Anne Ellegood

Anne is our Social Impact Product Marketer with extensive experience developing & delivering marketing programs for products, services, and partners that enable sales and build brands. In addition to being an amateur archaeologist, Anne is a self-professed data-hoarder fueled by curiosity & the quest for inbox zero zen.

Product Marketing Director

Nonprofit staff are the first line of defense you have, so here's what they need to know

As a leader of a mission-driven organization, you know that all nonprofit, non-governmental, and charitable organizations count on every stakeholder to help bring their mission and programming to life. The one tool they all have in common?

**Data.**

It doesn't matter if this data is being actively used or waiting for its turn to influence a crucial decision; it's always of measurable value.

It powers nearly all of a nonprofit's business functions; and contains critical information from organization programs and finances to the financials, identities, and personal information of every person in the organization's ecosystem. In ill-equipped, improper, untrained, or ill-intended hands, mishandling of this data can cause unpredictable damage to an organization and its stakeholders. 

## Data Protection – the Fundamentals

Although the responsibility of a nonprofit's data protection and security may fall to a designated individual person or team, even they can't monitor the thousands of actions stakeholders take with their data every day across the organization.

When it comes to keeping data safe, the best defensive measure is an educated and security-aware workforce. However, this is not always the case with nonprofit employees, who can often lack the general awareness and ongoing involvement necessary to play a more active role in safeguarding data. It is essential to include everyone in building an environment where personal responsibility contributes to the organization's cyber well-being.

So what are three fundamentals that can empower your people?

## Fundamental 1: Communicate Policies & Procedures Regularly

As part of staff onboarding, review any data protection and security policies and procedures in place across your organization. All contributors should know what is expected of them. Leaders should make sure this information is kept current and that all staff, and any non-internal parties, are informed and provide an acknowledgment that they've reviewed your policies and procedures as they're made available and updated.

> ⇒ Unsure of where to start with creating policies and procedures for data protection and security, or looking to review what your org has in place?

   

> Check out [Cyber Essentials from CISA](https://www.cisa.gov/cyber-essentials), which is an excellent resource for building a culture of cyber readiness within your organization and CISA's [Cybersecurity Framework](https://www.nist.gov/cyberframework); a gold-standard in helping org's understand and improve their management of cybersecurity risk.

Individual contributors should expect to review this information upon onboarding and throughout their tenure with your organization. If this hasn't been the case, then just ask. Everyone plays a part in keeping data protected and secured. If you're an individual contributor on some (or every) level of the organization, YOU are the best line of defense. Review security policies and procedures and frequently refresh, at a minimum, twice annually.

## Fundamental 2: Ensure Compliance

PII (Personal Identifiable Information), GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), CCPA (California Consumer Privacy Act), and PCI DSS (Payment Card Industry Data Security Standards) — are just a few of the many regulations and standards regarding data usage, protection, and security compliance a nonprofit may encounter and be responsible for adhering to. And what's more, these rules and regulations vary greatly. 

To give you an idea of just how vast protection and privacy laws are around the world, check out this [interactive map](https://www.dlapiperdataprotection.com/) from the global law firm, DLA Piper.

All staff and vendors supporting your organization's mission should understand the compliance regulations and standards regarding the data they have access to and work with. Staying up-to-date on changes in regulations is paramount. Failure to remain current and comply with these regulations and laws may result in heavy fines and/or legal action being taken against a nonprofit.

If your organization relies on vendors who have access to your organization's data, request their most current privacy and security policies and audit reports. Review them and ask for clarifications on anything that may be unclear. It's important to understand the measures they're taking to protect and secure _your_ potentially sensitive data. 

For example, visitors to Auth0, a product unit within Okta's online properties, can learn more about our trust and compliance policies through the information we've provided here:[ https://www.okta.com/trustandcompliance](https://www.okta.com/trustandcompliance)

## Fundamental 3:  Access Accountability

Working remote, working from work, or some variation of the two? In order to access data needed for work, connectivity to a network and login credentials are needed. No matter what your role is at a nonprofit organization, there are some basic measures you can take to safeguard access to the nonprofit's data:

* When connecting, ensure the network is PRIVATE and SECURED. (Public wifi isn't recommended)
* Using unique, random passwords preferably created by a password manager with the longest character count possible (ideally at least 16 characters at the minimum) will help ensure your login credentials are not easily guessed
* Enable [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) on all your important work and personal accounts. Multi-Factor Authentication, MFA for short, can reduce the likelihood of cyberattacks from stolen credentials. MFA works by requiring additional verification information (known as factors) when they log in using a username and password, providing further proof of identity
* Avoid sharing your account credentials information with anyone in any format (written, electronic, verbal, etc.) 
* Leaders should enforce the _principle of least privilege_ when it comes to who has access to the organization's data at all levels based on their individual role and need. This should be reviewed often and updated whenever there are changes in people or technology 

> **_⇒  The principle of least privilege is a concept in security limiting a user's access rights to only that which is required to do their job_**

These are just the three basic fundamentals for mitigating data risk in a nonprofit at the staff level across the organization. **All staff could benefit from the helpful information we've compiled to create Auth0's resource, [Your Personal Cybersecurity Checklist: Workplace Edition](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist-workplace-auth0dotorg).** The checklist covers basic workplace cyber hygiene, personal cybersecurity, and advanced workplace cybersecurity actions every staff member can follow. It's a great place to start your organization's journey to being more secure and assured in 2022 and beyond. 

<include src="asides/AboutAuth0" />

3 Fundamentals in Data Risk Mitigation for Nonprofit Staff

ben-dechrai

A technologist with a staunch focus on security and privacy. I love helping developers find the joy of experimentation, and designing unconventional solutions for the purposes of learning something new.

