.bnbchain.org/en), and others. EVM blockchains are the oldest programmable blockchains, and the ecosystem is well supported.

The Auth0 Lab team is working on open-source the code so it can be modified and moved to other blockchain platforms. That process takes some time, so keep an eye out by following us on [Twitter](https://twitter.com/Auth0Lab) or heading to our [GitHub organization](https://github.com/auth0-lab) and give it a follow.

## Unlocking NFTs for Your Application

### How it Works

The Auth0 Lab [fetch-nfts integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) works by relying on a few other pieces of infrastructure.

1. It utilizes the [Sign in with Ethereum integration](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) that SpruceID released in the Auth0 Marketplace in 2022. This allows the integration to grab a public blockchain address for the user, which is critical to querying an NFT smart contract to know if they own an NFT. If a user logs in with a method other than Sign in with Ethereum, NFTs won’t be fetched.
2. During [setup and configuration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install), specify a list of NFT contracts that you’d like the [Auth0 Actions](https://auth0.com/actions) code to query. You’ll also need to specify an API key for [The Graph](https://thegraph.com/en/), a service that queries blockchain data.
3. With a public key in hand, and a list of NFT contracts to search, the Actions code calls out to The Graph’s APIs to query the necessary NFT contracts. It returns a list of caip-22 asset references that your Action adds to the [ID token](https://auth0.com/docs/secure/tokens/id-tokens) as claims.
4. From there, you can utilize the data in your application to make any decision, like token gating access, that you feel necessary!

### Installation

Check out our [installation](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install) guide to get started!

## What’s Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Web3 NFTs for Identity and Access Control, Now Available on Marketplace

liz-rivera

At Auth0 I'm responsible for clearly and concisely communicating the value of our CIAM platform. What a great role to be in as digital technologies and applications increasingly become ingrained in our everyday lives. I also oversee the Healthcare vertical, which I'm super passionate about, as digital advances are already recreating the way we receive care.

Senior Product Marketing Manager, CIAM

Liz Rivera

Auth0 has a new CDP partner in our Marketplace

Digital interactions are increasingly dynamic as brands accelerate digitization - adding more digital channels and services to cater to consumer demands for convenient and seamless access to services from anywhere. This reality has fueled an explosion of data being collected across a wide array of channels and customer data repositories, which not only makes it difficult for marketing teams to get a single view of customers but also makes it challenging to trust the accuracy of the data.  

When customers cannot be accurately identified, this skews analytics and impedes true understanding of customers, their preferences, and behaviors across all digital properties, which is critical to driving adoption and customer lifetime value. This has sparked a growing need to bridge the gap between marketing and Customer Identity & Access Management (CIAM), combining identity and marketing to create a holistic picture of user behaviors. 

### Breaking down silos with customer data platforms (CDPs)

Brands collect customer data across various channels (web, mobile) and systems (martech, eCommerce, customer care) with the goal of extracting insights to enrich the experience. Unfortunately, these customer data sources act as islands creating siloed views of customers, impacting the ability to effectively analyze and personalize the experience.  

Centralizing customer data is the first step toward fueling the understanding of customers. Today, organizations are turning to customer data platforms (CDPs), which serve as master customer data stores. CDPs aggregate customer data across multiple channels and repositories, unifying previously disparate data silos to create unified customer profiles — the customer 360. 

CDPs enable marketing teams to optimize the timing and targeting of offers, communication, and engagement activities by allowing the analysis of behavior across the customer journey. However, without a proper identity verification source, the legitimacy of the data comes into question.  

Because CDPs aggregate previously collected data, it is difficult to know how valid the data is. The data may have been collected in a channel without gaining proper consent, the customer's identity may still be unknown (e.g., anonymous profiles), and/or the contact details have become outdated or were never validated.

### Source of truth: Customer Identity and Access Management

Traditionally, CIAM has been a form of front-line security. However, it has reciprocal value across an organization as it is the front door to your digital services and products. CIAM is how customers adopt and engage with your digital products and services and gives you the means to accurately identify, collect, analyze and secure their data. 

CIAM provides a unified interface for customers to sign up and sign in to your products and services - it is often the first touchpoint at which customers become identifiable. The data that is collected during these events is not only verified through authentication events but can span deterministic data, customer data brought in from other identity providers (e.g., social or enterprise repositories), the devices being used to access services, and the location services are being consumed from.   

This valuable source of truth can be used to connect customer identity across all digital services, including their preferences, usage patterns, and consent. 

### CIAM and CDPs: Powering the marketing funnel

Investment in a CDP is made to better understand customers in order to drive conversions, ROI, customer retention, engagement, loyalty, funnel optimization, and customer experience. Enriching the customer profile with essential identity data across all applications can further accelerate the value of a CDP investment.

Through bi-directional synchronization with CDPs and other martech systems, CIAM data can be used to:

* **Connect anonymous profiles to known customers **by providing verified identity data at signups, such as IP address and device identifiers. The CDP can ingest this data and correlate it to a previously unknown profile. With third-party cookies going away and mobile devices limiting app tracking, this capability is essential for marketers looking to understand their customers’ behaviors across their pre and post-account creation activity and engagement regardless of application or channel. 
* **Enrich user profiles with accurate, customer-provided data.** CIAM verifies users’ identities during registration and login, using identifiers such as email or mobile number. If the CDP detects a change/update, it will update the user profile with the new data.   
* **Power analytics with actionable identity data spanning how, where, and when users are signing up and signing into applications**. CIAM plays a central role in the conversion funnel. The acquisition is tied to signup, and retention is tied to the login experience associated with your digital services. Not having a unified view of these processes and a way to analyze and take action on this data can lead to friction, which creates frustration and leads to lost conversions. By providing a CDP with this data, which in turn is shared with martech and analytics systems, markets can develop a deeper understanding of customers’ behaviors and transaction patterns to identify threats, points of friction, and opportunities for segmentation. 

### Auth0: Unifying and powering existing tech stacks with identity data

At Auth0, we position ourselves as an essential component in the end-to-end digital relationship. Auth0 serves as a foundation to unify an organization's existing tech stack as it integrates and enables a broad ecosystem of technologies and applications spanning applications, APIs, martech, content management, fraud, privacy, sales, and customer care systems.  

Essentially Auth0 acts as a single source of truth for identity data spanning: 

1. Identifiers a user is providing when creating an account
2. Locales, devices, and IPs that the user is logging in from
3. Number of times a user is logging in
4. Applications the user is logging in to
5. Risk profile of the login that the user completed
6. Verified email or the phone number used during the authentication challenge

By sharing this data with downstream systems, Auth0 can boost business outcomes across an entire organization, for instance: 

* Marketing teams to power analytics to better gauge conversion and derive benefits from clean, trusted data.
* Customer support agents to leverage login activity to better service customers.
* Security teams to utilize transactional data to diagnose a potential account breach.  

We are constantly adding partner integrations to our Marketplace to allow our customers to power their tech stack easily and quickly with identity data. [Tealium](https://tealium.com/) recently launched a new CDP integration on the Auth0 Marketplace - [Tealium User Login](https://marketplace.auth0.com/integrations/tealium).  This integration enables marketing and digital teams to leverage Auth0 identity data to connect anonymous profiles to known users and enrich user profiles with accurate and up-to-date data.  

As we continue to grow our CDP footprint, our partner integrations will have an emphasis on helping consumer businesses better understand customers and drive conversion. These pre-built integrations, like Tealium, allow customers to configure and deploy a CDP without employing developers to build a custom solution. 

Be on the lookout as our partners continue to build out new CDP integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/).

Why You Should Integrate Customer Identity and Your Customer Data Platform (CDP)

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

If your organization stores customer data in the cloud, SOC 2 compliance is table stakes.

In the last two years alone, cloud-based cyberattacks[ more than doubled](https://www.trustwave.com/en-us/resources/library/documents/2020-trustwave-global-security-report/) — even though SaaS spending[ grew just 18%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/). 

While these numbers are merely a correlation from a statistical standpoint, it does indicate that if your business stores customer data in the cloud, it’s more important than ever for your business to take measures to secure that data. Especially given SaaS spending is[ expected to increase an additional 36%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) between 2020 and 2022. 

A SOC 2 certification from the AICPA is a foundational step that will help every service provider reduce security risks. Below is a guide to SOC 2 compliance requirements and certification.

## What Is SOC 2?

SOC 2 is an independent audit report that evaluates the security controls a tech service business uses to protect the data they process in the cloud. Possession of a SOC 2 report is considered table stakes in the SaaS industry, as the answers to most security questions a customer may have about their business’s security posture can usually be pulled from this report.

### SOC 1 vs. SOC 2 vs. SOC 3

“SOC” stands for “System and Organization Controls” and was created by the American Institute of Certified Public Accountants (AICPA). SOC 2 is one of three SOC reports, each with different purposes and/or levels of transparency:

1. **SOC 1.** Used to audit internal controls relevant to a customer’s financial systems. Report usage is “restricted,” meaning its use is limited to auditors, the service organization, and authorized users.
2. **SOC 2.** Used to audit the overall management of customer data. Report usage is also “restricted” the same way SOC 1 is.
3. **SOC 3.** The same as SOC 2, but the report is simplified and publicly available to increase transparency.

![What Is SOC 2](https://images.ctfassets.net/23aumh6u8s0i/5LsphelbdnIZtLBd7NOrZQ/3e05f625deb2ff6588f9bffbf2dc3449/sep_compliance_02.jpg)

## Why SOC 2 Compliance Matters

SOC 2 compliance isn’t a legal requirement for a tech business. However, having a SOC 2 report is a common compliance objective for service providers that store their customers’ data in the cloud because it’s a necessity from an assurance (and therefore[ competitive](https://www.forbes.com/sites/forbesbusinesscouncil/2019/10/09/using-cyber-security-as-a-competitive-advantage/?sh=260c85237ff7)) perspective.

For many small to medium-sized operations that store marginally-sensitive data (for example, information that’s already publicly available), a SOC 2 report usually provides enough assurance of their controls and procedures to their customers. 

However, for businesses whose data is considered[ sensitive](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en) (health data, for example), a SOC 2 report is the minimum a business should have in order to assure their customers they’ve taken steps to protect their data.

