jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Generative AI is everywhere, and since not every user has access to all data, learn how to use retrieval-augmented generation with fine-grained authorization to ensure that private information stays private.

Build Trustworthy AI: Implementing Access Control for RAG Systems Using FGA

Mira Sharma

Mira is a Product Manager on Auth0’s Enterprise Federations team. She is passionate about building connections, whether they involve OIDC tokens, puzzling out the shape of new product features, or frustrating New York Times games. When she’s not working, she’s probably writing intergalactic stories, out on a run, or in a pool somewhere.


Associate Product Manager

At DeveloperWeek 2025, AI took center stage—highlighting trust issues, security gaps, and transparency challenges as companies push for more reliable AI.

![Developer Week 2025](https://images.ctfassets.net/23aumh6u8s0i/5eSfirnEouOlpOO8dXMdhr/839499a4d80d00dd6278d0cdab94b2df/developer-week-header.jpg)

[DeveloperWeek 2025](https://www.developerweek.com/) was an AI-lover’s dream, a cornucopia of AI-driven innovation emerging from small startups to established industry leaders. There were dancing robot dogs, a plethora of cyber trucks, and a robot so intent on shaking human hands that it alarmed a few passersby as it scuttled speedily toward them. Attendees were privy to demos of voice cloning, roundtables with people from a diverse array of expertise, an enthusiastic DJ, and a small inflatable slide that lay in bouncy disuse. Any spies would be alarmed at the number of “agents” being openly discussed around them.

There is no denying that AI is the future. Yet like any nascent relationship, there are looming hurdles that must be navigated on the road to a happily-ever-after.

## Trust Issues 


While many envision the ultimate AI solution as an autonomous agent capable of reasoning and handling complex tasks independently, today’s reality spans a wide range of autonomy. Most of the AI tools displayed at DeveloperWeek still require significant human input, with only a few pushing toward greater independence.  

<img src="https://images.ctfassets.net/23aumh6u8s0i/LxsZn0xN57pNGGo4iZZAv/ed74ed928f1c281636b91ceb8093c8c8/developer-week-bot.jpg" width="200" align="left" style="padding: 10px; alt="Bot" /> After attending several popular speaker sessions, it became clear that a central challenge in achieving true autonomy is trust: how can AI-based products be designed to deliver reliable, accurate outputs? Many of today’s successful AI tools—such as GitHub Copilot and Cursor.ai—are B2B products used by trained developers, inherently relying on human oversight for verification. Rules and procedures for proper usage can be created and followed systematically, reducing the risk of hallucinated code or other errors impacting production environments. 


<br>
B2C products, on the other hand, have fewer means of imposing usage rules on customers. AI tools may work as expected with prompts provided for testing, but there is an infinite number of prompts that customers could inadvertently create. Attempting to circumvent things like hallucination and training data bias may superficially appear to act as guardrails, but they are hardly guaranteed. 

[Generative AI never doesn’t have an answer](https://www.ibm.com/think/topics/ai-hallucinations): This is wildly appealing in some use cases and terrifyingly misleading in others. The wild west of unreliable AI products, however, will not last forever; technology is improving at exponential rates, and people are learning how to interact with AI in more effective ways. In one of the most well-attended sessions, “Give Your LLM a Left Brain,” Neo4j’s Stephen Chin highlighted GraphRAG as a powerful tool to enhance the creativity of LLMs by incorporating actual data and helping models generate more logical and relevant outputs. Limiting AI expertise and function is also a simple way to enable more comprehensive output testing and promote greater transparency in acknowledging the model's limitations. The work to refine and balance these capabilities—much like connecting the left and right hemispheres of the brain—is already in motion.

## All Talk?  

Augmenting AI prompts with real data to enhance results–going from RAGs to riches, if you will–is not a new concept, and neither were many of the ideas bubbling around the booths. Although AI is still new in terms of its technical revolution, it is no longer shiny and novel to the wider world–we’ve been hearing about it since 2022. And while all sorts of flashy demos have been presented to show off the glittering promise of the AI-led future, where is that future now? 

A slide from Auth0’s keynote, delivered by Shiv Ramji, was particularly apt for describing the lifetime of an AI product. Getting a product ready to demo is not the same as shipping it; many AI products are in the liminal stretch between demo and shipping, as illustrated below. 

![Auth0’s keynote](https://images.ctfassets.net/23aumh6u8s0i/1jzUQMIWfPiBNrTwG3vBNj/c3b485195c0d6e8d9bb28f9692f410c5/developer-week-phases.png)

In short, this means that an explosion in AI technology is still imminent, with increasing numbers of ready-to-use, publicly available tools released regularly. As more companies push beyond [Gartner’s "trough of disillusionment"](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle), we’re witnessing a shift from skepticism to real, tangible progress, signaling that AI’s potential is beginning to be fully realized in ways that were once thought far off.

![Gartner](https://images.ctfassets.net/23aumh6u8s0i/7JCZEDrbN3IC0gOEF7KGcj/b020910303fb75dfb8f721093712a95e/hype-cycle-for-artificial-intelligence-2023.png)
_Source_: [Gartner](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle)

## Lack of Transparency 

Part of AI’s sparkling allure is its ability to abstract away the nuisances of code and technicalities under the familiar veil of natural language. It’s this very abstraction, however, that turns AI into a black box that makes modification, testing, and usage more complicated. There is a growing gap between those who create AI models—the engineers and researchers developing the foundational architectures—and those who design AI-powered products—the product managers, UX designers, and business strategists shaping how AI is integrated into real-world applications. In one session, the presenter asked the packed audience if any of them had ever built an AI agent themselves, seeing as agents were the subject of the 25-minute session. Not a single hand was raised. 

This audience may have been particularly bashful, but this was a clear indicator of the opaqueness that still surrounds the AI space. Everyone wants AI, but how many truly understand it—from the theory behind it to its actual development and proper usage? As no-code solutions become more common, this gap in practical knowledge will inevitably increase–and while this enables accessibility, another broadly beneficial aspect of the natural language abstraction, it also leaves room for oversights in development and usage. 

Another consequence of the growing opaqueness of AI products is the simultaneous demand for increased visibility. Many companies at the event showcased products aimed at improving clarity through visualization, while others acknowledged that this need for visibility was a pressing concern. In some cases, companies leveraged the black box nature of AI to their advantage, using its opacity to conceal underlying deficiencies – like when it came to product security.

## Insecurities 

Security is often a shocking afterthought in the development of many AI products despite [widespread overlapping security concerns across the industry](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/). Companies working with solutions involving RAG highlighted [Fine-Grained Authorization (FGA)](https://auth0.com/blog/streamline-your-authorization-workflow-with-auth0-fga/) and [Role-Based Access Control (RBAC)](https://auth0.com/docs/authorization/rbac) as key focuses, while others using AI agents to call APIs pointed to issues around [permissions and scope](https://auth0.com/blog/permissions-privileges-and-scopes/) as their most pressing security concerns. To address these challenges, companies took several different approaches.

### 1. Implementing FGA or RBAC Internally
This approach, which was the most commonly mentioned in ad-hoc interviews during the event, involves companies handling security frameworks themselves. While this can be an effective way to ensure that sensitive data is protected, it raises an important question: why continue reinventing the wheel? Much like AI tools often build on the same foundational models, it seems inefficient for every company to address the same security challenge individually when much of the industry will ultimately tackle it in similar ways. Standardized solutions could save time and resources and enhance overall security across the board.

### 2. Offloading Security to Customers
Some companies initially reduce their security overhead by offloading the responsibility to their customers. This might seem like an attractive strategy early in product development, as it enables faster go-to-market timelines. However, this approach is unlikely to scale in the long term. As AI products mature, customers expect products to include robust, built-in security features, not to carry the burden themselves. 