Developer Advocate

Ben Dechrai

What is Developer Day? Developer Advocate, Ben Dechrai, explores the lineup and shares his thoughts from a delegate's perspective.

You’ve probably heard by now that [Okta and Auth0 have joined forces](https://auth0.com/blog/developers-explore-okta-auth0/). As a developer advocate for Auth0, I’m really excited to see how we can combine our forces to make identity even better for the developer community.

You might not be aware that I’m a huge fan of creating events that directly address the needs of developer communities. From the first conference I ran in 2004 to the user group meetings that are still going to this day, you can imagine my excitement when I heard we (Auth0 and Okta) were going to run an online event together!

This time, members of my team are taking the lead, so I'll be in the same boat as many of you experiencing Developer Day as it happens, so I thought it might be helpful to share my thoughts on the event and what I’m looking forward to the most.

Hit up the [community forum](http://community.auth0.com/) if I miss something that’s important to you &mdash; there’s so much for everyone, I’m sure you’ll help others out too.

## What Is Developer Day?

[Developer Day](https://www.okta.com/developerday/) creates a space for all developers to discover how the identity space is evolving, learn best practices in privacy and security, and gain insights from developer experiences. It brings speakers from across these sectors right to your desktop, and best of all &mdash; it’s free!

> Speaking of free, did you know you can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> at any time? Why not try it out today?

![Developer Day speakers Cassidy Williams, Alyssa Miller, and Kapehe](https://images.ctfassets.net/23aumh6u8s0i/12g1Ga4gP8X04Xn0H0nnFt/5b4ae4b06847a028d9a784a46ec48b26/cassidy-alyssa-kapehe.png)

More specifically, it’s a one-day, single-track, virtual event, and while I’m proud to see some of my colleagues’ names in the speaker list, the lineup also features the likes of **Cassidy Williams** (Director of Developer Experience at Netlify), **Alyssa Miller** (Hacker, Researcher, and Security Advocate), and **Kapehe** (Developer Relations at Sanity.io, and yes, you might remember she used to [work at Auth0](https://auth0.com/blog/authors/kapehe-jorgenson/) too).

## What Can I Learn?

The first place I tend to go when looking at an event is the agenda, and skimming over this one, we’re in for a breadth and depth of information.

The keynote is where the day’s journey starts, and Alyssa’s **updates from the world of cyber security** are sure to offer a great insight that sets the foundation for the day. I’m a huge advocate for helping all developers understand security principles and states of play. Even if you never have to deal with part of it yourself, you’ll always benefit from knowing why something is done and how you’re being protected.

## From APIs to IoT: Live Demos and Security Fundamentals

From there, we meander down a path from securing Python APIs to securing your Home Automation and IoT devices. Personally, I’m a sucker for anything IoT-related, so I’ll be paying attention to this one.

![Developer Day speakers Aaron Parecki and Vittorio Bertocci](https://images.ctfassets.net/23aumh6u8s0i/hd4kE3aQJFlX45nvwu3xF/6496580a2a7c7da50a6591f781035097/aaron-vittorio.png)

Having grown up on YouTube videos (okay, I’m not that young...) about identity from both Aaron Parecki (or as I like to call him, Mr OAuth, but don’t tell him I told you) and Vittorio Bertocci (the man whose identity knowledge is dwarfed only by his magnificent hair), what better than a talk from both of them? The talk will not only cover where we’ve come from, but what the future of OAuth has in store for us.

## Advanced Topics like Verifiable Credentials and Integration with Third Parties

But identity isn’t just about logging in and loading your glamour shot from Gravatar. I just recently learned about verifiable credentials, and wow - it’s such a powerful concept with so many use cases, I just can’t even! The topic deserves its own article, but one example is around payments, and Uchi Uchibeke’s talk is going to be fascinating, to be sure.

![Developer Day speaker Uchi Uchibeke](https://images.ctfassets.net/23aumh6u8s0i/71FxWB7JqseFrDM9mF63Go/bd98bfcda1f9662b1c7de0bfab486599/uchi.png)

Uchi is flanked by demos on integrating Auth0 with NextJS for securing your webapps and Okta with Kong for securing continuous integration, delivery, and deployment. I think this highlights that the team who worked on the agenda really put a lot of thought into the balance between talks that can have immediate benefit to us developers, as well as enough advanced topics to keep our creative juices flowing.

Talking of immediately applicable information, if you want to learn how to validate REST API authentication and authorization, the JFrog talk is for you.

## Authentication in Gaming and Extended Realities

If you thought the IoT talk was a bit out of the box, the Gaming and XR talk might just be in a whole other room! Not literally. I mean &mdash; it’s a virtual event. There aren’t any rooms. There aren’t any boxes either, for that matter. I digress.

I won’t admit to being a huge gamer. I load up Poly Bridge 2 every now and then. Does Minesweeper count? One thing I do know, though, is that the authentication experience in games can be awful, and when you get into any extended reality (XR), well. Let’s not go there.

![Developer Day speaker Nick Gamb](https://images.ctfassets.net/23aumh6u8s0i/2REEADn8ARvYmok2WNAt5O/9185928ac397dced701f3cb2d252e4b9/nick.png)

We’ll let Okta's Nick Gamb go there instead, as he tells us about the propensity for this industry to be targeted by hackers. Follow his advice, and maybe we can all keep playing in the knowledge that our Minedimes are safe. (See &mdash; I told you I’m not a huge gamer.)

## Adding Pixie Dust to Enhance Security

![Developer Day speaker Milecia McGregor](https://images.ctfassets.net/23aumh6u8s0i/2tBAGZHtBlb4Dt1P21WzAS/2cd4c6438265b64c39bb39b89e6945b9/milecia.png)

With two talks left for the day, I’m personally keen to catch Milecia McGregor from Mediavine talk about pixies! Stop it, autocorrect. PKCE! While most SDKs magically hide away much of the implementation, it’s still worth understanding how authentication flows work and how they can be improved. The most common OAuth flow is debatably the Authcode flow, but PKCE makes it even better! Come along to find out how. I’ll be at the front taking notes.