![Why SOC 2 Compliance Matters](https://images.ctfassets.net/23aumh6u8s0i/2gAtMudqliW2LiC3h7imD9/db7be0b8025f315b137a7744e7d5d469/sep_compliance_03.jpg)

## The SOC 2 Certification Process

SOC 2 certification is completed by a third-party auditor who assesses the extent in which service provider’s controls comply with one or more of SOC’s five Trust Services Criteria (TSC): Security, Privacy, Confidentiality, Processing Integrity, and Availability.

SOC 2 is different from other security certifications because it lets each business decide how best to implement the SOC 2 framework. The auditor evaluates how well the business has implemented controls relative to each of the TSC and its operations and gives their opinion of overall effectiveness.

The auditor then compiles their opinion and findings into a report (the SOC 2 Report) you can then use to assure your customers of the steps you’ve taken to manage their data.

The SOC 2 Report comes in two different types (Type 1 and Type 2), and each has an impact on how the certification process proceeds. However, since each requires an evaluation of your practices against the five Trust Services Criteria (TSC), we’ll address those first and explain how each of the report types affects certification in more detail afterward.

### SOC 2 Trust Services Criteria

Tech service businesses can choose to certify in as many or as few of the TSC as they like. Most businesses choose to earn a certification for one to three of the criteria. However, businesses that process sensitive data will benefit from earning certification in all five.

Below is what earning certification in each of the SOC 2 Trust Services Criteria entails:

1. **Security.** An evaluation of both the electronic and physical controls a business uses to protect the customer data they process. Auditors will examine security measures, like, network security, vulnerability management, and security monitoring, as well as the steps you’ve taken to secure any access to the physical devices and locations your customers’ data, is stored on in order to prevent unauthorized access.
2. **Privacy.** An evaluation of how a service business collects and uses customer data. Auditors will compare a company’s privacy policy(ies) to the actual operational procedure(s) to ensure they’re in alignment with the AICPA’s Privacy Management Framework ([PMF](https://www.aicpa.org/interestareas/informationtechnology/privacy-management-framework.html)).
3. **Confidentiality.** An evaluation of how data is stored, accessed and shared. Auditors will examine the procedures and access controls you have in place to restrict who has access to customer data, as well as any technical measures, like encryption, you’ve implemented to keep data safe.
4. **Processing Integrity.** An evaluation of your quality assurance and processing-monitoring practices. Auditors will examine whether data is called from your servers in the same state it was stored — and that it’s only called for the people who are authorized to access it.
5. **Availability.** An evaluation of whether your customers have access to your system as outlined in their contractual agreement(s). Auditors will examine controls and procedures-performance monitoring, business continuity, disaster recovery, and incident management to ensure they match what was promised.

![SOC 2 Certification Process](https://images.ctfassets.net/23aumh6u8s0i/3lefYYa9FsqqIVecGGpIlV/88a934fa5d9dbb876787096be7536747/sep_compliance_04.jpg)

## The SOC 2 Report

Once an auditor completes their evaluation of the security measures you’ve implemented, you’ll receive either a SOC 2 Type 1 Report or a SOC 2 Type 2 Report (depending on which you chose to certify for). Both reports contain an explanation of everything you’ve done to keep your customers’ data safe:

1. The controls you’ve implemented
2. How they align with the Trust Services Criteria
3. An explanation of your company’s operations
4. How the auditing process was conducted
5. How you’ve implemented controls to secure the user environment

However, the differences between each report type mean that obtaining a SOC 2 Report can create a substantial increase in the effort and work required to comply.

### SOC 2 Type 1 Report

A SOC 2 Type 1 Report is an evaluation of the design of your controls at a specific moment in time. This means the certification process required for a Type 1 Report can occur relatively quickly (in the time it takes for an auditor to evaluate your systems and procedures).

### SOC 2 Type 2 Report

A SOC 2 Type 2 Report is an assessment of the operational effectiveness of your controls. The evaluation is done over a period of time to observe how effective those controls are in practice instead of just at one specific moment, as in a Type I Report.

A SOC 2 Type 2 Report typically requires months of auditing to obtain. But the increase in assurance it provides is often worth it for service organizations that process sensitive data. Traditionally a SOC-2 Type 2 covers a 6-12 month period. 

![Additional Security Certifications That Are Worth Pursuing](https://images.ctfassets.net/23aumh6u8s0i/Xb8Z3o1JWLQE9ZlM2vcQw/303397e92ee5a143b23112d7f055e4cb/sep_compliance_01.jpg)

## Additional Security Certifications That Are Worth Pursuing

A SOC 2 Report helps you demonstrate a baseline of security to your customers, and the more Trust Service Criteria you certify for, the more assurance you can provide (it’s why Auth0 meets all 5). 

But given[ the rate](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf) at which cloud-based cyberattacks are increasing in the wake of the pandemic (and[ the average cost of a data breach](https://auth0.com/blog/what-is-data-security/) across most industries), doing more than the minimum to secure your customers’ data is in your best interest.

Auth0 has earned certifications in several additional information security frameworks for this reason. We’ve created guides to earning certification with the ones we’re experienced with via the links below:

* **[ISO/IEC 27001](https://auth0.com/blog/auth0-achieves-iso-27001-certification/).** The International Organization for Standardization’s framework for building an information security management system (ISMS).
* **[ISO/IEC 27018](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/).** The International Organization for Standardization’s cloud-specific controls that cloud-based businesses should follow when certifying for ISO 27001.
* **[CSA STAR](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/).** The Cloud Security Alliance (CSA) offers some of the most relevant and cutting-edge controls for cloud security in the industry.

Learn more about how Auth0’s IDaaS platform can help you better secure and scale your authentication process[ here](https://info.auth0.com/video-platform-overview.html?_ga=2.10769394.753376883.1611345990-439625938.1611345989).

SOC 2 Compliance and Certification: What SaaS Businesses Need to Know

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

You can get data from your customers while keeping them happy by collecting it over time. Find out how you can use progressive profiling to your advantage.



When a new user hits your site, you want to do everything in your power to reduce friction. You make sure all the information is there to help them make the right decision, and you set out your pricing plans clearly and concisely to show your true value.

Then they go to sign up and you hit them with a 10-field form asking every question you could think of. Name, email, password, company, phone number, favorite book, childhood pets, hopes, fears,… The list goes on. Your potential new user is no longer as they can’t be bothered to waste their lives filling out these long forms.

For companies, these forms make sense—you need this information to better understand your customers, and ultimately to better serve them. But for those same customers, they are just a data grab and an annoyance, and any form that takes more than 5 seconds to fill out is *not going to be* filled out.

But there is a way both sides can win. **Progressive Profiling.** Progressive profiling is a technique for gradually building up a profile of your customers each time they interact with your product. It allows you to keep questionnaires and forms short and to the point, but still build up a fantastic picture of each of your customers over time.

Most importantly, it means your users can immediately engage with your product, experiencing it first before you overload them with questions. You might only get a small amount of data at first, but once they start using and moving your app, they will be far more happy to give you more.

![Progressive Enrichment Separator 1](https://images.ctfassets.net/23aumh6u8s0i/1TrkqXANAOhKdFfekZWaNJ/aefb6d52e4b266632993d4a6b65c327d/02body)

## The Problem With Long Forms

Customers are simply turned off by a long signup form. 86% of users say overly long forms make them quit on registrations, and reducing form fields from 11 to 4 [increases conversion rates by 120%](http://unbounce.com/conversion-rate-optimization/how-to-optimize-contact-forms/).

<include src="TweetQuote" quoteText="86% of users say overly long forms make them quit on registrations."/>

There are 4 main reasons people don’t fill out long forms:

1. **Lack of Value:** Unless a customer has a true need for your service, they are likely to look on a long sign up form as too much work for little benefit. If they are only signing up to give it a quick trial, or find some information only available to registered users, this friction is likely to be enough to stop the registration.
2. **Inappropriate Information:** When a customer is presented with a long sign up form they immediately think “Do they really need all this information?” Whereas you understand why it’s helpful to have company, title, or employee numbers information for your sales and marketing team, the customer doesn’t see this as necessary for their use of the service.
3. **Data Security:** The more data you have on a customer, the more there is to lose. With the substantial amount of data breaches occurring, customers are wary of handing over any data they don’t see pertinent to their own use of the service.
4. **Unreliable Data:** A combination of all 3 of these issues leads to this—customers will put random information into form fields just to get through the registration process quickly. This information will then be unusable for your sales and marketing teams.

![Progressive Enrichment Separator 2](https://images.ctfassets.net/23aumh6u8s0i/2nrxnzzlkAmZsunA3JrtlN/14abaade889f2af742b068bc75a95cb6/03body)

## How Progressive Profiling Works

Progressive profiling allows you to bypass these issues by collecting information gradually from customers over time as they use your service.

For instance, if you wanted the following information:

    * First Name
    * Last Name
    * Email
    * Company
    * Title
    * Number of Employees
    * Phone Number

You could ask for all this information in one go with a 7-field registration form. Alternatively, you could split it up into 3 blocks of information, each presented to the customer with a specific use.

On signup, you ask for `Email`, name (`First Name`, `Last Name`), and `Password`. The customer sees this as the obviously necessary information for signing up, and they’re accustomed to filling it out (an extra bonus is that this information is so common that their browser will autofill these fields, lessening friction even further).

By getting customers onboard without friction, you can get straight to showing them your product’s core value. If they come back a number of times, you can then ask them further information.

For example, you can ask them for company information: `Company`, `Title`, `Number of Employees`. By this time they will have started to see the value of your product, be using it frequently, and therefore be more willing to give extra information.

Finally, after a few more logins, you can ask for phone number to help you keep in contact.

Over the course of a few interactions, you have collected exactly the same information as you would with a long registration form. But instead of putting potential customers off with an annoyingly long form, you have only asked them for the pertinent information each time, showing them the reasoning behind this information, and making each step quicker.

This engages Dr. Robert Cialdini’s [principle](http://business.illinois.edu/shavitt/BA_531/Cialdini%20-%20Compliance.pdf) of “Commitment and Consistency.” Human beings naturally strive for consistency. Once we make a mental commitment to something, regardless of how small it is, we are exponentially more likely to stay consistent in our commitment to it.

By getting a small commitment up front with a short form, you make it much more likely that your customer will give you more information in the future. Using progressive profiling, you users can experience your product straight away, getting to understand its core value and committing to it. Though this only gives you less initial data, you can build up a relationship with users first, and then gather further information you need over time.