### 3. Implementing Guardrails to Limit AI Functionality
Another approach companies are taking involves creating restrictions on what AI can and cannot do. Some limit AI to read-only access or severely restrict its interaction with APIs. One company took the latter approach even further, disabling the AI’s ability to make API calls altogether. Instead, the AI would leave placeholders where API calls should be made, requiring a human to fill in the gaps. This “human-in-the-loop” method reflects a cautious approach to security, recognizing that while AI is powerful, there are still areas where human oversight is indispensable. It also underscores the ongoing debate around [AI autonomy](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)—how much trust can we place in an AI to perform tasks traditionally handled by humans? (Also, should AI developers be counted as legitimate attendees at developer conferences?)

### 4. Proceeding Without Considering Security
Finally, the most concerning approach—still alarmingly common—entails moving forward without proper security measures in place. As AI continues to be integrated into production environments, neglecting security becomes an even greater risk, particularly with the rise of malicious actors leveraging AI capabilities. Security is most effective when it’s built-in from the start, not added as an afterthought or band-aid to patch vulnerabilities later on.

## An Exciting Future   

So, AI has some issues, and so do we. The challenges we face today—trust issues, security concerns, and the need for transparency, along with others—are simply part of the process of building a long-term, reliable partnership with this incipient technology. DeveloperWeek 2025 highlighted the significant progress made in the span of just a few years but also underscored the importance of addressing these challenges as we move forward. As we refine our approach to AI development, it will be crucial to balance innovation with responsibility. 

Security, in particular, remains one of the most pressing concerns. As AI systems become more capable and deeply integrated into business operations, ensuring secure authentication and access control will be critical to preventing vulnerabilities. Products like Auth0 are already tackling this challenge, offering insights into securing Generative AI applications with stronger identity and authorization frameworks. AI security is something that is most effective built-in from the start, enabling developers and businesses alike to balance AI innovation with robust safeguards. 

> Explore how you can integrate robust AI security strategies with Auth0: [Auth for GenAI](https://auth0.com/blog/auth-for-genai/).

The future of AI holds tremendous promise, and with continued collaboration and thoughtful problem-solving, the potential for positive, transformative impact is within reach. 

## AI Resources

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)
* [Identity Challenges for AI-Powered Applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/)
* [Secure “Human in the Loop” Interactions for AI Agents](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)
* [The Rise of AI Agents and the Security Challenges Ahead](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/)

Developer Week 2025: Building a Long-Term Relationship with AI

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

Identity is the connective tissue between every person and technology in your ecosystem. This connective role also places Identity at the center of your risk profile. It’s no surprise that Identity remains the No. 1 attack vector in today’s threat landscape —  over 80% of data breaches involve some form of compromised Identity.

Properly addressing this fact means taking a serious and expansive look at your organization’s approach to Identity — because here’s the thing: Identity is more than just a login box. A rigorous, modern approach to Identity mitigates threats before, at, and after authentication.

Accordingly, technology leaders can’t limit themselves exclusively to Identity-related threats. They must also consider the impact their Identity solution has on core business priorities such as revenue, customer satisfaction, and growth goals.

This blog dives into how technology leaders can deliver Identity security solutions that also drive growth. If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

## It’s Time to Ditch Dated Identity and Excessive Friction

Protecting customers from account takeover and other malicious actions is crucial. But when that protection creates frustrating stumbling blocks for customers, like passwords, frequent CAPTCHAs, and multi-factor authentication (MFA) fatigue, your business is at risk. By introducing excessive friction into customer journeys, good-faith security efforts built on legacy Identity methods can lead to abandoned customer journeys, lower conversion rates, and lost business.

It’s a raw deal, and the worst part is that Identity security that burdens your customers doesn’t necessarily translate to better security. For example, traditional usernames and passwords with SMS as a second factor are vulnerable to social engineering and SIM-swapping attacks.

The clock has run out on legacy Identity. It’s time to embrace a modern approach that leverages Identity as more than a login box and, instead, drives better security and better business.

## Protect Every Stage of the Customer Journey

If the stats on pervasive Identity-related breaches teach us anything, it’s that legacy Identity simply isn’t enough in today’s threat landscape. Technology leaders need Identity security that can discover weaknesses, protect against vulnerabilities, and limit access if an adversary gets in.

In order to modernize security, you must modernize Identity. Auth0’s layered defense strategy improves security before, at, and after the login box alongside a SecOps dashboard, tools, and integrations. Here’s how our Auth0 Identity platform drives stronger security, privacy, and user experience (UX) across the customer journey.

### Before login

Bots make up 42% of all internet traffic today and 65% of these are bad bots.A versatile, scalable method for bad actors to carry out automated attacks, bots are also a major drain on your marketing budget. Whenever bots sign up for new accounts, they eat into your sign-up bonuses and block new connections with real customers.

Generative AI is poised to add gas to the bot fire: Between 2023 and 2030, AI adoption in cybercrime is expected to rise by 37%. Soon, businesses will be dealing with an even higher number of sophisticated bots capable of outsmarting simple bot-detection CAPTCHAs.

Modern Identity should stop bad bots in their tracks while maintaining customer-friendly experiences that protect revenue. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time with user-friendly challenges like the time-based authentication challenge. In addition, our Bot Detection solution now features a machine-learning model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)

### At login

Ultimately, driving your business forward comes down to providing customers with a simple and seamless user experience without compromising on security. Customers want on-demand convenience — fast, easy access with flexible login options — which means digital teams need to design phishing-resistant authentication experiences that also deliver a quick and easy customer journey.

Modern Identity can provide that perfect balance with flexible, secure passwordless login options. Passkeys allow users to log in quickly and securely, similar to how they unlock their mobile devices. They are also a phishing-resistant alternative to less user-friendly login options like the commonly used username and password plus MFA combination. Adaptive MFA can also reduce MFA fatigue by assessing risk signals such as a new device, network, or location, impossible travel, and untrusted IP, only triggering a second challenge for higher-risk authentication attempts.

In addition to login options, Auth0 offers layered security features for login. Auth0 Breached Password Detection and Credential Guard screen for and block compromised credentials. Auth0’s Brute-Force Protection and Suspicious IP Throttling help prevent account takeover attacks that target single and multiple user accounts, respectively.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on) 
* [Passwordless](https://auth0.com/docs/authenticate/passwordless),[ Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) 
* [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication)
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa)
* [Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)
* [Breached Password Detection and Credential Guard](https://auth0.com/docs/secure/attack-protection/breached-password-detection)
* [Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)

### After login

The ongoing rise in post-login threats also necessitates a defense-in-depth, layered security approach at every step of the user journey. The stakes are high, and the pain caused by breaches has the potential for extensive reach. Breaches not only incur painful financial losses but also lead to substantial brand and compliance-related effects that threaten the core business. Modern Identity can help avoid these outcomes.

Modern Identity elevates security, privacy, and experience post-login to protect sensitive customer interactions and user sessions. For example, with Auth0 Highly Regulated Identity, configure your organization to send financial-grade contextual approval requests to customers’ devices for sensitive interactions like account updates or money transfers. With Auth0 Continuous Session Protection, your organization can also continuously monitor user sessions to detect and prevent hijacking attempts, revoke suspicious sessions, and set custom timeouts.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity)
* [Continuous Session Protection](https://auth0.com/docs/secure/continuous-session-protection)

## SecOps

Security is a team sport, which is why Auth0 enables better collaboration between security, product teams, and developers with real-time insights and ready-made integrations that connect Auth0 functionality to a broader security apparatus.

For example, Auth0’s Security Center helps organizations detect and respond to attacks faster and fine-tune their security posture with intelligent insights and custom threshold alerting for Identity-related events, anomalies, and general efficacy. Security Log Streaming further supports faster event response by allowing the streaming of relevant Customer Identity Cloud activity to third-party SIEM tooling.