## Closing Keynote

It’s a packed event &mdash; thank goodness there are a couple of breaks during the day &mdash; and we finish with a closing keynote from Cassidy Williams. The agenda teases us with the mere existence of this session, and perhaps we’ll find out more before the event. In any case, I’ll not be missing it.

Tell us in the [community forum](http://community.auth0.com/) what you’re looking forward to the most, and I hope to see some of you in the chat room on the day!

Developer Day Helps Developers Build the Future of Identity

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The essential tools for managing user identity and how they impact your bottom line

Customer Identity and Access Management (CIAM) is how companies give their end users access to their digital properties as well as how they govern, collect, analyze, and securely store data for those users.

CIAM sits at the intersection of security, customer experience, and analytics. Providing an easy, frictionless way for users to onboard and log in is critical for driving conversions and building customer loyalty. Protecting sensitive data from malicious intrusion and taking steps to prevent data breaches is central to a sound security policy and compliance with data privacy laws. And compiling user data into a single source of truth is essential to understanding your customers.

Given CIAM’s complexity and dynamism, many organizations choose to engage a third-party [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider rather than build a solution in-house.

Below, we’ll discuss the elements of a modern CIAM solution and how your company’s approach to customer identity can impact top-line revenue as well as mediate bottom-line security risk.

<iframe width="560" height="315"" src="https://www.youtube.com/embed/belLEwjr9zQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Essential Elements of CIAM

Organizations need Identity and Access Management (IAM) solutions for several classes of end-users: employees, enterprise customers, and customers. But each type of user requires a different balance of security and user experience (UX). That’s why CIAM solutions provide a unique set of features distinct from B2B or workforce identity solutions.

Here are four features that form the bedrock of modern CIAM solutions. No two CIAM solutions offer exactly the features in the same way, but if you’re purchasing a CIAM platform, it should include the following:

### Scalability

Unlike workforce identity solutions that support thousands of employees and vendors who require fairly static access to a pre-assigned list of applications, CIAM has to scale to millions of users — often in response to short-term events like peak holiday seasons or major sporting events.

Although not traditionally described as a software “feature,” scalability is a unique element of CIAM that requires third-party, cloud-scale stability.

### Single sign-on
Single Sign-On (SSO) allows users to log in to one application and automatically be logged into a set of other applications. The most widely known SSO example is Google G Suite, where logging into your Gmail means you’re automatically logged into YouTube, Google Drive, and other Google platforms.

SSO is a basic element of federated identity, and there are SSO options for B2B and workforce IAM solutions. The type of SSO that’s specifically designed for end-users is [social login](https://auth0.com/learn/social-login/), which allows users to verify their identity with their credentials from a separate provider, like Facebook, Google, or Apple.

![Enabling Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3q11XLTm7JG97Zui0NdS83/69c34978d5b60a9fbfaceb42459b0334/enabling-social-connections)

Social logins greatly simplify the registration process for users, which can lead to increased conversions and fewer customers abandoning their shopping carts because they got tired of filling out a form. (More on the advantages of SSO later.)

### Multi-factor authentication

Multi-Factor Authentication (MFA) is a more secure means of authenticating user identity than the traditional username/password combination. Passwords are distressingly easy for hackers to steal or guess, so MFA demands an extra credential for users to prove their identity. This could take the form of a one-time PIN sent to the user’s mobile device, an email, or a biometric credential like a fingerprint or face recognition. Auth0 is even releasing a feature in which users can receive a phone call with a voice message of their one-time PIN.

![MFA Voice Recognition 1](https://images.ctfassets.net/23aumh6u8s0i/4uESmkHbV2FMThLWcAvqsi/90e5f72b2eca085e8bae37d60179c2b6/mfa-voice-recognition-1)

![MFA Voice Recognition 2](https://images.ctfassets.net/23aumh6u8s0i/3BLSbVxpLMYbflpxDk3FSb/2c52471683ca8c9b763ca4138504f829/mfa-voice-recognition-2)

![MFA Voice Recognition 3](https://images.ctfassets.net/23aumh6u8s0i/3F0G4n8bUa3BIAUQg7xuHm/7a770f40b2b958f1001a1c932408d119/mfa-voice-recognition-3)

MFA is increasingly regarded as a basic requirement for security, and data privacy laws are beginning to explicitly demand it. However, it’s critical to implement MFA for end-users in a way that doesn’t introduce unnecessary friction. MFA should only be triggered based on the assessed risk, such as when a customer signs in with a new device or makes a suspicious transaction. That’s another reason why it’s critical to have the deep insight into your customers that CIAM provides. So you can assess in context when a transaction requires a higher level of authentication.

### Centralized user management

Your insights into your users can be a major competitive advantage, but only if your data is organized, accessible, and accurate. A CIAM solution helps achieve the goal of centralized, data-rich customer profiles that function as a single source of truth about users. That’s because a CIAM solution is essentially an API that mediates between different applications and components, compiling heterogeneous data in one place.

Centralized user management eliminates data silos and duplicate data. Everything you know about a user is together in one place from which admins can quickly grant and revoke permissions. This single view of customers is an obvious advantage for analytics, but it also helps companies meet the reporting requirements of data privacy laws because all profile data is accessible and portable. Knowledge about the user is also critical for building more personalized experiences, which drives higher retention rates.

![Centralized User Management](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

## How CIAM Impacts Business

Now that we’ve gone over the fundamental elements of CIAM, let’s talk about how those elements impact your company’s day-to-day operations and your all-important bottom line.