Progressive profiling is easy to implement with Auth0. When a user is authenticated through Auth0, that user gets a `Profile` record, which can be populated with profile information about that individual user.

Contents for the user profile can come from 3 different sources:

1. Properties supplied by the identity provider—Facebook, LinkedIn, Twitter, or an enterprise account.
2. Attributes that are dynamically created using Auth0 Rules. For instance, [this Rule](https://github.com/auth0/rules/blob/master/rules/get-FullContact-profile.md) with populate your profile information from FullContact using just the email address.
3. The user themselves can add data to their Profile record through form fields presented during authentication.

![progressive profiling flow-chart](https://images.ctfassets.net/23aumh6u8s0i/Ebr9XpLsGk52TvYLhUHGL/f67ed02d22b8c4b4273d4e8faaaa58d0/progressive-profiling-1)


If you are using both social/enterprise login and Rules with Auth0 during your authentication process, then you should need little extra information added from your user.

Therefore, you should **never ask what you already know**. If you already have extensive demographics from LinkedIn or Facebook, it isn’t necessary to add questions about this information to your registration process.

## Implementing Progressive Profiling With Auth0

Information from these social providers is likely to be high-quality compared to what users may add to your login form, therefore pre-populating their profile from these sources is preferential. But if you don’t have this data, or you want to augment it, a progressive profiling structure can add any additional data you need for either customer communication, or for marketing or sales leads.

Using Rules, you can easily track how many sign in events have occurred for a user.

Using the Auth0 [Users API](https://auth0.com/docs/api/v2#!/Users/patch_users_by_id), Auth0 provides a “bucket” for user metadata:  `user_metadata`. The user token (obtained after authentication), is sufficient to modify the contents of `user_metadata`. This feature makes it very easy to control what information gets collected and when, and then through the Users API, enrich the user profile with any information collected:

<p style="text-align:center">
<img src="https://images.ctfassets.net/23aumh6u8s0i/5Ip7xQMK44PvGswTi7Enqn/742d07fc8dbe2229753c546b33599277/progressive-profiling-2" alt="progressive profiling user-flow"/>
</p>

In the example above, we collect `last_name` and `first_name` on signup, then on a later interaction `title` and `company`, finally in the context of an article that might interest the user, a `subscribed` property.

To see this in use, you can try our [progressive profiling demo](http://auth0.github.io/auth0-progresive-profiling-demo). The initial Lock log in/sign up screen is the same as any other:

![progressive profiling lock-screen](https://images.ctfassets.net/23aumh6u8s0i/3xDLliY5c5YcNQ2jDLsmKE/fdece3792a6b2fff391f4b73f1f9ab5a/progressive-profiling-9)

At this point, the new user can sign up with using SSO, or with email. If they choose SSO, the profile information will already be populated from the social identity provider. But if they choose to create a new account, a new profile will be created and `user_metadata` will be populated from the inputted information:

![progressive profiling customer-info](https://images.ctfassets.net/23aumh6u8s0i/1duKykZZt8Vz0QJJ22mTLC/617656191bc1feca50e37a77d211d7c1/progressive-profiling-4)

Either way, they are not asked for more information during their first visit. However, once they log out and log back in again, they are presented with further profiling questions:

![progressive profiling further-questions](https://images.ctfassets.net/23aumh6u8s0i/7vgGdpkTCPOn9O4mtJpWCn/0a58e21077cf54cecc927069ecc5b115/progressive-profiling-5)

Once they have answered, this information is added to `user_metadata`:

![progressive profiling user-metadata](https://images.ctfassets.net/23aumh6u8s0i/3eoDW5zFkx5feymShOLEUO/1aa7610eeb44db600bd5a426c874a7b0/progressive-profiling-6)

A counter, `last_profiling_step`, is initiated in `user_metadata` and once they leave the app and return a second time, another profiling question is presented:

![progressive profiling another-question](https://images.ctfassets.net/23aumh6u8s0i/6eM5W74b8Dha8nZpocVInR/ec37a7b37d400a8aec29aaa3b3775580/progressive-profiling-7)

This data is again stored in `user_metadata` for use by your sales and marketing teams:

![progressive profiling additional-user-data](https://images.ctfassets.net/23aumh6u8s0i/5dnAgF1PgclSFcSsYDo4gg/1b8b33d1eeff8d387533b8f0b02df773/progressive-profiling-8)

The next time the user logs in, they are not presented with any further questions, and are instead taken straight through to the app.

Instead of one long form, which a new user would either ignore and thus never sign up, or would move through quickly putting false information, you can use 3 shorter forms. These get the important information after a user has returned to you app, therefore showing that they are definitely interested in your product, and is more likely to give you true, quality information.

## Getting The Most From Your Progressive Profile Funnel

One of the great strengths of progressive profiling is that it makes your registration process dynamic. As a user registers, you can construct a buyer persona for them and tailor the registration process to them.

For example, you could use metadata in conjunction with Rules to check if your user is using a personal email address (Gmail, Hotmail, Yahoo, etc.) or a private domain, as in a work email.

If a customer is using a company address, it will make more sense for you to ask for their corporate information before you ask for more detailed contact details like phone numbers. If they’re using a personal email address, it makes more sense to collect more contact info first.

From there, you can segment you users depending on how they answered previous questions:

* If you asked for job title, then you will want a different flow for people answering *engineer* to those answering *marketer*.
* If you asked for company size, you will want to ask different profile questions to users from a *1,000-person* company from a *5-person* company.
* If you asked when they would be interested in further information on your product, you would want a different flow depending on if the answer was *now* or *never*.

With progressive profiling, you can get high-quantity, high-quality information from your users without pushing them away with aggressive forms and questionnaires.  Progressive profiling allows you to collect just the right information from your users at just the right time. You can build up a true profile of each one, allowing you to not only serve them better, but also to help your team generate just the right leads to help your company grow.

> 📘 Want to learn more about the role of customer identity and UX? Download [Okta’s global study](https://www.okta.com/resources/whitepaper-create-the-Identity-experience-your-customers-want/thankyou/) to learn more.

<include src="TweetQuote" quoteText="Progressive profiling allows you to collect just the right information from your users at just the right time."/>


Progressive Profiling: Vital Info from Happy Customers

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to protect customer data from internal and external attacks



On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised.  

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />


What the American Express Data Breach Should Teach the C-Suite

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Concerns of a breach prompting global retailers to invest in advanced identity management



**BELLEVUE, Wash. – April 2, 2019 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced key findings on how retailers are approaching data security and customer experience in light of widespread data breaches and cyber attacks. Based on a survey of nearly 100 global retailers and case study examples collected by Internet Retailer, the report highlights how the age-old battle of security vs. customer experience is now being solved with modern identity management technology. More details from the 2019 Retail Data Security Report can be found [here](http://info.auth0.com/IdentityinRetailReport.html).

Retailers are in constant competition with each other to increase revenues, maintain customer loyalty, and offer the best user experience possible. But according to the survey, security comes first, with 35 percent of respondents ranking “securing customer and employee data” as their highest priority. Next comes the shopping experience for their consumers, with 29 percent of retailers citing “increasing conversion rates” as their second priority.

Security vs. customer experience has been a longstanding challenge in retail, but retailers no longer have to choose one over the other, thanks to today's modern approach to identity and authentication, like Auth0. With a single, centralized system for shopper identities, a retailer can reduce risk with extra layers of authentication, easily capture data to understand consumer preferences, and personalize the end-to-end experience.

The high costs of a breach are spurring retailers to invest heavily in identity, especially given that one in seven retailers surveyed had experienced a data breach in the past year. Nearly three-fourths of retailers (72 percent) cited multi-factor authentication as the top strategy to combat a data breach, followed by stronger passwords (53 percent), and step-up authentication based on user behavior (37 percent).

"Retailers are rarely experts in identity management, nor should they be. Implementing any authentication technology can be incredibly complex, and that's where an identity specialist like Auth0 can help," said Dave Wilner, Chief Revenue Officer at Auth0. "We're proud to provide retailers around the world with a universal identity solution that not only removes the burden of worrying about security, but also enables them to provide a much better shopping experience to their customers."

To read the full report, please visit: <http://info.auth0.com/IdentityinRetailReport.html>.

### **Media Contacts:**

Kasia Hall<br/>
Matter for Auth0<br/>
[khall@matternow.com](mailto:khall@matternow.com)<br/>
971-246-7898


Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113


Securing Customer Data Tops List of Retailer Priorities, According to Survey By Internet Retailer

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.


The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/)  and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials.  

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />


3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

3 lessons business leader can learn from the T-Mobile data breach to protect their teams and customers.


On August 20, T-Mobile discovered that a hacker had gained personal information from unauthorized access to its system. Over 2 million of its 77 million customers were exposed.

Although T-Mobile quickly reported the incident to authorities, it's apparent that the cybercriminal is [aiming to sell the data](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420), including names, ZIP codes, phone numbers, email addresses, and payment information.

While it's still too early to determine the financial consequences T-Mobile will face from the incident, a recent [study](https://blog.kenan-flagler.unc.edu/risky-business-the-impact-of-data-breaches/) from UNC found that data breaches can cost companies as much as 3% of their market value. Dashlane estimates the average dollar cost at [$7.35 million](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) in the U.S., 60% of which is customer (revenue) loss.

 What can business leaders learn from this incident to protect their teams and their customers going forward?

## Lesson 1: Hackers Go for Weak Points, So Protect Yours

Understanding how hackers get in is the first step. There are [four common ways](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) that hackers access systems:

1. Malware infiltration (placement of malicious software, including ransomware and spyware)
2. Phishing (emails that trick recipients into giving away sensitive data or downloading a file that installs spyware)
3. USB traps (a hardware device that contains a HID spoof)
4. Mobile attacks (attacks specifically designed for mobile software)

In all cases, hackers look for the simplest vulnerability they can possibly use to compromise your system. That means they're not necessarily going to try to waltz in the front door. In the T-Mobile data breach, the thief was able to access the system through a hole in an API.

It's critical to plug your leaks. Since APIs run on web servers, they are available to all internet users. Like websites, hackers can crawl APIs.

### Authorize Your Users

To be sure you know who is working within your system at any one time, implement a strong user management system. You can build one in-house or outsource it. Many choose to outsource their identity management since the field is increasingly complex and time-intensive — a challenge for in-house teams to manage with the rest of their workload.