Auth0 SOLUTIONS TO EXPLORE FURTHER

* [Security Center](https://auth0.com/docs/secure/security-center)
* [Security Log Streaming](https://auth0.com/docs/secure/security-center/prioritized-log-streams)

## The Perfect Blend of Security and Usability

It’s tempting to think of Identity as a box to be checked. Equip your customer-facing applications with SSO and MFA–check. It's time to dust off your hands and declare victory, right? If only it was that easy.

To adapt to the ever-shifting risks of the business landscape with equal attention to security and revenue, technology leaders need an approach to Identity-based security that also functions as a business driver. That means integrating secure, seamless Identity functions into your security and revenue strategies at each customer touchpoint.

Legacy approaches to Identity fall far short of this goal. But, by entrusting your organization’s Identity with a leader in modern Identity, you can position your business to lead the pack in customer Identity security and core business KPIs.

## It All Starts with Auth0

[Thousands of customers](https://www.okta.com/customers/) worldwide trust Auth0 to strike the perfect balance of robust security and seamless customer experience across more than 10 billion monthly authentications.

We’ve invested in a layered defense strategy to improve security before, during, and after the login box — plus a dashboard and tools for SecOps that improve visibility and enable faster responses to potential and emerging threats.

Curious about how the Auth0 can help you build trust with your customers, secure your applications, and protect revenue?[ Reach out to our team](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) to schedule a demo.


Identity Security 101: How to Drive Trust and Loyalty across the User Journey

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

A quickly implemented Auth0 Action can enhance security by requiring users to log in from trusted IP addresses or blocks.

Ensure Users Log in from Trusted Networks with Auth0 Actions

Ryan Friess

Dynamic and seasoned, Ryan holds the role of Senior Sales Engineer at ID.me, a prominent platform specializing in identity proofing, group affiliation verification, and authentication. Ryan's extensive background in both sales and engineering enables him to seamlessly fuse technical intricacies with client requirements. He excels at providing custom solutions that effectively tackle intricate challenges across diverse sectors.

Sr. Sales Engineer - ID.me

Enhance Auth0’s authentication and elevate trust by combining it with ID.me’s verified identities.

In today's interconnected digital landscape, ensuring robust security for online platforms has become a top priority. As the number of data breaches and cyber-attacks continue to rise, businesses and organizations must employ innovative solutions that go beyond traditional authentication methods. Two industry giants, Auth0 and ID.me, have joined forces to create a powerful alliance that offers advanced security measures by integrating Auth0's identity and access management expertise with ID.me's cutting-edge authentication and identity verification capabilities. 

![ID.me & Auth0](https://images.ctfassets.net/23aumh6u8s0i/2MEfvv6hdNXWLrBzbZQNfz/b8ac2c26229144aa7cf12473e4a1c11e/01_Idme.png)

## The Power Duo: Auth0 and ID.me

In the realm of consumer identity and access management, Auth0 has been a trailblazer with its versatile authentication solutions, catering to diverse needs across industries. By providing a seamless and secure way for users to log in to applications and services, Auth0 has revolutionized the way developers handle identity and access management. But what happens when consumer authentication is not enough, and the business needs a way to associate a user’s true identity to their request to access your application? That's where ID.me comes in. 

## How Does It Work? 

ID.me exists to put individuals in charge of their own login, their own data, and their own ID cards to allow the login and the data to move with the user. ID.me’s primary focus lies in validating users' identities through a multi-layered approach, ensuring that the person on the other end of the screen is who they claim to be, and our user’s know they can take their portable identity with them anywhere they see the green ID.me button. This level of assurance goes far beyond the standard username-password-OTP combination, effectively thwarting potential fraudulent activities for higher-risk transactions. 

## Turnkey Integration of ID.me on Auth0

We wanted a way for developers and business decision makers to easily leverage the benefits of ID.me’s trusted and portable credentials within their existing Auth0 implementation in a turnkey manner - eliminating the need of custom development. Therefore, we worked closely with the Auth0 team to create **three turnkey marketplace listings**: 

- [ID.me Post-Login Action](https://marketplace.auth0.com/integrations/idme)
- [Social Login (Community)](https://marketplace.auth0.com/integrations/idmecommunity)
- [Social Login (Identity)](https://marketplace.auth0.com/integrations/idme-identity)

In just four configuration steps, you can benefit from ID.me’s network of 110M+ members and 47M+ IAL2 verified members for your secure authentication and identity verification needs. 

![Cconfiguration Steps](https://images.ctfassets.net/23aumh6u8s0i/7pJt2OAXv9rzBWIY24KIVS/6b30010556c4dfd158b2254ed4cb64fe/02_idme.png)

It’s as simple as selecting the Add Integration button on the marketplace listings, entering your ID.me credentials, and applying the post-login action and social login to your appropriate Auth0  applications. We’ll go into more detail in the next section, but as a sneak peak, your end result will look something like this:

![Integration](https://images.ctfassets.net/23aumh6u8s0i/6ipkP21q1On13NKx4cn8Rs/0bfcf3f9a7dfbce35deb0fb6bef6ffcf/03_idme.png)

- **Pathway #1** - By providing users with the choice of how they prefer to log into your application, customer satisfaction increases, pass rates improve, and ID.me provides 
support for any of your users that elect to log in through ID.me - effectively _reducing the burden and lowering the costs of password resets to your call center or IT Help Desk_. After successful authentication or verification, a corresponding Auth0 user account will be created with appropriate ID.me-validated attributes mapped within the user account.
support for any of your users that elect to login through ID.me - effectively _reducing the burden and lowering the costs of password resets to your call center or IT Help Desk_. After successful authentication or verification, a corresponding Auth0 user account will be created with appropriate ID.me validated attributes mapped within the user account. 

![Pathway #1](https://images.ctfassets.net/23aumh6u8s0i/5Br6WvqABfS3DtVAjTAeML/ab441728797ab912328c7ae80213f8b2/04_idme.png)

- **Pathway #2** - In order to support your existing user base, users can log into their existing account, and can be redirected to ID.me for verification. After successful verification, the individual’s ID.me attribute payload will automatically be mapped within the existing Auth0 user account. 

## For Developers - Let’s Dive a Little Deeper

While integrating ID.me is turnkey within your Auth0 tenant, it’s still important to understand the nuances of the user journey and data flow. The architecture diagram below provides an overview of the two pathways we just discussed: ID.me as a Social Login and ID.me as a Post-Login Action.

![ID.me](https://images.ctfassets.net/23aumh6u8s0i/4CHSxbdUrMVfmKWxhWGBd5/3905e1176eb5ec191575bd955fef71e2/05_idme.png)

The top half of the architecture diagram highlights the Auth0 login with the ID.me post-login action pathway, in which the user elects to log into their existing Auth0 credentials, and will be redirected to ID.me for verification. Take note that an indicator is used to determine when to prompt an existing user for verification with ID.me, and that post-successful verification, that indicator will be updated within the user's application metadata. 

The bottom half of the architecture diagram demonstrates the data flow for the Social Login pathway. This is where our partners receive the benefit of the ID.me network, allowing 110M users to login to your application with their pre-verified ID.me credentials in just a few clicks. 

Now, let’s take a look at an even deeper dive and look at an overview of ID.me, as well as what the exact steps needed to configure the ID.me integrations in this video. 

<AmpContent>
<amp-youtube
    data-videoid="Vd9zZcsGUkE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/Vd9zZcsGUkE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Conclusion 

The digital landscape is continually evolving, demanding innovative solutions to combat cybersecurity threats effectively. The partnership between Auth0 and ID.me brings together two industry leaders, each contributing its strengths to create a security ecosystem that surpasses traditional authentication methods. By combining Auth0's identity and access management prowess with ID.me's authentication and identity verification capabilities, we can ensure a higher level of trust, security, and compliance while providing a seamless user experience. Together, we are transforming the way to approach digital security, setting a new standard for safeguarding user identities in an ever-changing world.