## CIAM Is Central to Data Security

Customer data can be your company’s greatest asset — unless it falls into the wrong hands. A robust CIAM solution has security features to protect against fraud, hacks, and misused data on multiple fronts.

In recent years, the login box has become the front line for fending off intruders. Hackers use [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) to steal or guess user credentials and impersonate legitimate users at the login box. One of the most damaging forms of broken authentication attacks is [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/), in which hackers use passwords stolen in one breach to break into other sites. This method works given people’s tendencies to reuse passwords. There are currently billions of stolen passwords being passed around the dark web. Credential stuffing attacks alone cost businesses an average of $4 million a year, according to a 2019 [study from the Ponemon Institute](https://www.information-age.com/credential-stuffing-123482099/).

The best defense against credential stuffing and other authentication-based attacks is a CIAM solution with MFA and brute force protection. Brute force protection stops hackers from flooding your application with login attempts and crashing your site. Meanwhile, MFA ensures that a stolen credential won’t give hackers automatic access to your users’ accounts.

It’s important to note that the amount of damage hackers can do with customer credentials is limited, since they don’t have access to back-end systems. But these attacks can still damage your customer relationships and lead to negative headlines, as in the case of the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/).

CIAM systems also help protect your customer data from back-end mischief in the event of a data breach or hack. CIAM solutions govern how you encrypt and anonymize personal data, so it’s useless to data thieves. It’s essential to choose a CIAM system that uses the latest encryption protocols, however, or your databases of sensitive data might as well be written in plain text. Finally, CIAM systems track who within your organization is accessing customer data and alerts admins to suspicious activity. That way, neither an employee nor a bad actor can walk away with your most valuable and sensitive asset: your customer data.

**How it affects your bottom line? Cost of data breaches.**
A [2019 Ponemon study](https://www.ibm.com/security/data-breach?cm_mmc=OSocial_Blog-_-Security_Optimize+the+Security+Program-_-WW_WW-_-CODB2019Blog_ov70891&cm_mmca1=000000NJ&cm_mmca2=10000253) found that the average data breach costs businesses $3.92 million. Businesses who don’t want to budget for that should budget for a modern CIAM solution instead.

## CIAM Helps Manage Data Privacy Law Compliance

A new crop of data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) is fundamentally rewriting the rules for how organizations collect, store, and share personal data (PD). Meeting these legal obligations means managing your approach to CIAM.

To begin with, centralized user management is essential in fulfilling the reporting and erasure requirements of data privacy laws. Under GDPR and CCPA, organizations must provide users, upon request, with copies of their data along with a record of how that data is being used.

Then there’s the issue of MFA. GDPR, CCPA, and New York’s SHIELD Act fall short of explicitly demanding MFA. Still, they require “reasonable” or “appropriate” security measures, and both [legal and security experts](https://www.natlawreview.com/article/new-york-shield-act-faqs) agree that this means MFA. GDPR enforcement has supported this idea: multiple organizations have been [slapped with fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) for failing to implement MFA.

Data privacy laws are all about controlling who can access PD, so encrypting customer data and controlling access to it are baseline requirements. A CIAM solution needs to provide all of these elements, as well as tailoring data collection and consent management practices to the relevant laws.

**How it affects your bottom line? Cost of regulatory fines.**
As of May 2020, EU states had issued over [€153 million in fines](https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/) to large and small organizations for non-compliance with GDPR. In November, Californians will vote on the California Privacy Rights and Enforcement Act (CPREA), the so-called “CCPA 2.0.” As the name suggests, the new version will feature a greater emphasis on enforcement. With new laws being passed all the time, the cost of non-compliance can add up quickly.

## CIAM Is a Business Enabler Through Customer Experience

A good CIAM solution is the difference between showing up at a crowded restaurant and being told there’s a 20-minute wait and being escorted straight to your table while the bartender mixes your favorite drink. With the right approach to CIAM, you can give your customers easy login and offer them services based on a nuanced understanding of their needs.

Businesses live and die by their conversion rates, and it’s tough out there. In 2019, the [average global website conversion rate](https://www.invespcro.com/blog/the-average-website-conversion-rate-by-industry/) was 2.58%, which is actually down from 3.42% in 2014. Clearly, today’s customers have no patience for filling out frustrating registration forms. If you use social login, your users get a friction-free registration experience without having to remember another password.

Meanwhile, your company gets the benefit of shared knowledge with that social media provider, so you automatically know your customer’s location, timezone, language, and other details to guide upsell recommendations.

**How it affects your top line? Higher conversions and retention, less frustration.**
[Studies have shown](https://blog.hubspot.com/blog/tabid/6307/bid/6746/Which-Types-of-Form-Fields-Lower-Landing-Page-Conversions.aspx) that reducing the number of form fields increases conversion rates. With social logins, you can eliminate the form altogether and enable one-click signup. Plus, when users don’t have their own unique password for your business, you save help desk time. [Gartner research](https://www.infosecurity-magazine.com/webinars/password-management-getting/) says between half and a quarter of help desk calls are for password resets. A North American healthcare organization told us it spends approximately $160 to $170 per employee per year on password-related issues alone.

## CIAM: A Holistic Approach to Customer Identity Management

As we’ve shown, CIAM plays an increasingly central role in how companies create their digital identities and manage their customer relationships. Given that, companies are allocating more resources to their access management solutions, either from day one or as part of a larger digital transformation.

To learn more about how CIAM can help provide enhanced data protection and seamless customer experience, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />


What is CIAM?

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Social login integration for popular app now available to all Auth0 customers


**TOKYO -- August 26, 2019 --**  [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS) today announced that [LINE](https://line.me/en/), the dominant communication app in Japan, is now supported as a social identity provider for Auth0. [LINE Login](https://developers.line.biz/en/services/line-login/) enables developers to quickly and seamlessly integrate it into their applications, making social login easier for millions of consumers across Japan.