Auth0's [user management](https://auth0.com/user-management) dashboard, for example, lets administrators grant permissions for certain users to access sensitive customer information.

![Auth0's user management dashboard](https://images.ctfassets.net/23aumh6u8s0i/QocoCmdAqGCxzA9wCSqsp/c0f08f478e78129808dea8aa38477077/authorization-permissions)

With this powerful web interface, they can add or remove users, modify their profiles, and identify any root-cause login issues.

With APIs, it's also important to remember to authenticate your apps in addition to authorizing users. You can use a [standardized protocol](https://auth0.com/docs/api-auth) for both authentication and authorization.

## Lesson 2: Update Your Password Practices

A 2017 Verizon report found that [81%](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) of hacking-related breaches were due to stolen and/or weak passwords. While for years teams relied on the MD5 (message-digest) algorithm to hash passwords (create mathematical representations of plain text), today it's not considered the safest method.

<include src="TweetQuote" quoteText="A 2017 Verizon report found that 81% of hacking-related breaches were due to stolen and/or weak passwords."/>

Although originally MD5 hashes were designed to prevent anyone from working backwards from the hash to determine the real password, it's now possible to rapidly generate MD5 hashes to eventually find a matching password.

[Evidence](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420) points to T-Mobile password hashes being MD5, which suggests the company may have been using outdated password practices.

To prevent the risk of password hacking, many providers are using bcrypt instead — a more resistant algorithm. bcrypt uses a salt, an additional layer safeguard for passwords in storage. Over time, users can increase bcrypt's iteration count to slow the process. This makes it more resistant to brute-force search attacks.

### Implement Two-Factor Authentication

Two-factor authentication or 2FA is an alternative verification method. In addition to requiring users to type in a password, 2FA can also request a TOTP (a time-based one-time password algorithm) that it sends to the user's cell phone or other hardware device.

2FA can also require the second form of identification to be a biometric, such as a thumbprint or Face ID.

![iOS 11 iPhone X Face ID](https://images.ctfassets.net/23aumh6u8s0i/i6mkIBMKzZboV96MAaR8I/a18fc7a031c9f5660c611d89a7e52de0/ios11-iphone-x-face-id-hero)

[[Source](https://support.apple.com/en-us/HT208109)]

While none of these solutions are foolproof, a second method of authentication has been found to prevent breaches in [80%](https://www.slideshare.net/cheapsslsecurity/vip-strong-authentication-no-passwords-infographic-by-symantec)of the cases.

## Lesson 3: Improve Communication with Customers After a Data Breach

Although T-Mobile did attempt to notify customers whose accounts might have been compromised a few days after they discovered the incident, many of these recipients were put off — thinking the text message itself was a form of phishing.

![T-Mobile Data Breach Tweet](https://images.ctfassets.net/23aumh6u8s0i/1mspiKVeO2GUD8nXvUZw8z/7ba4d36cdc43e5edbcdbcf60907236b0/tmobile-tweet)

[[Source](https://techcrunch.com/2018/08/24/t-mobile-says-hackers-stole-customer-data-in-data-breach/)]

Texting can be a tricky form of communication for something so sensitive (particularly from a large, impersonal corporation). Organizations like [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) and Equifax have succeeded with well-crafted PR campaigns and explanations on their websites:

![Reddit data breach press release](https://images.ctfassets.net/23aumh6u8s0i/KD5ZLDwuM8UeOKhP3UW2K/bcb28aeb0eda8d90b2a6daee7e69f580/reddit-breach-release)

As a portion of the full announcement (which you can read [here](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)), Reddit clearly defines the scope of the breach, including details of what information the hacker accessed and how to know which users were affected.

Reddit also lets users know ahead of time that they will be contacting them through email to verify if their account has been compromised.

This is in stark contrast to T-Mobile's [vague description](https://go.skimresources.com/?xs=1&url=https%3A%2F%2Fwww.t-mobile.com%2Fcustomers%2F6305378821&xguid=85UTUFk2RzAa&id=66960X1514734&checksum=fc5d6ea7126bb8e6a7af56a7049975e787946c4e625ac9ceef083a8513bb04da) that their team shut down “an unauthorized access to certain information.”

![T-Mobile data breach press release](https://images.ctfassets.net/23aumh6u8s0i/3di8OI1TiR8WKlOTKzEIX3/560aff9c400227387f70fbc291cfad36/tmobile-breach-release)

Being as specific and transparent as possible (as quickly as possible) will help your customers trust that you are handling the situation and keeping them safe.

## Recent Data Breaches by the Numbers

It seems like every week there is a new catastrophe for personal data in the headlines. [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), Saks, Ticketfly, Panera, Lord & Taylor — these are just a handful of the major incidents so far in 2018.

The first half of 2018 saw nearly 700 breaches, on pace to equal 2017's staggering 1,579 breaches.

![T-Mobile Data breach chart](https://images.ctfassets.net/23aumh6u8s0i/2zNkiAn1hkY4MHzNlS1usB/28808e7918247c784def7780f80ae734/data-breach-chart)

The total number of exposed records from these incidents in the past five years tops 580 million.

<include src="TweetQuote" quoteText="The first half of 2018 saw nearly 700 data breaches, on pace to equal 2017's staggering 1,579 breaches."/>

In addition to data breaches, data exposures — when data is improperly defended and open for access on the internet — are on the rise. Instead of a malevolent hacker getting through a protected system, a data exposure occurs if a database isn't correctly configured or doesn't require appropriate authentication. In 2018, Exactis, for example, exposed [340 million records](https://www.wired.com/story/exactis-database-leak-340-million-records/), putting 2 terabytes of personal information at risk.

You don't have to be as large as T-Mobile to take powerful steps to secure your company. [Small businesses](https://www.godaddy.com/garage/online-security-advice-small-business/), for example, can still implement multi-factor authentication and improve their password practices. Taking steps to secure your customer data — whatever your size — will help you avoid becoming an easy target for hackers.

## Bolster Your Security in Order to Scale

Data breaches and exposures can quickly erode customer and investor trust — particularly at critical times in a business's lifecycle. For example, T-Mobile is currently in [a $26 billion merger agreement](https://www.zdnet.com/article/t-mobile-and-sprint-to-merge-finally-strutting-5g-clout/) with Sprint. The deal, which has already been subject to regulatory scrutiny, could face even more hurdles if parties see T-Mobile's lack of updated security practices as a liability.

On the flip side, if you strengthen your defenses and clearly communicate your progress, you have a better chance of emerging from any issues with your reputation intact.

Make sure you are on top of the latest security practices and protocol to avoid worst-case scenarios that could obstruct progress.



3 Critical Lessons from the T-Mobile Data Breach

Key solutions like anomaly detection, universal login, and custom security rules delivered by Auth0 helps its customers protect sensitive user data.



Tight infrastructure security is critical — but if you don't remember to secure your web applications, customer data remains exposed.

There are several [common threats to web-app security](https://auth0.com/blog/common-threats-in-web-app-security/):

- A lack of encryption between your web browser and their servers
- XSS (cross-site scripting) that occurs when malicious scripts are injected into web applications
- Clickjacking (when an attacker injects transparent or opaque objects into a web application)
- Cross-site request forgery (where the attacker impersonates an authorized user and requests sensitive information, such as passwords)

These threats are continuing to multiply and become more complex by the day. To mitigate breaches, particularly in a time of [heavy regulatory scrutiny](https://auth0.com/docs/compliance/gdpr), Auth0 offers three major strategies:

1.  Anomaly Detection
2.  Universal Login Support
3.  Customizable Rules

Auth0 allows you to combine these features to further amplify protection for your app's end users. While you can always attempt to develop these and similar solutions in-house, outsourcing app security will give you access to a team of experts who work 24/7 to keep up with the latest trends in a constantly evolving space.

## Anomaly Detection

Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system. Used separately or in combination, the shields have the ability to stop malicious access attempts before they occur. Administrators receive alerts of suspicious activity and can then block future login attempts by an aberrant user.

<include src="TweetQuote" quoteText="Learn more about how Auth0 provides three built-in shields that detect anomalies among users in an app's system."/>

### Brute-Force Protection

Within its [Brute-Force Protection](https://auth0.com/docs/anomaly-detection) feature, Auth0 has two distinct shields:

1.  Shield 1 is triggered after 10 failed login attempts on a single account from the same IP address.
2.  Shield 2 is triggered after 100 failed login attempts from a single IP address via different usernames in 24 hours or after 50 sign-up attempts in one minute from the same IP address.

When Shield 1's threshold is reached, an email is automatically sent to the user, which an administrator can edit however he or she wishes. This initial email looks like:

![Affected user email](https://images.ctfassets.net/23aumh6u8s0i/7Hf4QzvX6IDVi6gl4hGRp4/8fc62d71de2ae3698d64c087b89c730c/affected-user-email)

An administrator can easily edit the template by accessing the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and following Emails > Templates.

When Shield 2 is triggered, dashboard administrators are notified. Brute-Force Protection will also block the suspicious IP address. When the issue is resolved, an administrator simply locates the user in the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and files an action to unblock. A user can also click on the "unblock" link provided in the email above or change their password.

### Breached-Password Detection

The third shield is breached-password detection. This is easy to turn on and customize in the Anomaly Detection section of the Auth0 dashboard.

![Breached-password anomaly detection with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3Oe0VufANczOhCpPtuL8iV/99ffa473077e16cd7733334c25a9c73d/breached-password-shield)

Breached-password detection is useful in instances where Auth0 suspects that a user's email has been compromised in a major security breach. (Auth0 consistently tracks these on third-party sites.) If this occurs, Auth0 will trigger the shield, notify the user, and block them from logging in until they reset their information. Breached-password detection is becoming increasingly helpful as many individuals use the same or similar iterations of the same password on multiple sites.

<include src="TweetQuote" quoteText="When Auth0 suspects that a user's email has been compromised in a security breach, Auth0 will trigger a protective shield, notify the user, and block them from logging in until they reset their information"/>

## Universal Login

Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

Universal login is a more seamless experience for the user. On the front end he or she sees a simple authentication request; on the back end, credentials remain within the same domain instead of being sent across origins. This makes it a far more secure method than exposing the information to outside sources. When personal data moves from one origin to another, [phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) and [man-in-the-middle attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks) become common.

In addition to an enhanced customer experience, universal login is simpler for administrators to maintain and provides the benefits of single sign-on (SSO).