Strengthen Your Application Security beyond Authentication

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

How SafeBase Uses Auth0 to Lead the Way in Customer Trust

## Leading the Way in Customer Trust

The security startup, [SafeBase](https://safebase.io/), is defining the standard for customer trust management. Through the SafeBase [Smart Trust Center](https://safebase.io/showcase), companies are able to share their security posture and eliminate security review friction, ultimately leading to more closed deals. “Implementing good security controls as you’re a growing company is very hard, and it’s always under-invested,” said SafeBase’s Co-Founder & CTO, [Adar Arnon](https://www.linkedin.com/in/adarnon). 

We sat down with Adar, and he shared that their approach was aimed at helping companies grow. Their goal is to eliminate human time spent on security communications like sharing SOC2 or Pentest reports, security questionnaires, or incident breach notifications. While these are crucial to maintaining customer trust, they can be time-consuming and a bottleneck to closing deals. Arnon explains that these processes can be “...super manual, and that’s what we decided is worth solving.” 


<include src="QuoteCard" body="As we’re growing with these customers, something that’s very clear is that big customers really care about identity management and security." name="Adar Arnon" title="CTO & Co-Founder" team="" company="SafeBase" />


The impact SafeBase has had on their [customers](https://safebase.io/customer-love) since their 2020 inception is truly exciting. They’ve taken historically frustrating and tedious security processes and created a product that allows companies to become more efficient, ensuring stakeholders have fewer security review emails in their inboxes. That’s a total win in our book. 

## Choosing Auth0, a Standard in Authentication and Authorization

Once SafeBase started adding users, they determined that it didn’t make sense to implement their own user management system. Upon asking his network, Adar shared, “...it sounded like Auth0 was the agreed-upon standard. Auth0 offered a platform that we felt could grow with us while providing good support.” Other factors that were evaluated were Auth0’s [tech stack](https://auth0.com/docs/quickstarts) and [documentation](https://auth0.com/docs). 

One of the key features the team benefits from is [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login), specifically because they do not have to deal with maintaining the front-end or back-end. The SafeBase team determined Auth0 was a good solution and joined our startup program to help them scale. 


![Why Auth0](https://images.ctfassets.net/23aumh6u8s0i/6fQxARcY6WWbfOE8wiClfN/6521c4ef2961cb12bf461db6ca037f9a/SafeBase_Checklist_-1.png)

## Join SafeBase and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Adar and the entire SafeBase team. If your organization is looking to build your own Smart Trust Center, [schedule a demo](https://safebase.io/schedule) today. 

_This profile is the fourth installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: SafeBase

swale-nunez

Swalé Nunez is a polymath with a deep fascination for creativity and an uncontrollable desire to innovate. A creative whose creativity takes shape in the form of technology manifested through human-centered design. Through his disruptively unorthodox approach and advocacy for technology that is user-centric, he is helping to pioneer decentralized identity through user-controlled identity provisioning. <br>
He has architected robust identity and access management solutions across industries, including finance and government sectors, and continuously works to bring that level of security to consumer identity. Ushering in a hybrid architecture implementation, which offers enterprise-grade authentication with intuitive consumer-like ease of use. An implementation that introduces a more transparent profile data sharing model that gives users more control over the access and sharing of their profile data while streamlining onboarding and checkout for seamless digital interactions.

Founder - Iuncta, Inc

Swalé Nunez

Iuncta has a new integration on Auth0 Marketplace

Social logins have given developers an effortless way to address several of their onboarding challenges. With a simple integration that lets users sign up and sign in to applications using social accounts, developers remove considerable friction from the process. Auth0 eased the integration process further, letting developers choose which social login provider to use. The [most prevalent](https://www.okta.com/blog/2020/08/social-login/), Facebook, was generally the default. That integration alone not only helped eliminate password management but also showed increases in conversion rates and overall user engagement. But removing friction and easing a developer’s job is just the first part of this journey. It’s also about user trust.

## A Question of Trust

There has always been an element of trust involved in the social login relationship. But it’s changing. As the relationship between users and the applications they interact with has evolved, user expectations of that relationship have shifted as well. And trust is at the core of these expectations. A study by [MalwareBytes Labs](https://blog.malwarebytes.com/security-world/2019/03/labs-survey-finds-privacy-concerns-distrust-of-social-media-rampant-with-all-age-groups/) found that 95% of internet users don’t trust social media companies with their personal data. Those who responded to the survey showed distrust across all social media platforms. The same research found that 87% of respondents didn’t feel confident sharing their personal data online. The lack of user confidence and distrust is becoming evident in how often they make use of social logins today. 

With users becoming more informed about data privacy and the need to become more active in protecting their online identity, they expect a privacy-first login that will give them more control over and transparency in their data. A report from [PEW Research Center on Americans and their online privacy](https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/) found that 84% of users stated they have little to no control over the data companies collect about them. As technology evolves and with the advent of blockchain technology, users are embracing the idea of having more control over their online identities, data, and transactions, and technology is evolving to help make this possible. Decentralized identity is one such approach.

## A User-First Approach to Online Identity

[Iuncta](https://iuncta.io/)’s user-first approach to identity and access management is built on a model emphasizing transparency that leads to trust. It prioritizes user privacy and enables user control, all consistent with its user-centered design approach. Iuncta is a social login with transparent data sharing and access to zero-party data, so users are always aware of what data is being shared, when, and with whom. A social login that gives users the control they deserve, ensuring trust, offering privacy, and establishing peace of mind.

Iuncta’s decentralized identity implementation allows users to act as their own identity provider online, introducing a more transparent profile-data-sharing model. With its hybrid architecture, developers can quickly and easily offer enterprise-grade passwordless authentication with an intuitive consumer-ready experience that is supported by Iuncta’s [mobile app](https://youtu.be/GN5VMTN_fm8). The Iuncta platform enables user identity on demand, streamlining onboarding and facilitating secure and effortless digital interactions between users and developers.

![Mobile App](https://images.ctfassets.net/23aumh6u8s0i/1yV0zNgYxkdaBNrtSWznCd/ac139374809ea4f043d22ed1db6dda18/01_mobile-app.jpeg)

### End-to-end authentication

The Iuncta solution manages the relationship between the developers and the users of their applications and is supported by a feature-rich cloud offering at the core of an end-to-end solution to consumer online identity management and licensing. 

The key elements in Iuncta’s layered implementation include:

* Developers (Client) – A minimalist module requires only a username for passwordless access.
* Web API/Mobile SDK – A comprehensive list of tools for seamless integration into the Iuncta cloud service offering.
* Cloud services – A feature-rich collection of core Iuncta ecosystem services. It is the control center for the extensive functionality list.
* Mobile app – A clean and intuitive user interface designed to make user interaction with the Iuncta platform natural and effortless. 

![Iuncta](https://images.ctfassets.net/23aumh6u8s0i/1uGGyQ3FBjMBIO34dhAawX/149ba6599cc169cd3c9f0232ba209ea1/02_end-to-end_authentication.png)

Iuncta’s hybrid approach combines a consumer-friendly user experience with enterprise-grade security without lengthy development time. As an official Auth0 partner in its [Marketplace](https://marketplace.auth0.com/integrations/iuncta), the integration only takes a button click and a few simple steps for developers. With an Iuncta partner account, developers get access to the complete list of web APIs and downloadable mobile SDKs, as well as a reference guide with documentation and code samples to enable customization.

## Transparency That Leads to Trust

Social logins don’t all operate by the same set of principles. This means that, despite the importance of transparency, as cited by users, privacy, control over data, and trust aren’t priorities for all social login providers. The most important factor to consumers when choosing to share personal data in its secure collection and storage, control over what data is being shared, and trust in the company, according to the [Agility PR report](https://www.agilitypr.com/pr-news/public-relations/covid-has-made-consumers-more-willing-to-share-data-what-do-they-expect-in-return/). Iuncta believes in these principles and puts them to work.