With more than 81 million monthly active users in Japan, LINE is one of the most widely-used messaging apps for seamlessly connecting people, information, services, business, and brands. Now available on the Auth0 platform, LINE is joining more than 30 other social identity providers, enabling Auth0 customers to integrate LINE Login in as little as a few minutes.

"Our mission is to make connections possible for our customers, whenever and wherever they want them," said Shinichro Isago, Platform Evangelist Manager, Developer Relations at LINE Corporation. "By enabling LINE Login via its platform, Auth0 is helping to extend our customer philosophy of facilitating connections and access to information as conveniently as possible."

Social login provides many advantages to users and the brands that implement it. Consumers benefit from hassle-free and secure logins, brand consistency across channels (web, mobile), and a much better overall experience. Brands offering social login with LINE can realize many benefits as well, including increased user registrations, in-depth user profiles for personalized content campaigns, centralized user management, and increased brand satisfaction.

"Customers understand the positive impact social login has on their users, and more importantly, the friction it eliminates from any interaction with their brand," said Jun Fujita, general manager of Auth0 Japan. "We are excited to offer integration for the most dominant messaging app in Japan, and look forward to seeing its implementation throughout our customer base."

Learn more about the [LINE Login integration](https://auth0.com/blog/line-login-now-supported-with-auth0/) with Auth0.

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)


Auth0 Integrates Social Login for LINE

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Enabling LINE Login for your users is as simple as flipping a switch.



[LINE](https://line.me/en/), the most popular communication app having more than 80 million monthly active users in Japan, is now supported as a social identity provider for Auth0. Now enabling [LINE Login](https://developers.line.biz/en/services/line-login/) for your users is as simple as flipping a switch.

![Image of LINE login in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/1SIm7mt8ZAbPUSrJTSKbEs/27ab9c5303604dceb823682fa6081e7b/line-login-toggle-switch)

## What Are We Releasing?

LINE is joining more than 30 out-of-the-box integrations with social identity providers. Auth0 customers can enable LINE Login in as little as a few minutes, allowing LINE users around the world to log in with a simple button click or tap.

LINE Login has many benefits, including:

- **Increased registrations:** Account creation can be frustrating and many potential users will exit an app at this point. With LINE Login, users can easily create an account in your app with their LINE credentials.

- **Verified email addresses:** LINE handles email verification, allowing you to easily retrieve the user's up-to-date, verified email address.

- **Access to user profiles:** Retrieving the LINE user profile gives you more data to target personalized content.

- **One-tap return experience:** If the user is logged in to LINE and registered with your app, logging in is as simple as tapping a single button.

## How Does LINE Login Work?

LINE Login is a simple process. Here is how it works:

1. The user clicks or taps "Sign in with LINE"

2. A login request is sent to LINE

3. Once LINE confirms the user's identity, an existing user will get access to your application. A new user will be registered and then logged in to the application.

![Login screen in English with LINE login](https://images.ctfassets.net/23aumh6u8s0i/1IoWEYadTfvzhftALb52lk/121501de9fb830378f38f6d7971184eb/line-login-with-auth0-english)

## How Do I Get Started?

To try LINE Login out, [sign up for Auth0 for free](https://auth0.com/signup) and [follow the setup directions outlined in this documentation](https://auth0.com/docs/connections/social/line).


LINE Login Now Supported with Auth0

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Creating continual possibilities can be fast, secure — and still benefit your brand and bottom line



![Photo of the GO1 team that powers user's login experiences with Auth0](https://images.ctfassets.net/23aumh6u8s0i/VqTCg8aa75ucLAOvLZvq5/05284c57fe39aa35892002d40de23b84/auth0-roi-innovation-go1-team)

You might have heard about [GO1](https://auth0.com/learn/go1-adaptable-authentication-service-built-scale/)'s recent VC round from Microsoft's M12 division. "GO1 is one of those rare companies that brings a consumer-led experience to an inherently enterprise product," M12's Principal Priya Saiprasad told [Business News Australia](https://www.businessnewsaus.com.au/articles/go1-bags-over--30-million-in-raise-led-by-microsoft.html). She goes on to compliment GO1's user experience: "GO1 is redefining how enterprises procure training content and how employees in turn consume it via a modern user-experience and a single subscription."

GO1 is powering that scalable user experience with Auth0. "If we didn't have Auth0, we'd probably need seven or eight developers focused on [identity]. Our teams now can spend much more time working on the improvements that our customers actually see and care about. Not having to spend time on that means that we get to spend time on everything else," says Chris Hood, CTO and Co-Founder, GO1.

<include src="TweetQuote" quoteText="GO1 is redefining how enterprises procure training content, @M12vc’s Principal Priya Saiprasad told @BusinessNewsAus. Find out why GO1 and others turn to Auth0 for innovation."/>

That savings adds up to more than $700,000 annually and enables GO1 to connect with any partner system. "If we were doing it ourselves, we would probably integrate with SAML and that's it," says Hood, referencing one of the languages commonly used to exchange authentication and authorization data. "But the benefit we have here is we get to have all the different types of integration." Those integrations have helped GO1 grow from one million users to 10 million in a single year.

Helping our customers remove repetitive implementation frees them to focus on what they do best &mdash; and, let's face it, seeing our customers rocket through VC rounds is always exciting.

## Recognized for Solving Different Needs

Building innovative products is a great way to inspire, attract, and retain top tech talent while boosting your company's bottom line. While your team is focused on your core mission, our core mission is innovating identity. And we were recently recognized by Frost & Sullivan in their 2019 Global Identity and Access Management Technology Innovation Awards. Auth0 is the only company featured for technology innovation in the corresponding Frost & Sullivan Best Practices [report](https://auth0.com/resources/whitepapers/frost-sullivan-global-iam-technology-award) for Global Identity and Access Management (IAM).