## Auth0 Security Rules

Auth0 has developed customizable [Rules](https://auth0.com/docs/rules/current) for its app-security features. Rules are JavaScript functions that execute when a user authenticates to your application. Rules can be helpful when customizing and extending Auth0's existing capabilities. For example, the [Force Email Verification](https://auth0.com/rules/email-verified) and [User Fraud Score](https://auth0.com/rules/socure_fraudscore) Rules can be incorporated into Auth0's existing tools like Anomaly Detection to better determine if a user truly is who they say they are.

### Force Email Verification

Force Email Verification only allows app access to users who have verified their emails. Incorporating Force Email Verification into an app instead of a browser version is a good UX practice with powerful back end capabilities.

![Force Email Verification code](https://images.ctfassets.net/23aumh6u8s0i/6MhbfE6DYpGdnku3wGI9Rn/4dd87042b24817242ccde8b52d16c781/verify-email-code)

[[Source](https://auth0.com/rules/email-verified)]

For example, if you are working with a large set of emails that belong to a network, e.g., `@university.edu` or `@company.edu`, Force Email Verification can help parse individuals in a group to make sure that a fake user hasn't set up an account to blend in with the others. Force Email Verification requests that users cross-check their information; anyone who returns information that doesn't match or does not return additional information at all will be blocked from logging in.

### User Fraud Score

Like Force Email Verification, you can tack on the User Fraud Score to a variety of features. If you've built an online marketplace — like Etsy, for example — you can use this rule to cross-check everyone conducting business and thus add an extra layer of protection to purchases. The Rule calculates a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

In the Auth0 Dashboard, copy the code block above, and replace placeholders with the appropriate values. The rule will pull the fraud score from socure.com and store it on app_metadata. A full set of Auth0 Rules can be found [here](https://auth0.com/docs/rules/current).

For fraud detection, Auth0 partners with [ThisData](https://auth0.com/blog/anomaly-detection-safer-login-with-thisdata-and-auth0/). ThisData allows real-time detection of any account takeovers across both web and mobile apps.

## No Better Time To Secure Your Apps

Securing your app with the best tools is always a good decision — but it is especially timely, given the slew of new regulations: GDPR deadline has passed, but [it's not too late to comply](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/), and several countries and states in the U.S. have followed the EU with [similar privacy initiatives](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/). In line with these events, Auth0 has developed additional [strategies](https://auth0.com/gdpr-assessment/) for getting your team into alignment quickly, including [customer identity and access management (CIAM) protocol](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/).

While it might be easy to forget your apps in the swirl of demands around your core operations — making sure you plug any holes here is key to ensuring that you don't become another [data-breach statistic](https://consequenceofsound.net/2018/06/ticketfly-hacker-data-breach/).


How Auth0 Makes Your Apps More Secure

Tips for a secure and organized data migration process. 1. Workflow and project management tools 2. User identity and access management 3. Clear customer communication



Data is the foundation of a company's success. It provides the basis for customer insights, corporate strategy, and operational efficiency. As more companies embark on [digital transformation](https://auth0.com/app-modernization), migrating this critical information — particularly sensitive customer data — to a new platform(s) can be a burden. Moving data can unearth inaccuracies, unknowns, and/or duplicate entries, making it insufficient to use and requiring significant changes. 

The tips below will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users.

<include src="TweetQuote" quoteText="Data is the foundation of a company's success. This post will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users!"/>

---

## Issues That Can Arise with Data Migration
Before we dig into strategies for success, it's important to understand the issues that can arise in data migration. The process can be thorny for several reasons.

### Lack of Consideration for the Process
Teams are generally focused on selecting and configuring their new system. Testing potential tools and comparing the models are generally more exciting and inspiring than the mechanics of lifting data out of the legacy package. If data is uploaded in its current state, any errors or irrelevant aspects could become amplified and increase the information's exposure to risk. Because of this, it's important to be sure your team is on the same page about the nuances of the process and has a specific roadmap marked with individual roles and responsibilities.

### Improperly Tracking Users
It's critical to manage user identities and monitor for suspicious activity when you're migrating sensitive information. Companies that rely on consumer data, in particular, must validate all entries against new regulations — [GDPR](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data), for example, along with more specialized industry standards such as Sarbanes-Oxley (SOX) for financial institutions and the Health Insurance Portability and Accountability Act (HIPAA) for many healthcare providers.

### Poor Communication of Updates
Making sure your end users understand how you are securing their data after you've updated your apps is important for maintaining their trust. If you can't articulate what you are doing with their information, it's unlikely they will stick around. Documenting your work and developing a clear communication strategy are essential to making sure your data migration supports your company's overall goals for growth.

To address these potential issues, the following strategies focus on workflow, user access, and communications.

<include src="ebook-ads/UserMigrationYourWay" />

## 1. Organize Your Workflow and Project Management
To clearly understand and outline the steps required for a successful data migration, take time to consider the following:

- What will cause the least disruption to the daily operations of your system? That is, when are the best times to work on and/or migrate data sets of highest sensitivity or usage?
- What aspects of your strategy can you tag to teammates in-house, and where might you need to bring in outside expertise?
- How will you document your process, ensuring that all information is accounted for?
- Will you enrich your files after they have been moved with further information (e.g., customer names and/or account numbers)?

While this list is not exhaustive and each strategy will be unique, depending on an organization's current systems and future goals, it should aid in understanding the depth of thought required for an efficient data migration.

It can be helpful to use a workflow tool to organize your team and define your process. [Airtable](https://airtable.com/product) has a proven track record for improving internal organization. When mapping out your data migration strategy, Airtable can help define your project scope, set deadlines, and assign individual responsibilities.

For any task that you're organizing, Airtable will help prioritize tasks and ensure that you adhere to your overall goals:

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/38brOxQrTQvBu8Pa8BBQ17/df355af7ec95291c2abff6758ccb9694/1-airtable)

> [Source.](https://airtable.com/product)

Within the grid view, you can check to see which tasks have been completed and quickly note whom to reach out to in case of a question or concern. Airtable also has a [calendar view](https://airtable.com/product) to better visualize the timeline of your data migration, which can quickly become lengthy and arduous without clear monitoring. Both views can help break down the potentially opaque data migration process into a concrete series of steps.

Additional tools to consider for managing the task of data migration include:

- [Asana](https://asana.com/guide/examples/company/project-management): Highly customizable, popular tool for engineering teams
- [Trello](https://trello.com/): Visual workflow; bulletin-board format
- [Jira](https://www.atlassian.com/software/jira): Supports distributed collaboration

Taking time to think through your steps at a granular level and selecting a tool that will hold your team accountable will help you succeed.

## 2. Clearly Track Who Accesses Customer Data
Understanding who is accessing and updating portions of sensitive customer data at any given time during the data migration process is critical to maintaining integrity. In today's environment of [increasing industry regulations](https://auth0.com/gdpr) around consumer data, this core function must be up-to-date and as tight as possible. 

Because of the complexity and urgency of this task, many teams choose to outsource their [identity management](https://auth0.com/app-modernization) when migrating data, particularly as part of a larger [digital transformation](https://auth0.com/learn/identity-management-drives-digital-transformation/).

[Auth0's user management dashboard](https://auth0.com/b2e-identity-management-for-employees) allows a systems administrator to authorize new users, track their behaviors, and evaluate their performance according to the company's policies.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5IwuLEHPTS1w1q7UhTcUPk/277cb0224267a945a4265e0984263142/2-auth0-manage)

> [Source.](https://auth0.com/learn/cloud-identity-access-management/)

In the Auth0 dashboard, an administrator will have a clear view of users at any point. In addition, Auth0's identity platform offers enhanced options like multi-factor authentication, anomaly detection, and advanced logging. For example, if the administrator notices a certain user has a series of failed login attempts, they can [block access](https://auth0.com/docs/anomaly-detection) to investigate further. 

From a user perspective, this function is an invisible and painless part of their workflow. 

## 3. Explain Your Data Policy Changes
If you can clearly communicate your data migration and updated data usage policies to your users, you will gain their trust — and an edge over your competitors. At the moment, very few company blogs or statements spell out the details of data usage in a digestible format — as we've recently seen with Facebook's [confusing policies](https://www.wired.com/story/mark-zuckerberg-congress-day-one/). 

You have an enormous opportunity to distinguish yourself in the field if you can fill this information gap. A major data migration is a perfect opportunity for you to document previous work and latest updates. Making this information immediately visible, user-friendly, and clearly accessible is key:

![Facebook](https://images.ctfassets.net/23aumh6u8s0i/7mn6vdZtybE6e5Rlg1dSNa/10c9a53747ac05ec8598251b03153990/3-zuck)

> [Source.](https://www.recode.net/2018/3/28/17171496/facebook-settings-redesign-cambridge-analytica)

While hopefully your team will not be recovering from a data leak like [Facebook's](https://auth0.com/blog/cambridge-analytica-and-facebook/), the tech titan provides an excellent example of how to communicate a change in policy to users. Three key points to include when explaining your updates are:

1. Place a brief summary of the information on the front of the app where users will see it immediately without any digging.
2. Include a clear CTA or way in which users can click to read further details.
3. Make sure any actions your user must take to delete or update their data settings are very simple.

You must make your user feel as though they are well supported and in full control. Both sets of information — your summary and fine print — should feel friendly and encouraging. Employ your best writers and incorporate welcoming images or a set of bullet points to truly put your best foot forward.

## Don't Be Afraid to Change
[90%](https://auth0.com/learn/how-auth0-uses-identity-industry-standards/) of businesses today state that legacy software systems are keeping them from achieving their goals. Despite increasingly strict regulations, you should not be afraid to scale and innovate. Just be sure you take the process of data migration seriously as you search for your new platform. Make sure the right people access the correct pieces of data at the proper times during the migration and then seize the opportunity to demonstrate how bulletproof your new strategy is with excellent customer communications.

<include src="TweetQuote" quoteText="90% of businesses state that legacy software are keeping them from achieving their goals. Scale and innovate while paying attention to data migration to succeed!"/>


Three Strategies to Streamline Your Data Migration Process

Get inside your customers' heads by centralizing your data.



---

Having a 360 view of your customers might sound like just another marketing cliche designed to sell CRM software. But the idea—that you should have a comprehensive understanding of your customers at all stages of the lifecycle, from acquisition to referral, is essentially the holy grail of all growth marketing efforts.