Through its transparent practices, Iuncta’s social login helps to facilitate this trust through privacy, security, and control. Iuncta meets current and future expectations through:

* Ethical, fair, and transparent data practices without massive data collection or secrecy 
* Passwordless, user-controlled authentication and access to personal data
* Multifactor authentication for additional layers of security
* Creating a channel for users to profit from managing access to their identity, an innovative value exchange model.

Putting transparency into practice, it becomes clear that the more users trust, the more willing they are to share their data; the more data they share, the better the experience. The better the experience, the more likely they are to return as paying customers. A little trust goes a long way. 

Let’s work together to re-establish trust. Check out our [integration in the Auth0 Marketplace](https://marketplace.auth0.com/integrations/iuncta).

A Better Social Login: Transparency That Leads To Trust

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Trusted integrations from industry-leading third-party solutions extend Auth0's functionality to solve increasingly complex identity needs



**BELLEVUE, Wash. – Sept. 22, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Auth0 Marketplace](https://marketplace.auth0.com), a trusted partner integrations catalog that enables customers to quickly extend the core functionality of the Auth0 platform and use it as an identity solutions hub for their specific needs. Auth0 Marketplace, with its ever-growing breadth of verified partner integrations, provides customers with the extensibility, customization, and confidence to meet their identity needs of today and tomorrow.

Auth0 Marketplace gives customers the power and flexibility to combine Auth0 with adjacent technologies, enabling them to put identity at the forefront of larger projects such as digital transformation, threat detection, compliance, customer conversion, and more. The identity management landscape is increasingly complex, fueled in large part by new security threats, regulatory requirements, privacy laws, and user convenience demands. Yet its function within enterprises is simultaneously becoming more critical, making extensibility a pivotal feature within any identity platform. 

Auth0 Marketplace leverages Auth0's inherently extensible platform even further and supports solutions that cover a wide range of identity needs, including Consent Management, Identity Proofing, Log Streaming, Security, SMS/Email, Single Sign On, Social Login, and more. All integrations have been verified for security and functionality, and are easily discoverable. Once integrations are selected, installation wizards and guides help customers enable these new partner solutions quickly. 

The launch of Auth0 Marketplace reveals two new categories of partner integrations: 

* [**Consent Management**](https://marketplace.auth0.com/categories/consent-management): Obtain and maintain user consent records for collecting data (e.g., via cookies) for ongoing adherence to data privacy regulations like GDPR, CCPA, etc. Auth0 Marketplace features new partner integrations from MyLife Digital, OneTrust, and others. 

* [**Identity Proofing**](https://marketplace.auth0.com/categories/identity-proofing): Verify a user's identity based on real-world factors (e.g., biometrics) and additional factors before granting access. Auth0 Marketplace launches with new partner integrations from Onfido, Vouched, ID DataWeb, Caisson, and others. 

Auth0's existing integrations are now discoverable and available in [Auth0 Marketplace](https://marketplace.auth0.com/), including recently-launched Log Streaming from Splunk, Datadog, Azure Event Grid, and Amazon EventBridge. 

"Consent management, together with identity management, provide a powerful solution for the adherence to the many data privacy policies, like GDPR and CCPA, that continue to crop up and provide incredible hassles for companies," said Kevin Kiley, Chief Revenue Officer at OneTrust. "This issue and need will not go away. Being a premier launch partner in Auth0 Marketplace gives us visibility with Auth0's thousands of customers, and provides them with an integral technology that is more important than ever with today's numerous privacy laws." 

"We are excited to be part of the Auth0 Marketplace launch and have our solution serve as an integral component for Auth0 customers' identity architectures," said Rick Hofmann, VP of Global Partnerships and Alliances at Onfido. "As companies look to accelerate and scale their digital transformation, being able to remotely tie a user to their real, physical identity at onboarding and at other points along the customer journey, is critical to reducing fraud and building customer trust. We look forward to servicing additional audiences via Auth0 Marketplace."

By becoming part of Auth0 Marketplace, partners can participate in the growing demand for digital identity solutions and showcase their innovative products to Auth0's 9,000+ customers worldwide.

"Launching Auth0 Marketplace is a great milestone for the company and further highlights the demand for an extensible identity platform. Giving customers the power to fully adapt Auth0 to their needs widens their ability to build a secure, end-to-end holistic identity solution. Auth0 Marketplace partners represent the integrations that matter for identity," said Shiven Ramji, Chief Product Officer at Auth0. "Auth0 Marketplace will open the door to external innovation and make it easier for our customers to work with Auth0 as a true hub for identity management."

'[**Introducing Auth0 Marketplace**](https://auth0.com/blog/introducing-auth0-marketplace)' provides more detail about how to discover and enable integrations that help businesses solve identity. In addition, Auth0 will be hosting a webinar on October 7th to take a deep dive into Auth0 Marketplace and how it can help customers. Please visit the [registration page](https://auth0.com/resources/upcoming-webinars/auth0-marketplace-webinar) for more details. Companies that wish to become part of Auth0 Marketplace can find more information at the [Auth0 Partners page](https://auth0.com/partners). 
 
<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk <br />
Global Communications <br />
Auth0 <br />
press@auth0.com

Hannah Carroll <br />
Matter for Auth0 <br />
auth0@matternow.com <br />


Auth0 Marketplace Launches and Provides Even Greater Extensibility for Building Identity Solutions

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

How to leverage Identity Proofing to increase trust in your applications.

Self-registration, i.e., the process that allows users to create their credentials, is a common approach to onboarding users in applications. It offers users autonomy and frees from any manual backend processing. However, in some contexts, typical self-registration may be insufficient. You may need to go beyond the simple e-mail verification and use Identity Proofing services to confidently identify your users.

## What is Identity Proofing?

So, your application uses Auth0 to authenticate users. They can register by providing their own credentials and profile information or access through [enterprise connections](https://auth0.com/docs/get-started/dashboard/enable-enterprise-connections). Your application can even access their profile, but how can you make sure that your users are who they claim to be? This is the goal of Identity Proofing services. By integrating them into the Auth0 login flow, you can verify their actual identity during the registration or the login process.

Using Identity Proofing services is mandatory when the user identity is a critical factor. Think of scenarios like patient onboarding in a telemedicine system, candidate registration for hiring purposes, student sign in to take an online exam, online transactions in bank and e-commerce activities. In these scenarios, you need to verify that the claimed identity matches the user's actual identity.

Check out [this article to learn more about the business value of Identity Proofing services](http://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/).

## Meet Our Identity Proofing Providers

The [Auth0 Marketplace](https://marketplace.auth0.com/) provides you with a few integrations from our partners that help you add Identity Proofing services in your applications. You can do it by adding those integrations in the Auth0 login flow. You just need an <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Auth0 account</a> and an account in our partners' platforms. The rest is just a matter of configuration.

In fact, the Identity Proofing services offered by our partners are implemented as [Auth0 Rules](https://auth0.com/docs/rules) that require a simple setup, for example, entering the provider's keys. Let's take a look at the integrations offered by some of our Identity Proofing partners.

### Meet ID DataWeb

[ID DataWeb](https://www.iddataweb.com/) offers an Identity Proofing integration based on its *Attribute Exchange Network* (AXN). Their service provides your application with three identity verification methods: *MobileMatch*, *BioGovID*, and *Dynamic KBA*. You can also configure a multi-step process for validating the user's identity with the *Identity Verification Workflow*.

![ID DataWeb Verification](https://images.ctfassets.net/23aumh6u8s0i/6codFvfOriC9mWUZcxeRIn/f1b05ea79d4e7379fb77e66510760922/id-dataweb-verification)

The [ID DataWeb Verification](https://marketplace.auth0.com/integrations/iddataweb-identity-verification) integration redirects users to the Identity Proofing workflow. It typically happens at the first user login and the validation result is shared with Auth0.