As the report states, "Approaching the market by solving universal use cases helps Auth0 attract customers with many different identity needs, such as increasing end-user adoption of certain applications, increasing security, or dealing with M&A activity. Rather than requiring customers to seek additional vendors when they need authentication for additional audiences, Auth0 supports any use case and can continue to serve as the identity platform."

But just because we've won an award doesn't mean we stop innovating as Auth0 CEO and Co-Founder Eugenio Pace explains in this short video [1:09 secs], innovation is a daily practice:

<iframe width="560" height="315" src="https://www.youtube.com/embed/NxSBXVU04JQ" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <br>
<br>
## Decreasing Project Risk

Innovation isn't just ticking through the customer's ask list. It's thinking through the possibilities presented by identity and creating experiences like our [rolling (or trickle) migration](https://auth0.com/learn/migrate-user-database-auth0/), which makes it easy to move users to our enterprise-class database without losing them to password resets.

[Servcorp](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/) is a dominant force in the work space industry boasting a presence on 4 continents, 60 cities and 25 countries. Their clients include many Fortune 500 companies and businesses of all sizes. "We were looking for something that would give us not only a single sign on or unified experience down the track, but something that offered us a very clean migration path from the disparate sources we had across Servcorp. [Auth0's] custom login scripts were very important as this meant we could do rolling migrations, which significantly decreased project risk. That whole migration strategy, no one else could do," Matthew Baumgartner, Global CIO, Servcorp

Having Auth0 tailor the authentication experience to specifically fit Servcorp's needs means that the time to onboard new applications has gone from weeks to around a day &mdash; freeing developers up to spend more time delighting Servcorp customers.

{% include tweet_quote.html quote_text="Innovation isn’t just ticking through your customer’s ask list. It’s about helping them see the possibilities of identity when expressed through the Auth0 platform. #realROIauth0"%}

## Collaboration Brings Success

We've been able to help our customers do some amazing things thanks to the benefits of listening and collaboration, but solving 'impossible' challenges is always fun. The Global IT Director Matt Tedder from [Sprinklr](https://auth0.com/learn/sprinklr-achieves-impossible-sso-with-auth0/) was working in a GDoc office, but people needed to access critical Microsoft products &mdash; just not all the time. They kept forgetting their passwords and he found his team wasting a lot of resources on resets. Single Sign On (SSO) for all would solve it, but Tedder was told it couldn't be done.

"I researched this a long time and didn't think there was a solution. I was on a fool's mission to see if I could do it myself. I got 50% of the way there, and then Nico [Sabena] from Auth0 gave me free, crazy good support when I wasn't even a customer, and we figured it out together," says Tedder.

Licenses can now be auto-assigned, even though this isn't an option in Office 365. With Auth0, Tedder handles this programmatically, rendering it seamless to the user.

![Illustration for The Real ROI of Auth0, Part 2: Innovation](https://images.ctfassets.net/23aumh6u8s0i/36TUwtEx3fhy8CMt7ZPPRx/adbc6a106264f69f4b753ac1bbe32f14/the-real-roi-of-auth0-part-2-innovation)

## Supporting (And Providing) 'Continual Innovation'

Handling more than 25,000 business transactions yearly including sensitive capital raises, IPOs, mergers and acquisitions and audits, [Ansarada](https://auth0.com/learn/ansarada/) lands security high on their list of needs. But, as a company perpetually pushing better customer experiences, nearby sits continual innovation, which is part of why they chose Auth0.

"There's a real fine line between building features that customers ask for and providing features that take a leap beyond that and provide an exceptional experience to the customer that they didn't know they could get. Auth0 is innovating in that space and looking at better ways to provide more convenient authentication to customers while reducing security concerns for us and them," Steven Rogers, Chief Information and Security Officer, Ansarada.

We'll cover security in the next post of our Real ROI series.

## Resources

**The Real ROI of Auth0**
[The Real ROI of Auth0, Part 1: Time To Market](https://auth0.com/blog/the-real-roi-of-auth0-part-1-time-to-market/)<br> 
The Real ROI of Auth0, Part 2: Innovation (you're reading Part 2)<br> 
[The Real ROI of Auth0, Part 3: Security](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/)<br> 
[The Real ROI of Auth0, Part 4: Maintenance](https://auth0.com/blog/the-real-roi-of-auth0-part-4-maintenance/)<br> 

**Guidance**: Our [How to Have a Successful IDM Project series](https://auth0.com/blog/how-to-have-a-successful-idm-project/) goes into some innovative ways to solve identity. Also please check back regularly for practical posts on technology and identity best practices.

**Docs**: Customers often cite the benefit of our clear documentation and Jumpstarts. Get started [here](https://auth0.com/docs/).

**Questions?** Please reach out to an [Auth0 Resource](mailto:sales@auth0.com) if you'd like to learn how we can support your specific project or digital transformation.


The Real ROI of Auth0, Part 2: Innovation

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

How to improve your app's security with features like MFA, encryption and more with just a few lines of Javascript.



From Ashley Madison to Home Depot to Sony, it feels like every week, there’s a new high-profile security breach where millions of user records with sensitive information gets leaked to hackers.

Fundamentally, this happens because security is hard. Hackers are experts in security, but you probably aren’t, even as an experienced developer. This stacks the deck against you—as you build out your authentication and identity system while you scale, you may not recognize where you’re creating opportunities for the bad guy.

Moreover, security gets de-prioritized on your roadmap because it’s hard to build and isn't immediately urgent.  When you get around to worrying about security, it’s too late—you’ve had a breach and you need to go into damage control mode.