> Auth0 can help B2C companies to enrich the profile of their customers through an easy to use [Modern Customer Identity Management solution](https://auth0.com/b2c-customer-identity-management). Increase brand loyalty with better conversion, boost your revenue with new user acquisition, and secure customer identity with state-of-the-art technology.

Back in the early days of apps and the internet, a 360 view was easier to acquire. User identities were simply more consolidated. You didn't have dozens of SaaS tools running off the cloud, your users' identities weren't dispersed across Google, Facebook, and every other social platform —  all your users' data was stored in your own system. You were in charge.

Those days are gone. The landscape is fragmented by all different kinds of identity providers, authentication protocols, and tools.

What you have instead is a vast explosion of user data and tools for analyzing that data. That's made getting a 360 view of your customers more technically complicated—but it's also made it far more powerful.

## Your Identity Management System Needs a Single Source of Truth

The biggest roadblock to getting a 360 view of your users is how identity is managed. The complexity begins when a user signs up for your app and it expands entropically as they use it. Your different SaaS tools and monitoring systems collect all of this information, send it back to their servers, and then you wind up fighting with their APIs and integrations to make sense of all of it.

That's why the best analytics teams begin the process of collecting data at the root—when a user first signs up for an app.

The easiest way to do that is to set up a classic 1:1 authentication system. You control user registration and login, you manage their passwords, and you are the only entity that is involved. Therefore, you have total access to your users' data and the data of any external APIs you might integrate with.   

What makes this tricky today is that federated identity management is such an established practice. You want to be enabling social and enterprise login if you have an app of any size, or a new app that you want people to feel comfortable using. Federated identity managers are simply not based on a centralized model—consolidating your customer view into one place will involve a ton of development time and effort.

That's why we built [Auth0](https://auth0.com), an identity provider that acts as both a classical identity provider and a federated identity manager.

![Auth0 Value Prop](https://images.ctfassets.net/23aumh6u8s0i/6FQek2JcD5SJ17wxsQi6tw/ab95045e16579bd858d63068c7ca7ad8/venndiagram)

This allows you create the foundations on which to start building and acting upon your 360 view of your customer:

* **Classic identity management**:
    * **Auth0**:
        * stores login credentials for every unique user
        * provides user information on an analytics dashboard
        * manages all of the users in your organization, no matter what they used to log in

* **Federated identity management:**
    * **Social login**: User and password from Facebook, Google, Twitter, etc. serve as login information for connection to the desired platform through Auth0
    ![Auth0 Providers](https://images.ctfassets.net/23aumh6u8s0i/4K4wQdWfj9upCjTaoQG2wT/6e717e3ec553b2813fd5dd1f412a2f08/auth0-social-login)
    * **Enterprise login**: Enterprise credentials are used to access a variety of systems and platforms, where the username and login are stored in an internal identity provider but connected through Auth0

> Auth0 provides the simplest and easiest to use [user interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users.

This type of data collection means that you can connect user information that would otherwise be stored in completely separate places — maybe data that isn't even collected directly by your app. Putting the missing pieces in your user profile for a 360 view gives you what you need to customize your user interaction, from onboarding to upselling.

## Automate the Error Out of Your Data Centralization

Within your own system, you use a variety of tools to help you monitor and engage with users. Maybe you have an app analytics platform to gather behavioral data, an email management system to send personalized emails, a CRM, and a login platform like Auth0. These systems tend to rely on client-side analytics, which makes the perfect storm for data to slip through the cracks.

Client-side analytics are notoriously unreliable. Because they have to be executed on the user's end when they first visit your site, they can easily be disrupted:

* Users might exit out of a page before your code runs
* They could block JavaScript (with an ad blocker, for instance)
* They might click on a link before the page has finished loading and interrupt the loading script

Meanwhile, server-side analytics are unwieldy and difficult to implement. In order to get all of your desired server-side analytics running with your system, you'll end up running through a web of APIs and [writing more and more code](https://segment.com/blog/the-way-server-side-analytics-should-be/) just to get everything working smoothly.

That's where Auth0 Rules come in. Rules are snippets of server-side Javascript that run as soon as a user logs in, eliminating the client-side reliability problem while being just as easy to set up and get going.

![Auth0 Identity Flow](https://images.ctfassets.net/23aumh6u8s0i/3fDhde4dlCPTWQh6awAULV/5f0c496d5f0636dae76328b547ca8500/flow)

With [Auth0 Rules](https://auth0.com/docs/rules), your server-side automation always gets information from your user to your tools. For example, if you wanted to create a lead in Salesforce the first time a user logs in, you can [use an Auth0 Rule to instantly send] (https://github.com/auth0/rules/blob/master/rules/creates-lead-salesforce.md) the signal to Salesforce to make a new lead.

In fact, you can connect Auth0 with pretty much any platform by creating automated actions at sign in using JavaScript. And they're just a few lines of code — not a forest of API integrations.

You need to know that your tools are going to get the data they need to help you understand how your customers are behaving, and automating a cross-platform integration ensures that you [realize the power of all of your SaaS platforms](https://auth0.com/blog/integrate-auth0-into-your-existing-saas-tools/).

## Use Your Centralized Data to Cater to Your Customers

A rich, 360 view of your customers is a springboard for fine-tuning your product to increase customer satisfaction. The way you interact with your users  from login onwards can make or break whether or not you retain those customers, no matter how good your product is.

When you're unable to consolidate all the information that you know about your customers, you can easily wind up asking them the same questions twice. Getting information about who your customers really are turns into a slow and error-prone process. When you have a centralized repository of knowledge about your users and a reliable infrastructure for gathering data on them, however, you can put much more effective and subtle collection practices into place.

A great example of this is [progressive profiling](https://auth0.com/blog/progressive-profiling/). You want to ask your users questions about who they are and why they're using your product, but you know that slamming your users with a huge form as soon as they sign up ruins your conversion rates. With Auth0, you can create a Rule that triggers every time your users log in. You can ask them questions intermittently—throughout their customer journey—rather than giving them a huge survey up-front.

![Progressive Profiling](https://images.ctfassets.net/23aumh6u8s0i/1At7rnzD0X0Q7fLQauxuUV/4899e717b5cf6f8920b905af80927397/progressive-profiling-2)

Auth0 helps you store all of this information through creating profile records. You can gather information from an existing identity (like a Facebook profile), an Auth0 Rule, or information the user adds to their profile. Each users' profile record will get updated as data rolls in, to keep all of that valuable information accessible.


Capturing and centralizing log in information is a great way to make your users' experience better, especially when it is part of a larger customer profile. When the user experience is good, your customers are satisfied, and there's nothing better for business than satisfied customers.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can help you make your product secure with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

## To Delight, You Must First Understand

Creating a complete profile for your customer is one of the most important steps you can take to turn your users' actions into insights.

Think of all the bad email marketing campaigns you've deleted from your inbox, or marked as spam. Think of all the irrelevant push notifications you've gotten. Think of all the products you've downloaded with high hopes only to see an onboarding process that seems like it wasn't designed with *anyone in mind.*

When you centralize your data collection and build up the right infrastructure around it—the kind that lets everyone on your team get on the same page—then you become capable of building truly personalized, delightful experiences across every part of your app.


How To Get A 360 View of Your Customer By Managing Identity

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

An unsecured database allowed hackers to steal personal information from over 820,000 Cloudpets customers. Learn how this may affect you and what to do next.



[Spiral Toys](http://spiraltoys.com/) is a company that creates toys for children. It has an internet-connected product called [CloudPets](http://cloudpets.com/) which allows parents and children to record and send voice messages to each other through a mobile app. On January 7, hackers discovered that the database the company was using to store data for this product was unsecured. Hackers took control of the database, deleted all information, and demanded a payment to restore the data.

![Cloudpets Homepage](https://images.ctfassets.net/23aumh6u8s0i/4ISXmWTbhcqnqACVvBoSLv/6c7cb193c8c49f69d71da5ffd32cc7bc/cloudpets)

The database contained information for 820,000+ users containing emails, bcrypt hashed passwords, and links to voice recordings customers and their children had made which could now be publicly accessed. Additional information stored included pictures, names, birthdays, and relationships. Customers were not notified that their data had been compromised.

[Troy Hunt](https://twitter.com/troyhunt) wrote an excellent [article](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/) covering this incident. Some highlights include that the database used was publicly accessible and did not even require a password to access. Cloudpets was also notified at least four times that their database was exposed and the reporters never heard back from the company. Finally, staging and test databases were also discovered which had production data that could have also been compromised.

Aside from the devops failure to secure the database properly, password requirements for user accounts were non-existant. Although the passwords were stored as bcrypt hashes, Troy was able to use [Hashcat](https://hashcat.net/hashcat/) and find valid passwords such as "qwe", "password", and "123456".

![Cracked Bcrypt Hashes](https://images.ctfassets.net/23aumh6u8s0i/1ChTEWQXZQBJD3YjBclNhX/76bdc049376598ed8261792961ad335d/cracked-bcrypt-hashes)

Source: [Troy Hunt](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)

Since the database has been publicly exposed since at least December 25, 2016, it is safe to assume that many malicious parties have accessed and downloaded the data. We urge customers that have Cloudpets accounts to change their passwords and monitor their other accounts for signs of malicious activity.

## Personal Information Security Guide

Even if you don't have a Cloudpets account, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, best practices for choosing good passwords, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

## Auth0 Can Protect Your Users and Apps

Managing identity is a complex and difficult task. At [Auth0](https://auth0.com), our goal is to make identity simple for developers. A recent feature we launched called [Breached Password Detection](https://auth0.com/breached-passwords) can help alert your users that their credentials have been compromised in a data breach when they login to your app. We are still working on getting and adding credentials from this breach to our database to better protect your users. This feature helps your users stay safe, but also protects your apps from malicious access. Additionally, Auth0 meets the standards for various [password strength requirements](https://auth0.com/docs/connections/database/password-strength), provides [multifactor authentication](https://auth0.com/multifactor-authentication), and more.

If you want to make identity simple and secure for your applications, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">give Auth0 a try</a>.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Cloudpets Data Breach Affects Over 820,000 Customers

Tavis Ormandy, a vulnerability researcher at Google, discovered that Cloudflare was accidentally leaking sensitive data including passwords, private messages, and more. Learn how this may affect you and your customers and what to do next.