The [ID DataWeb Verification](https://marketplace.auth0.com/integrations/iddataweb-identity-verification) page in the Auth0 Marketplace will guide you through the integration configuration.

### Meet Persona

Add an additional level of assurance to your log-in experience without hurting conversion with Persona's identity verification flows via the new Persona action in the marketplace. Persona is an identity verification platform that is trusted by companies like Square, Branch, and Coursera to scalably tackle any identity challenge, from automating onboarding decisions to fighting fraud. Use the Persona action to easily customize and trigger any combination of automated verification methods based on how risky a user is after signing up or logging in for your application. Once users are verified by Persona and authenticated by Auth0, use the Persona platform to automate any follow-up action like updating your CRM or sending an email.

### Meet Incognia

With the Incognia Onboarding integration, mobile apps can add real-time address verification to their onboarding processes to establish trust with new customers on day one. Through its SDK, Incognia collects anonymized location data directly from the sensors on a mobile device. Once an address is passed to Incognia, it performs a real-time address verification to determine whether the new user is currently at the provided address or has ever been to that location in the past. 

![Incognia](https://images.ctfassets.net/23aumh6u8s0i/aUxEV2bXX60OhkFNcy7r9/a102c3c4dd0e9482b8b9d57bb505cb3d/incognia-onboarding-2.png)

The Incognia Onboarding integration is implemented as an Auth0 rule at the first user login. When executed, the Incognia Onboarding API assesses whether the new user’s location behavior actually relates to the provided address and delivers a risk assessment and supporting evidence.

Check out the [Incognia Onboarding listing page](https://marketplace.auth0.com/integrations/incognia-onboarding) for more details. 

## Summary

This overview of Identity Proofing shows how you can empower your users' digital trust relationship. Identity Proofing helps you prevent fraud, especially in scenarios where the user's actual identity is crucial. The [Auth0 Marketplace](https://marketplace.auth0.com/) provides you with easy-to-use integrations from the best Identity Proofing providers on the market.

All integrations in the Marketplace are pre-validated by Auth0, so you know you can trust them. Also, you can get support for the integrations directly from the experts that created them. Finally, if there is an integration that you would like to see in the Marketplace, [you can request it here](https://community.auth0.com/c/marketplace/request-integration/89). You can also [submit your own integration](https://auth0.com/partners) if you'd like to share it with other developers.



Auth0 Marketplace: Add Identity Proofing to Your Applications

New global report highlights how identity is foundational in helping governments improve existing services, and launch new ones faster and more securely

**BELLEVUE, Wash.** **– January 12, 2022** –[ Auth0](https://auth0.com/), a product unit within[ Okta](https://www.okta.com/) (NASDAQ: OKTA), today released the findings of its first [Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report), a global research report that provides government technology leaders with insight into the identity maturity of public sector organizations around the world. The report highlights the importance of a centralized identity strategy in putting safe and accessible services into the hands of citizens faster.

Over the past two years, many public sector organizations were prompted by the immediate need to deploy digital infrastructure to maintain continuity of their services amid the COVID-19 pandemic — such as offering citizens license renewals online and virtual education — and are now grappling with the impacts on cybersecurity and user experience. From the Executive Order on ‘Improving the Nation’s Cybersecurity’ in the U.S., to digital identity and Single Sign-On (SSO) initiatives in the UK and Australia, enabling employees, citizens, and other government entities to access all of these applications easily and securely has become a demand around the world. 

The 2022 Public Sector Identity Index, conducted by Auth0 and [Market Connections](https://www.marketconnectionsinc.com/), captures the perceptions of 850 IT and line of business decision-makers within national and state/local government organizations across the U.S., UK, and ANZ (Australia and New Zealand) with regard to their [Identity and Access Management (IAM)](https://auth0.com/resources/whitepapers/how-identity-forms-a-foundation-for-digital-govenrment) strategy.

The report’s key findings include:

* Only one in five are extremely confident in either the security (17%) or ease of use (19%) of their current authentication solution.
* Username and password is the most frequently used authentication method by citizens (86%), compared to very little usage of biometric or passwordless authentication (16%).
* Four in ten are currently building their own IAM solution in-house (41%), and cite speed to implementation (83%) and using internal staff to manage IAM internally (82%) as two of the biggest pain points in doing so.
* Most governments are looking to expand their digital services in the next two years (75%) and rank protecting citizen’s privacy and data as most important when thinking about citizen services (73%).

<br>

Regional analysis shows U.S. respondents rank ensuring citizens’ trust in digital services as an area of high importance (71%), but have less confidence in their organization’s ability to deliver this (56%). Similar discrepancies in importance versus confidence in delivery include speed in adding new services in the UK (66% importance vs. 48% confidence), and improving the user experience in ANZ (72% importance vs. 60% confidence).

Dean Scontras, Vice President of State and Local Government and Education (SLED) at Okta, said: “Digitization is likely to continue in light of Zero Trust mandates and mounting consumer expectations. Public sector organizations greatly benefit from bringing their identity management strategy in line with their digital goals. While there is a strong focus on securing citizen data, the vast majority of applications are still protected by a username and password, despite their well-documented security risks.”

According to Forrester Research, the public sector has a massive influence on the entire economy making up 30% of the global GDP and 33% of the global workforce, and the global research firm predicts that more governments will adopt Zero Trust frameworks to revive public trust in digital services.[^1]

An [Identity-First approach](https://www.youtube.com/watch?v=g7ZzOJQwRsE) puts identity at the center of government digital transformation, while also laying the foundation for a Zero Trust security model. Key to this approach are modern login technologies that replace traditional passwords, and introduce friction only when suspicious behavior is detected. By making the shift to Identity-First, organizations like [Larimer County](https://auth0.com/case-studies/larimer-county/) provide easy and seamless access for legitimate users, while decreasing the risk of security and compliance breaches.

Jessica Figueras, a cybercrime and digital identity advisor to governments and Okta consultant, said: “In the face of increasing digitization, skills shortages, and online harms, governments are taking a hard look at the technologies they can bring onboard to help them reach their digital goals. The research suggests that identity is one such technology that can help the public sector do more with less.”

To learn more and download the full report, please visit: [2022 Auth0 Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report).

## Methodology

Auth0 engaged Market Connections to design an online survey of 850 IT and line of business decision-makers within national and state/local governments in the U.S. (200 federal, 200 state & local), UK (100 federal, 100 state & local), and ANZ (Australia and New Zealand) (155 federal/national, 95 state & local), fielded in September-October 2021.

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Okta<br />
[press@okta.com](mailto:press@okta.com) <br />

### Investor Contact:
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com) <br />

**Disclaimer:**
Research reports and related summaries referenced herein are provided for informational purposes only, and consist of the opinions of the organizations publishing such research and should not be construed as statements of fact. Okta and Auth0 make no representations, warranties, or other assurances with respect to such research.

[^1]: Public Sector Predictions 2022, Forrester Research, Inc., November 3, 2021. 

Auth0 Public Sector Index Shows Governments Struggle to Provide Trustworthy Online Citizen Services

philippederyck

Philippe De Ryck helps developers protect companies through better web security. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. As the founder of Pragmatic Web Security, Philippe delivers security training and security consulting to companies worldwide. His online course platform allows anyone to learn complex security topics at their own pace. Philippe is a Google Developer Expert and an Auth0 Ambassador/Expert for his community contributions on the security of web applications and APIs.

Web Security Expert, Founder of Pragmatic Web Security

Philippe De Ryck

Learn how Trusted Types help eradicate DOM-based XSS in frontend Angular and React applications.

Securing SPAs with Trusted Types

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Companies of all sizes are pivoting quickly to remote work. Here are seven lessons from our remote-friendly culture


Due to recent events, hundreds of thousands of people globally have found themselves having to work from home. But what happens when someone now finds themselves out of their daily routine, without structure, and alienated from a lack of social interaction?