When you finally come out the other side, you need to do a massive overhaul of your systems and company culture to pay off your accumulated “security debt” from years of neglect . . . if you’re lucky and your company still exists.

But the security landscape is changing. With identity-as-a-service providers like Auth0, you’re able to outsource security to experts whose 100% focus day and night is to make sure that your user data is secure. Your IaaS becomes a platform on top of which you can easily layer on additional security services that protects your user data as you grow and scale.

## An App Store for Adding Security to Your App

When you add a new security measure to your homegrown identity system, like multifactor authentication (MFA), you need to wire it up to your code by hand. This can be very time consuming, add considerable code complexity, and leave room for inconsistencies and errors.

With Rules in Auth0, you’re able to add your new security feature—like MFA, encryption and more—with just a few lines of Javascript. The code lives on Auth0, executes in a sandboxed environment there, and runs every time a user logs in. You get a familiar, consistent interface to your user model and that makes it easy to use and creates system-wide reliability.

Adding security services to your app becomes as easy as adding an app to your phone in Apple’s App Store or Google Play.

### How Rules work

Rules in Auth0 are code snippets written in JavaScript that are executed as part of the authentication process. They essentially allow you to extend the Auth0 API with your own customizations, and without having to write any additional code on your end.
![Auth0 Rules](https://images.ctfassets.net/23aumh6u8s0i/6dxCXCkAbtyPK6v3NpPvP5/2bc837b97b27ba3ff4dff7273f1c4bef/auth0-rules)
When a user signs up, logs in, or authenticates in general, an authentication request is made to Auth0 (Step 1). After the user authenticates in step 3, the rules are run on step 4 and the result is passed back to the App.

It’s after the user authenticates, but before we’ve logged in the user that we can add more constraints around login to increase the app’s security. MFA is just one example of this.

 We’re able to take all kinds of contextual data about the user to evaluate whether an additional security measures should be triggered—which goes a long way towards protecting sensitive user data and app integrity.

Here are 5 simple Rules that you can use today to improve your app’s security—and each one shouldn’t take more than 20 minutes to set up.


## 5 Security Rules

### 1. Multifactor Authentication

```
function (user, context, callback) {
  /*
  You can trigger MFA conditionally by checking:
  1. Client ID:
  context.clientID === 'REPLACE_WITH_YOUR_CLIENT_ID'
  2. User metadata:
  user.user_metadata.use_mfa
  */

  // if (<condition>) {
    context.multifactor = {
      provider: 'any',

      // optional, defaults to true. Set to false to force authentication every time.
      // See https://auth0.com/docs/multifactor-authentication/custom#change-the-frequency-of-authentication-requests for details
      allowRememberBrowser: false
    };
  //}

  callback(null, user, context);
}
```

(Auth0 Rule for [Duo Multifactor](https://github.com/auth0/rules/blob/master/src/rules/duo-multifactor.js))

Multifactor authentication has gone from a luxury that only the biggest enterprise companies offer to their employees to an expected security feature even in consumer apps like [Twitter](https://blog.twitter.com/2013/getting-started-with-login-verification).

After a user logs in with their username and password, MFA requires that the user also prove that they are in possession of the phone (or another device or separate account) that’s associated with the user account. This additional layer of security protects the user even when their username and password has been compromised.
![Multifactor Authentication Flow](https://images.ctfassets.net/23aumh6u8s0i/1HxaXtyJhuP6JdCTu7J2ej/5a1b2db8d870481dc84448e08c8bc8fc/multi-factor-authentication-flow-video)
You can set up the Rule in fewer than 10 minutes and it will trigger multifactor authentication via [Duo Security](http://duosecurity.com/) or Google Authenticator to happen upon login. Here’s how it works:

1. The user logs in.
2. The MFA service kicks in and prompts the user to authenticate with their second device. If it’s the user’s first login, they’re prompted enroll their device with the MFA provider and that gets associated with their user account.
3. The user is granted access to the app.

Setting up the Rule is as easy as flipping a switch, selecting your MFA provider, and then configuring the associated Rule.
![Choosing MFA provider](https://images.ctfassets.net/23aumh6u8s0i/XZ3EQivmHdeaHkVApAi92/7b9ee17081f0bbccf40c417a9b265e01/choosing-mfa-provider)
What’s especially powerful about the Rule is that you can easily configure MFA to get triggered on different conditions, like, the type of network used.

And to do that, all you need to do is write a bit of extra conditional logic in JavaScript for your Rule. This helps you tailor how onerous the MFA burden is. You can have MFA triggered every time the user logs in, or only under abnormal conditions.

In the following example, we only trigger MFA when the user is logging in from a non-whitelisted IP:

```javascript
function (user, context, callback) {
  const whitelist = ['1.2.3.4', '2.3.4.5']; // authorized IPs
  const userHasAccess = whitelist.some(function (ip) {
    return context.request.ip === ip;
  });

  if (!userHasAccess) {
    return callback(new Error('Access denied from this IP address.'));
  }

  return callback(null, user, context);
}
```