On February 17th, Tavis Ormandy, a vulnerabilities researcher at Google, sent the tweet that kicked off 2017's biggest security story yet:

![Tweet](https://images.ctfassets.net/23aumh6u8s0i/70lrHor3JHJ2mpMhcIYmD0/a8ae61fe8062a2abad060c9707f51819/tweet)

*Could someone from cloudflare security urgently contact me.* That's not something anyone wants to read on a Friday afternoon, but especially not when it's coming from one of the world's top infosec researchers.

The problem? While doing some routine bug checking, [Ormandy](https://twitter.com/taviso?lang=en) saw some data that did not match at all what he expected to find.

"It's not unusual to find garbage, corrupt data, mislabeled data or just ... non-conforming data...but the format of the data this time was confusing enough that I spent some time trying to debug what had gone wrong, wondering if it was a bug in my code," [he wrote](https://bugs.chromium.org/p/project-zero/issues/detail?id=1139), "In fact, the data was bizarre enough that some colleagues around the Project Zero office even got intrigued."

The rest of the Google Project Zero team (a team of security researchers employed specifically to find new [zero-day exploits](https://en.wikipedia.org/wiki/Project_Zero_(Google))) probably expected Google's announcement of the first [practical SHA-1 collision](https://auth0.com/blog/sha-1-collision-attack/) to be the big news of the week.

As they looked closer, they found “encryption keys, cookies, passwords, chunks of POST data and even HTTPS requests” for all sorts of different sites using Cloudflare—private messages, reservations, plaintext API requests from a password manager, hotel bookings.

How did all of this happen?

## Cloudflare was dumping memory across the web

It begins with a simple bug in the code to Cloudflare's highly popular reverse proxy service. HTTP requests to certain types of sites signed up with Cloudflare would trigger the bug, which would then "leak" data from random* *Cloudflare customers' sites (those that happened to be in memory at the time).

![Cloudflare](https://images.ctfassets.net/23aumh6u8s0i/SFApl9rEVZFr1bZEQnm2k/1df7cc080c9c802b225f4610a0daee12/cloudflare)

*A simple depiction of how a reverse proxy like Cloudflare's works. Since reverse proxies are shared between customers, data from all was at risk of being disclosed.*

Since September, random bits of data have been coming out of initialized memory and leaking across random Cloudflare customer's sites. In other words, if you went to visit a site that used Cloudflare, you could have had other people's sensitive information “leaking” into your own browsing session.

When search engines “crawled” these pages to index them, the same kind of information “leaked.” Because search engines cache the output they receive when they visit a page, all these leaked tokens, secrets, and messages were indexed, split up and spread across *millions* of pages of search results.

![Search Results](https://images.ctfassets.net/23aumh6u8s0i/569KQNvP3RuTSc2z9FCZy/83586ba930635d2bace66281330bc291/SERPs)

(Source: [Wordfence](https://www.wordfence.com/blog/2017/02/cloudflare-data-leak/))

While Cloudflare is working with the major search engines to purge their caches of sensitive information now, it's hard to avoid thinking about the paranoid version of events.

Paranoid version: state actors, or state-sponsored actors with significant resources, discovered this vulnerability before Google did. They found a way to send manipulated HTTP requests to Cloudflare sites that would output a predictable stream of user data—and have either packaged everything they found for resale or set about figuring out how to crack what could be billions of passwords, credit card numbers, and secret tokens.  

Cloudflare claims they can rule out this scenario with access logs, but whether or not that's true has been subject to [some debate](https://news.ycombinator.com/item?id=13721452).

> Auth0 can improve software security with the breached password detection feature. [This feature protects and notifies your users when their credentials are leaked by a data breach of a third party](https://auth0.com/breached-passwords). You can optionally prevent access until the user has reset their password.

## What you should do now

The way that data was disclosed means that any site using Cloudflare could potentially have had its secrets and tokens compromised. Patreon, Yelp, Uber, Medium, Fitbit, and OKCupid all use Cloudflare—for a full list of sites you can [click here](https://github.com/pirate/sites-using-cloudflare). Several tools have also been [built to assess your risk](http://www.doesitusecloudflare.com/), like this script that [crawls your Chrome history](https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d586f064).

Though many, many sites use Cloudflare, at least to some degree. It's still quite unlikely that your personal information has been exposed. Many of the individual sites mentioned have also come out and written posts to explain whether you should be concerned—perhaps most notably, 1Password, which was initially mentioned in Tavis's tweets as a [potentially compromised site](https://blog.agilebits.com/2017/02/23/three-layers-of-encryption-keeps-you-safe-when-ssltls-fails/).

The first thing you want to do to protect yourself from this and future incidents is to enable [multifactor authentication](https://auth0.com/multifactor-authentication). The most important sites to enable MFA on are the ones you use as an SSO iDP—if you're logging into 20 different sites using your Google credentials, then you definitely want to enable some form of MFA there.

While it's unlikely your passwords were exposed, this is as good a reminder as any that you should be using strong, unique passwords and organizing them using a password manager.

Resetting individual passwords for sites doesn't make much sense—the list of compromised sites is simply so vast. The only solution is to do a mass reset and make sure you're using proper password hygiene going forward.

## What you should do for your customers

As a site operator, you're probably wondering 1) if you're at risk, and 2) if any of your users' data was exposed in this incident.

Cloudflare has already reached out to domain owners that they have proactively identified as being at risk in this leak. However, the absence of notification does not mean that your domain (and customers) are safe.

First off, enable multifactor authentication [if you haven't already](https://auth0.com/multifactor-authentication). It's the easiest way to get a huge boost to the security of your site.

Many site operators have begun forcing password resets for all of their users. If you run a consumer site, it may not be worth the trouble and inconvenience. If your customers are in the enterprise, then it is probably a very good idea to force a change. If you're not going to make your users change their passwords (and from a cursory browse of the web this Monday morning, it appears that this is mostly the case), then you should at least recommend it.

As far as data invalidation, any secrets which you can easily rotate—session identifiers, tokens, keys—should immediately be changed. Customer SSL keys do not appear to have been compromised in this incident, but it would be prudent to change as much data as you can which may have passed through Cloudflare.  

If you or any of your customers are regulated by the Health Insurance Portability and Accountability Act (HIPAA), then you'll [definitely want](https://www.aptible.com/blog/aptible-was-not-affected-by-cloudbleed/) to have your security/compliance teams get in touch with your lawyers and discuss whether this is a breach that needs to be reported.


What Cloudbleed Means for You and Your Customers

ryan-chenkie

Ryan is a full-stack JavaScript developer and trainer who mainly works with React, Angular, Node, and GraphQL. He runs a consultancy where he builds apps for companies and also helps established dev teams with their modern JavaScript challenges.<br /><br />Ryan is a Google Developer Expert, the host of the Entrepreneurial Coder Podcast, the author of Securing Angular Applications, and an all-around fanatic about application security.

Developer

Ryan Chenkie

For B2C companies, nothing beats knowing who your customers are and what they want.



---

**TL;DR**: Knowing your customers is key when it comes to effectively selling to them. In this article we'll explore four ways that you can put user data to work to get to know who your customers are, what they want, and how to serve them better.

---

Business challenges exist in all industries, which is a reality that organizations need to contend with and work past. However, for businesses that are strictly consumer-facing, such as retail, some challenges can be greater than they would in others industries. For most companies, it doesn’t make any sense to target all consumers with a given offering because there’s no way to serve absolutely everyone. As the saying goes, if you try to cater to everyone you’ll end up serving no one. What B2C companies are left with, then, is the need to get specific and target a subset.

Narrowing down to a smaller target audience isn’t a silver bullet though. Even at that point, it can be difficult to find optimizations for how to market to this subset because the crowd might still be quite diverse. Perhaps your retail business has stats that say your signature women’s jacket is most popular amongst 25 - 34 year olds in Europe. Chances are good that your total audience doesn’t solely consist of this niche group. A challenge that exists in this case is how to optimize the marketing process so that effort isn’t wasted on those who likely won’t be interested in your offering.

There are many different ways that B2C companies can optimize their marketing processes, but one that can easily be overlooked is through the user authentication process. Assuming you run a website to either augment or act as the sole source of your sales, it turns out that there are a lot of ways your B2C company can use the login process to benefit your overall marketing. The key to it is insightful user data.

## 1 - Build Up Your Customers’ Profiles with Social Data

While it may be true that your customers are all unique individuals with their own hopes, fears, and dreams, there are some attributes that will be shared amongst most of them. Things like age, gender, location, and product preferences are just a few examples of user details that can be common to more than one of your customers. These are pretty typical details for companies to collect, so perhaps you’re already gathering this kind of information.

While this info is great to have and can be helpful, it really doesn’t give you the full picture of your customers. The good news, however, is that you can do better at building up a profile for your customers by leveraging their social data that comes from providers like Facebook, Google, and Twitter.

### How it Works

Chances are good that you’ve come across a website or application that allows you to log in with one of your social accounts. It’s all made possible through OAuth 2.0, a specification that enables a third party (such as a social provider) to authorize users on behalf of the requesting application.
While this is great for the user experience because logging in is a snap, there’s an even greater upside that can be realized by your company if you implement social authentication: you can collect information about your users from their social accounts. Lots of it--valuable bits of info like what events your customers have attended, which ads they’ve read and responded to, and much more.

Did a red light just go off for you? You might be wondering if this infringes on your users’ privacy. Surely your customers wouldn’t want you to know this much information about them and use it for your own marketing purposes, right?.

The key here is that your users all need to consent to sharing this information with you in the first place. When you request that they share it, they are asked very clearly if they’re ok with it. For some users, the answer is no. But for many, the answer is yes, and if it’s a yes, you now know that customer better than you did before.

### The Benefits

The benefits of having more user information for marketing purposes are probably obvious: you can use that information to target your offers to specific customers. Instead of marketing to your customers en masse, you can pick out very specific subsets and craft offers that are specific to them, all while having confidence that there’s a better chance they will respond to these offers because you have data which says so. You can analyze this enriched user information and pull out insights that wouldn’t be possible without social data.

![customer data dashboard](https://images.ctfassets.net/23aumh6u8s0i/3O0KLdg0zMCROLOjF31Zuj/15b74b19efbd8cb8f4bfb931dd4aba64/customer-data-1)

## Social Data is Easy with Auth0

Enabling social login is easy with Auth0, especially when you use the [Lock widget](https://auth0.com/lock) in your application. After <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">signing up for Auth0</a>, select the social identity providers you want to allow your users to log in with. You get to choose which pieces of profile information you’d like your customers to share with you.