Auth0 has been a remote company from Day 1, with our two founders starting the company seven years ago while living in the USA and Argentina. We grew and scaled our workforce by hiring people from all around the world. Below are the key lessons for employers and employees to smooth the transition to remote working.

## 7 Lessons for Successful Remote Working


### Lesson 1: Trust Your Peers

There are two essential components for the success of remote working. Trust is one of them — when you can't work next to each other, trust becomes primordial. You have to trust your peers will continue to give their best while working from home,  that they are doing what they say they are doing, and will deliver quality work on time.

Trust will empower them to thrive.

### Lesson 2: Clear Communication

Communication is the other essential component. Without face-to-face interactions, ensuring clear, constant, and transparent communication is of utmost importance. Maintain regular communications with your peers, whether it's via chat or video, by setting up weekly syncs, 1:1s, or brainstorm sessions.

Tools play a key role in making this an enjoyable and efficient experience. There are plenty of options, but our communications trifecta is [Slack](https://slack.com/), [Zoom](https://zoom.us/), and [Confluence](https://www.atlassian.com/software/confluence) for chat, video, and documentation. We also use [Mural](https://mural.co/) for whiteboarding, [Figma](https://www.figma.com/) for real-time collaboration between our designers, and [Lattice](https://lattice.com/) for feedback, surveys, and 1:1 conversations, just to name a few more.

![The important of clear and constant communication when remote working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Lesson 3: Respect Others' Time

Meetings can be tempting when working remotely (it's an opportunity to see a face!) but think twice before scheduling one. Ask yourself, can this be managed via message/email or maybe even a short video call? If yes, then there is no need to schedule a meeting. The meeting is needed? Ok, but make sure to set up an agenda and respect the starting and ending times.

Don't expect instant responses from colleagues. Your messages/emails don't have to be answered instantly. Everyone needs time to focus on their projects, so take into account that your requests can't be answered right away and learn to respect the 'Do Not Disturb' status.

### Lesson 4: Manage Your Time

Making the switch to remote is not easy and can have an impact on your productivity, but many things can help:

* Start by organizing your day — structure is key.
* To-Do lists are your friend.
* Plan in advance.
* Implement a time management technique — we recommend the [Pomodoro technique](https://en.wikipedia.org/wiki/Pomodoro_Technique).
* Block your calendar with focus sessions.
* Setup the don't disturb status.

### Lesson 5: WorkSpace

"It will be amazing to work from my bed or couch" is a common first thought when starting to work from home. Although the idea is very tempting, having a dedicated space for working is essential.

It doesn't have to be a fancy office with 3 screens and full of gadgets, it's about having a space that suits you, where you feel relaxed and happy, and which enables you to focus and set your creativity free.

Tips to set up a quick workspace: find a space in your house close to the internet (you don't want to lose connection during a video call) where you can work without disruptions, take your most comfortable chair and desk, order nice headphones, and you are ready to work.

### Lesson 6: Work-Life Balance

Working from home can blur the lines that divide personal and professional time. The most important thing is to set up boundaries by implementing office hours. Forget about the typical 9-5 (you are free from that), but choose what suits you best. The important thing is to divide your two lives.

Remember to take breaks during your office hours. Taking breaks doesn't come as easy when working from home, but they are important for your mental health and productivity. Try planning and scheduling your breaks in advance and most importantly: *get away from your desk*.

Another big one is exercise. Sedentarism is one of the few cons of remote working, but there are plenty of great routines you can do right there in your house.

Now you can't justify not doing exercise because of the lack of time... you have hours free because you are not commuting anymore.

![7 lessons from beignn remote working for 7 years](https://images.ctfassets.net/23aumh6u8s0i/1823ottXfMNiYotVUDWb32/8b1944d65d45be3594d1f386ddbfb79f/culture2)

### Lesson 7: Don't Overlook Security

The sudden growth of remote working comes with an increase of cybersecurity challenges: new devices to be hacked, networks to be probed, credentials to be stolen, and targeted phishing attempts, to name just a few

Here are 3 tips that can help overcome these challenges:

- *Cybersecurity Guidance*: education is the main way to overcome these challenges. Educate your organization about security by creating best practices guides and setting up training sessions.

- *Single Sign-On*: reduce password fatigue, mitigate credential theft, and make life easy for everyone by [setting up Single Sign-On](https://auth0.com/single-sign-on).

- *Multi-factor Authentication (MFA)*: the much needed extra layer of security. [Implement MFA](https://auth0.com/multifactor-authentication) and safeguard your data from unauthorized access.

## Conclusion

Welcome to the remote club. We hope these lessons based on our experience of 7 years as a remote company can help you get the best of your remote time and maintain the same productivity as working from an office.

Are you a remote worker specialist and want to share some of your lessons? Or you just started remote work and have some questions? Please go ahead and leave a comment.


Welcome to the Remote Club: 7 Lessons From 7 Years

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Breach protection isn’t enough — you need to prove trust with accreditation and data privacy respect


"As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do &mdash; your entire business depends on it," says Rolf Bekkstrand, former CTO, 4human HRM.

He's not alone.

No one wants to be the person who tried to save budget using a lesser level of encryption &mdash; and got hacked. Or, worse, [exposed customer data by storing it poorly](https://threatpost.com/facebook-data-of-millions-exposed-in-leaky-datasets/143412/).

In a broader sense, security is about trust. When your customers share their identity with you, they're trusting you to keep it safe &mdash; and while blogs posts and webinars can help convey that a third-party vendor is trustworthy, it's not enough for a company to just claim that it's secure. We need to prove it.

That need for proof has gone far beyond being a business requirement. GDPR's data protections may have come into force in 2018, but many countries already maintained strict requirements and others have data privacy plans in the works. All of this regulation is part of a global trend inspired, at least in part by the rising number of data breaches.

![Illustration for The Real ROI of Auth0, Part 3: Security](https://images.ctfassets.net/23aumh6u8s0i/24eCHY1wwRU8LJRrLT72iQ/868299ecb1a894525fe3b8169f2fa0eb/the-real-roi-of-auth0-part-3)

## Global Data Privacy Trends Include Civil Action

[Breaches](https://auth0.com/blog/what-is-a-data-breach/) are happening at such a rapid rate that USA Today now maintains a [ranked breach index](https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/). In the first half of 2018 alone, there were [668 breaches and over 22 million records exposed](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/).

According to the Ponemon Institute, the global average cost of a data breach rose to $3.86 million last year ([Forbes puts it at $7.91 million in the U.S.](https://auth0.com/blog/what-is-a-data-breach/)) &mdash; and those calculations are pre-GDPR. With [€50 million in non-compliance fines leveled at Google](https://www.bbc.com/news/technology-46944696), a [suit already filed against eight other companies including Apple and Amazon](https://www.darkreading.com/privacy/gdpr-suit-filed-against-amazon-apple/d/d-id/1333690?_mc=NL_DR_EDT_DR_daily_20190119&cid=NL_DR_EDT_DR_daily_20190119&elq_mid=88915&elq_cid=25956827), and an [EU judge ruling that civil action against Facebook is viable](https://tech.newstatesman.com/business/schrems-facebook-legal-battle), security and compliance are about much more than your perimeter.

Lest you think that these concerns only apply to your EU customers, the shift towards protecting data privacy is a global trend, but one where different countries might use GDPR as a baseline, but tweak it for their needs. A case in point is California's data privacy law, coming into force in 2020, which looks likely to provide [the basis for a Federal data law in the U.S](https://digitalguardian.com/blog/lawmakers-see-california-consumer-privacy-act-basis-federal-law). You can find in-depth look at expected data privacy trends in 2019 [here](https://auth0.com/blog/data-privacy-2019-the-lowdown/).