### 2. MFA when there’s a log in from a different IP

```
function (user, context, callback) {
  const ipaddr = require('ipaddr.js');
  const corp_network = "192.168.1.134/26";
  const current_ip = ipaddr.parse(context.request.ip);

  if (!current_ip.match(ipaddr.parseCIDR(corp_network))) {
    context.multifactor = {
      provider: 'guardian',

      // optional, defaults to true. Set to false to force Guardian authentication every time.
      // See https://auth0.com/docs/multifactor-authentication/custom#change-the-frequency-of-authentication-requests for details
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

(Auth0 Rule for [multifactor on log in from different IP ](https://github.com/auth0/rules/blob/master/src/rules/guardian-multifactor-ip-range.js))

Alterting users to suspicious activity can empower users to protect themselves from hackers by giving them advance notice to change their passwords or set up MFA.

This rule sends a text message to the user’s phone whenever someone logs in to their account via a different device or location from the previous login.

Here is a similar notification that [Facebook sends](http://piersdillonscott.com/tag/geolocation/) in email form:
![Facebook Security Email Form](https://images.ctfassets.net/23aumh6u8s0i/2lpnxgIWb2ZtwKXrBuhXHN/1cdb823fdf72b32c0e0d395d81e8fd3e/facebook-security-email)
Note that they don’t just notify you that a new device has logged in, they also issue you a call to action to protect your account information if it wasn’t you that logged in.

And even when it’s the user herself who has logged in from a different location or device, the text message won’t be a nuisance. That you’re looking out for their security will impress them. In addition, you could issue an alternative call to action to set up MFA to further strengthen the security on their account.

### 3. User fraud score

```
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

(Auth0 Rule for [Socure](https://github.com/auth0/rules/blob/master/src/rules/socure-fraudscore.js))

If you’ve created an online marketplace like AirBnB or eBay, protecting your buyers and sellers from fraud is one of the most important things you can do to increase the trustworthiness of the marketplace and ensure that more transactions happen there.

The Rule above calculates a fraud score for every user based on their email address and IP address. It uses the cloud service [Socure](http://socure.com/), which aggregates data from social media, offline identity verification services, and publicly available data on the web to determine whether a user is real or fake.

You can use that data to protect your app and your users by putting users with high fraud scores on a watchlist, or require additional verification before they can transact with other users.

And the Rule will get you the information you need at the time of registration, not after the user has a history of fraudulent transactions on the site—by which point, it could be too late.

### 4. Force email verification

```
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}
```

(Auth0 Rule for [forcing email verification](https://github.com/auth0/rules/blob/master/src/rules/email-verified.js))

Facebook showed the power of using the user’s email address to make your app ridiculously viral. The user's [name@college.edu](mailto:name@college.edu) email address shows the app developer that the user attends College. That means that the app developer can add the user to network College instead of dropping them into an empty app where they have to build their own experience from scratch.

Yammer did the same with [name@company.com](mailto:name@company.com) email addresses, and it became the fastest growing enterprise app ever as a result. Today, this tactic is a tool in the toolbox of ludicrously fast-growing SaaS companies like Slack to leverage the company network to add as many users as quickly as possible.

To make this work from a security standpoint, the user must prove that they actually own the email address and belong to the network signified by their email address. This is where the email verification process comes into play: have your app email the user with a unique, obscure, automatically-generated link to a page. That will force them to prove that they have access to the email account by logging in and clicking on the link to verify.

If you don’t have this email verification step, you’ll show an imposter or hacker sensitive information internal to the company, and that would be disastrous.

This Rule denies any user who hasn’t verified their email address from logging in. What’s great about implementing email verification this way is that it doesn’t complicate your existing authentication code. Rules can be chained together and turned on and off individually, which keeps things simple and nicely modular.

### 5. Encrypt sensitive data

```
function (user, context, callback) {
  user.app_metadata = user.app_metadata || { };
  user.app_metadata.private_data = encrypt({
    license_key: '1234567',
    social_security_number: '56789'
  });

  callback(null, user, context);

  function encrypt(data) {
    var iv = new Buffer(configuration.ENCRYPT_IV);
    var decodeKey = crypto.createHash('sha256')
      .update(configuration.ENCRYPT_PASSWORD, 'utf-8').digest();
    var cipher = crypto.createCipheriv('aes-256-cbc', decodeKey, iv);
    return cipher.update(JSON.stringify(data || {}), 'utf8', 'base64') + cipher.final('base64');
  }
}
```

(Auth0 Rule for [encrypting sensitive data](https://github.com/auth0/rules/blob/master/src/rules/encrypt-sensitive-data.md))

Encrypting sensitive user data minimizes the damage that occurs if hackers compromise a user’s account or find a way to leak user data.

<include src="TweetQuote" quoteText="Encrypting sensitive user data minimizes the damage that occurs if hackers compromise a user’s account."/>

Recently, crowdfunding site Patreon announced that it had been [hacked](http://motherboard.vice.com/read/the-whole-works-is-in-there-hackers-dump-data-from-patreon-crowdfunding-site). Attackers got away with 2.3 million email addresses, user names, and shipping addresses—plus, it included private messages sent via the site’s internal messaging platform of a highly personal nature.

But it could’ve been worse.

As a crowdfunding platform, Patreon stored user tax information as well, and if that got leaked, it would  have been disastrous for the site’s members. However, Patreon encrypted all of the tax information with a 2048-bit RSA, and stored the encryption keys on a separate server that wasn’t compromised. That meant that sensitive and personally-identifying tax information that could have been used for rampant identity theft remained secure.

Use this Rule to provide that protection to your user. This Rule takes sensitive data, like a user’s social security number or his license key, encrypts it, and stores it as [metadata](https://auth0.com/docs/rules/metadata-in-rules) associated with the user account.

## Do Good and Do Well
![Trello Pricing](https://images.ctfassets.net/23aumh6u8s0i/5l66tH6pNFIEPHiFIe5lSP/3d101d3bb94cd7fce219e116d7b88639/trello-pricing)
These Rules quickly and easily add extra security to your app to protect your users—and if you bundle them together, you have something you can charge more for.

Use them to assemble an [enterprise tier](https://auth0.com/blog/2015/08/18/how-to-go-upmarket-and-grow-your-revenue-by-20x/), charge 5x your basic tier, and use that to grow your revenue by 20x.

Not only will that help you make more money, it will give you a profit incentive to keep improving the security on your app, aligning you and your customers’ interests for the long term.


"line"