![customer data facebook](https://images.ctfassets.net/23aumh6u8s0i/kdHOoDphw5DxTvPzsaeog/d92ff7959a3b9494f843fa1814f0a140/customer-data-2)

When users log in with the social providers you have enabled, their data will be sent back and stored in their Auth0 profile. With this raw data in place, you’ve got a lot of options for using it to support your marketing efforts. For example, you can use the [Auth0 management API](https://auth0.com/docs/api/management/v2) to query your user data for parameters that match what you need for your campaign.

## 2 - Enhance Your Customer Info with Progressive Profiling

When enriching your customers’ profiles with social data, there are times when it’s just not possible to get all the information that you’d like. Perhaps the customer isn’t willing to share their information, or maybe they just don’t have a very robust social profile to begin with. In these cases, there’s another option: progressive profiling.

If you’re a LinkedIn user then you’ve probably already seen progressive profiling in action. In essence, progressive profiling is all about collecting user information in small quantities over time, all while providing messaging to the user which encourages them to do so. There’s nothing worse than needing to fill out dozens of form fields all at once just to start using an application. It makes for a terrible user experience, and is certainly a point of friction that can drive many customers to look for something better. With progressive profiling, you ask for just a tiny amount of information from your customers each time they log in to your app, which greatly reduces the perceived burden of filling out form fields.

### Benefits of Progressive Profiling

While it takes longer to collect user information through progressive profiling, it’s well worth the wait. It makes for a much better for user experience, so the chances of you not losing a new customer right off the bat due to a poor experience are greatly diminished.

More than this though, it provides a way for you to get the same (or similar) information you would from your customers’ social providers. You have control over the questions you ask, and just like a customer can choose to disclose information from their social profiles or not, they have the option of providing an answer to your questions or passing. Could your marketing efforts benefit by you knowing which new movies your customers have watched in the last month? Ask them the next time they log in. Sure, some might pass, but others will give you this information because they are primed to do so through consistency and commitment.

![progressive profiling question](https://images.ctfassets.net/23aumh6u8s0i/5vnD7NjR6Q06SnDjcYUKT2/a33eb7cb3d39965e8c38f2df56ed3f3c/customer-data-3)

![progressive profiling question](https://images.ctfassets.net/23aumh6u8s0i/6rs6KgXFAGwzgsQeNy6BgO/5a287c0918773a57f97814daab2eae93/customer-data-4)

## Progressive Profiling is Easy with Auth0

Auth0 gives you full control over the data stored in your users’ profiles and it can be modified by using the [Auth0 management API](https://manage.auth0.com). To create progressive profiling for your application, you can create a series of “drip” questions you’d like your users to answer and then check whether or not the answers to those questions exist in your users’ profiles when they log in. If the user hasn’t answered a question, you can prompt them for it and save the answer in the user’s profile via the API.

## 3 - Get More Info with Third Parties

Social data and progressive profiling are great ways to enrich your customers’ profiles, but the story doesn’t need to end there. If you’d like to go even further, you can also get creative by consulting third parties for even more user information. There are a lot of options in this area, some of which are free. For example, if you want to know what the median income is for your users’ zipcode, you can query the US Census Bureau API. Or, if you’d like more personalized information, you can use an app like [FullContact](https://www.fullcontact.com/).

FullContact gathers and reports publicly available user information that comes from a multitude of sources. This is really helpful because although your customers likely have multiple social accounts, chances are they’re only going to use one preferred provider to log into your application, meaning you can only get social data from that single provider. Since FullContact gathers data for any visible social accounts a user has, the information in your customers’ profiles becomes a lot more robust.

![auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/61nTgqgbBXLygWQ0awUIBo/592054382ea129e51c74337ce86d158e/customer-data-6)

### Further Enrichment is Easy with Auth0

Auth0 provides a robust [rules engine](https://auth0.com/docs/rules) which allows you to augment the authentication pipeline any way you like. This pipeline is the perfect spot to add logic to send your user’s data to a third party. For example, if you want to use FullContact, you can use a rule which sends the user’s email address to it when they sign up. You can also choose to save the information that comes back from FullContact in the user’s Auth0 profile. In fact, this rule--and many others like it--are already written for you and can be enabled with a click.

![auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/3Q20GjBGwU2lEKytfoj85o/653ab3af136323655d5bb8dff4137c4e/customer-data-5)

## 4 - Go Even Further: Analyze Your Customer Data

Services that provide additional information about your users such as FullContact can be very helpful, but another way to get to know your customer base better is by slicing and dicing your own data. There are plenty of services that can help you manage your customer data, and one great example is [Lytics](https://www.getlytics.com/). Lytics allows you to upload or send your user information to their service where it can be collected and later analyzed.

![auth0 lytics](https://images.ctfassets.net/23aumh6u8s0i/5jvgV8f5bXQmISvH3k4CwG/75d13402acc8447a7626ab7b45e3795d/customer-data-7)

### Sending Customer Data is Easy with Auth0

Sending user information to a service such as Lytics can be cumbersome, and in many implementations you might be required to write a fair amount of code to arrange communication with their API. With Auth0, however, this is a breeze. In much the same way that you can use Auth0’s rules engine to send data to services like FullContact, you can create your own custom rules to send data to Lytics when a user authenticates in your application. Simply write (or modify) a little bit of JavaScript to create a [rule](https://auth0.com/docs/rules) which augments the authentication pipeline to send data to the REST API that Lytics exposes, and you're good to go.


## Wrapping Up

Rich customer identity data is becoming one of the most important ways for B2C businesses to market and sell effectively. Not only is this data important for marketing purposes, but it’s also key to knowing your customers better in general. 

If you’re not yet using social data to enrich your customer’s profiles then you’re missing out on some important opportunities. The good news is that Auth0 can make this process very easy and also solve many important authentication problems in your apps at the same time. If you’re interested in knowing more about how customer identity can benefit your company, [get in touch](https://support.auth0.com)--we’d love to chat.


Customer Data is King: Four Ways to Know Your Customers Better

Using multi-tenancy you can cut costs and still allow your customers strict control over their data



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

## What Is Multi-Tenancy?

A multi-tenanted software architecture allows you to serve multiple customers from a single application instance running on a single server, or pool of servers. This is in contrast to a single-tenant application where each customer would have a dedicated software instance running on dedicated servers. Thus,

* Multi-tenant: One instance, multiple customers.
* Single-tenant: One instance, one customer.

A tenant is defined as a group of users who share access to that application instance. For instance, this could be a company with multiple employees, all who have access to your SaaS service. In a multi-tenant architecture, a single instance of your application would be shared across multiple companies (tenants), and across multiple employees within those companies.

Every tenant would however have a dedicated share of that instance, and multi-tenant application can then be customized for each specific tenant's need, in particular:

* Branding: Each instance would likely need to be “skinned” to fit with the branding of the organization. This is akin to how [Lock](https://auth0.com/lock) can be customized for each user's login page.
* Functionality: Each tenant may require certain workflow changes that fit better with their business.
* Access Control: Each tenant will want to set the permissions, rights, and roles of their users independently.

## The Benefits of Multi-Tenancy

Building multi-tenant applications conveys a number of benefits for a SaaS company:

**Scalability**: There is overhead associated with spooling up each application instance. Extra processing power and memory is required over and above just that for the single instance. Additionally, resources can be shared across tenants in a multi-tenant architecture.

For example, if a SaaS company had 10 tenants, and each tenant needed just over 1 server to fulfill their requirements (say, 1.1 servers), in a single-tenant architecture this would require 20 servers as each tenant would need dedicated servers. In multi-tenant architectures, only 11 servers are needed, as resources can be shared easier.

**Data Handling:** It is easier for the SaaS company to handle and utilize data when it is aggregated in a single location. In a single-tenant application, data will be spread across multiple databases and will need to be pooled for any further analysis by the SaaS. In multi-tenant, this data is easily available, so running queries across multiple tenants and analyzing trends is simpler.

**Release Management:** In a multi-tenant application, there is just one codebase running on a single server or pool of servers. When a fix has to be implemented to the codebase, it just has to be rolled out to this single instance and there is no need to update multiple servers or locations. For a single-tenant application, each instance will need to be patched independently, and tests run on each.

## Why Multi-Tenancy Is Difficult

Building multi-tenant applications is a challenge as it requires significant planning and forethought to go into the initial coding. As there is no physical separation between different tenants like there would be with single-tenant architectures, all the separation has to be resolved in code. Developers have to:

* determine the tenant a request was intended for
* protect against data leakage
* isolate configurations
* run individual logging and background tasks per tenant

Additionally, as each tenant’s data is stored together, significant security testing is required to make sure each tenant has access to only their data.

## Using Auth0 To Build A Multi-Tenant App

Authentication and authorization are fundamental to multi-tenant architectures. Correctly authenticating individual users within a tenant organization and determining what they are authorized to access are paramount to this software model.

<include src="TweetQuote" quoteText="Authentication and authorization are fundamental to multi-tenant architectures."/>

Learn more about how to use multi-tenant applications within Auth0 in the following link: [Using Auth0 with Multi-tenant Apps](https://auth0.com/docs/saas-apps).

![Creating Auth0 Applications](https://images.ctfassets.net/23aumh6u8s0i/3qddAPTPmpgnrhA484an8Y/fb8914127037a897f112fb041cd7772a/applications)

You can use the [Auth0 API](https://auth0.com/docs/auth-api) to authenticate and authorize users for each application easily:

* **Authenticate** users established by their email address. This could either be through custom email/password combinations with a rule set up to determine the tenant via company email (home realm discovery), or via identity federation such as LDAP, Active Directory, or custom SAML providers.
* **Authorize** users by assigning different roles within the company. This would be managed through metadata.

Metadata in an Auth0 user profile allows you to associate specific information to any authenticated user. In the user profile, Permissions, Groups, and Roles are all special cases of these attributes.

For instance, a user might be authenticated for multiple tenants and have different roles in those tenants:

```json
{
  "email": "matias@auth0.com",
  "app_metadata" : {
    "permissions" : {
      "auth0" : {
        "role" : "admin",
      },
      "sharelock" : {
        "role": "user",
      }
    }
  }
}
```

The logic of the applications can then use this metadata to restrict or allow users access to data and instances as the roles allow.

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


"customer data"