The likelihood that data has been exposed is part of the reason behind all the regulation, but due to the rising number of data breaches, it's no longer just companies and partners that want to be protected, says John McKim, VP of Product & Technology, [A Cloud Guru](https://auth0.com/learn/cloud-guru-saves-550000-aud-annually-using-auth0/), "Customers want to know that their data is going to be protected and secured, and identity is a critical part of that. Having confidence that the systems that hold their very personal information... is really critical. That's why we like to use Auth0."

## Proving Trust with Accreditation

<iframe width="560" height="315" src="https://www.youtube.com/embed/FySg3K4HXAs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Accreditations are often on a required term-of-business checklist, but the reasoning for that placement lies in trust, says Auth0 CISO/VP of Operations Joan D. Pepin. "That certification means an external third-party has verified that we meet a professional standard &mdash; and it's not a one-and-done effort. We have to work to maintain that accreditation. Just as you need to regularly update the software on your laptop, we need to continually update our security."

This continuous improvement and monitoring happen alongside our development efforts, helping us to continue building in security as we innovate.

Companies who choose Auth0 instead of building identity in-house benefit from our accreditations.

Certifications like [SOC 2, HIPAA, and ISO 27001](https://auth0.com/security/) require an upfront investment to achieve the accreditation plus yearly costs to maintain it. "Most Fortune 500 companies won't sign deals if you don't have the applicable certifications," says Auth0 Senior Manager of Governance Risk and Compliance Adam Nunn. "Yearly tooling costs can vary from organization to organization, ranging from $25,000 to multi-millions, depending on the size of the org."

Auth0 invests yearly on third-party auditors, salaries for the staff who make sure we're compliant, and internal compliance tools (excluding engineering tools and/or tools deployed for security purposes), and continually improving our processes &mdash; eliminating both certification worry and cost for our customers.

For companies protecting large amounts of sensitive and regulated data, like healthcare collaboration platform [ACT.md](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/), realizing it doesn't have to be painful can come as a surprise.

"We hadn't expected to be able to find a partner like Auth0 who would be so focused on security, proper authentication, and yet create a platform that's incredibly well-documented, easy to test, and is HIPAA compliant," Narath Carlile, Chief Medical Information Officer, ACT.md.

## Getting the 'Jump' on Fraudulent Users

Working with identity experts means dealing with fewer bugs, vulnerabilities, and introduced workarounds, but active security features like anomaly detection and brute force protection can remove a significant amount of worry for your and your customers &mdash; even if you're doing business in a challenging space.

"Marketplaces can be a heavily fraudulent space. A lot of scammers list fake cars and they have different mobile numbers and email addresses or whatever, and they try to convince people to wire transfer money,"  says former Cox Automotive Australia CTO Jeremy Gupta. Instrumenting Auth0 in the private seller experience allows Autotrader to verify mobile and email using out-of-the-box flows plus customization.

"We also get some really strong moderation through the Auth0 platform, which allows our customer service team to jump on fraudulent users ahead of time," says Gupta.

## Security ROI

"I'm a big proponent of letting experts do what they do best. If you get identity management wrong, it falls apart horribly, and you get put on the front page of the newspaper as having exposed a large number of people to really bad things. I didn't want to rely on building it ourselves," David Bernick, former Director of Cloud and Technology, Harvard Medical School

Since we control the front door to our customers' applications, we are a security company. Auth0 takes protecting our customers identity transactions seriously. "We invest heavily in our Security team, building out a cutting edge program and hiring talented engineers who want to build the security of a security company," says Auth0 Senior Director of Security Duncan Godfrey.

That behind-the-login-box effort pays off for our customers. "Security is often misunderstood, and when it is an afterthought, left to the end, it tends to bite you in the butt.," says Stephen Berard, former Senior Global Software Architect, Schneider Electric. "We didn't have to kick the proverbial can down the road every time a new security or authentication question came up, whether the question was hypothetical, practical or mission critical.

## Resources

**The Real ROI of Auth0**
[The Real ROI of Auth0, Part 1: Time To Market](https://auth0.com/blog/the-real-roi-of-auth0-part-1-time-to-market/)<br> 
[The Real ROI of Auth0, Part 2: Innovation](https://auth0.com/blog/the-real-roi-of-auth0-part-2-innovation/)<br> 
The Real ROI of Auth0, Part 3: Security (you're reading Part 3)<br> 
[The Real ROI of Auth0, Part 4: Maintenance](https://auth0.com/blog/the-real-roi-of-auth0-part-4-maintenance/)<br> 

**Guidance**: [Auth0's Approach to Information Security](https://auth0.com/resources/whitepapers/auth0-security/) details our approach to information security and our list of certifications and compliance capabilities so that you can better understand how Auth0 protects your data.

**Docs**: Customers often cite the benefit of our clear documentation and Jumpstarts. Get started [here](https://auth0.com/docs/).

**Questions?** Please reach out to an [Auth0 Resource](mailto:sales@auth0.com) if you'd like to learn how we can support your specific project or digital transformation.


The Real ROI of Auth0, Part 3: Security

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Insurers know that digital transformation is coming. To stand out from your peers, adopt identity and access management for a secure experience that customers can trust.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---


Insurers know that implementing digital changes have the potential to benefit them long term. A recent [McKinsey study](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/making-digital-strategy-a-reality-in-insurance) found that insurers that digitized their processes eliminated 30 to 50 percent of the human service costs. The top quartile of those surveyed achieved 2X the growth of their peers.

<include src="TweetQuote" quoteText="Insurers know that digital transformation is coming. To stand out from your peers, create a secure experience that customers enjoy and trust."/>

But specific obstacles in the industry have stalled progress. First, the majority of insurers don't have the in-house technical expertise and equipment to make sweeping changes without support. In addition, many are concerned, particularly in an era of [increased scrutiny around customer data](https://auth0.com/blog/cambridge-analytica-and-facebook/), that a system overhaul could threaten measures they've already taken to protect sensitive information.

Despite these real challenges, customers increasingly expect cutting-edge solutions. Other industries, like [healthcare](https://auth0.com/healthcare/) and [financial services](https://auth0.com/financial-services), are quickly incorporating digital methods, raising the bar for everyone. Eventually, insurers will be forced to change. Early adopters will gain an edge, and those who are slow to transform will lose.

While it's possible to begin a digital transformation in many ways — from creating a new claims platform to simply delivering online quotes — starting with an identity and access management (IAM) strategy is a clear, easy-to-implement step that allows managers to attack several core functions at once.

## Legacy Systems in a Changing Environment

In industries such as [retail](https://auth0.com/retail), many teams are able to rely on consumer data pulled from public sources like [social media profiles](https://auth0.com/learn/social-login/) to underpin their strategies. This might include compiling current and potential customer interests, events they've attended, and pages they've liked. In insurance, it's more complicated. Agents work with higher-touch information sets, like health records and credit scores.

![Legacy, old insurance systems example](https://images.ctfassets.net/23aumh6u8s0i/1T3qVEXkTfn8vpmFRHZyqX/35117cf6090d3668e1aacab3d062734a/legacy-systems-struggle-to-keep-up-with-digital-transformation)

[Source: Electronic Medical Records & Electronic Health Records Software](http://www.emr-ehrs.com/mental-health-electronic-health-records.php)

This data is the foundation for building customer risk profiles, determining premiums, and completing claims. Most teams have developed processes over decades that continue to work well. Although a lot of this data exists on legacy insurance softwares and systems and may not be intuitive for new hires to find and work with, more-seasoned agents understand the process and don't feel an urgent need to change.

With such fixed methods, it can be challenging to know why and how to begin to make updates. Tweaking any aspect of an established insurance company's model, even something as simple as market research or reaching out to new prospects, could skew the whole.

Yet if teams don't start somewhere, they risk becoming irrelevant in markets that are quickly evolving. Home insurers, for example, are facing variables such as interconnected home security and heating systems, like the Google Nest; auto insurers are having to factor in autonomous vehicles and the changes that ride-sharing programs like Uber and Lyft bring; even health insurers are seeing stiff competition from newcomers, like Oscar, that have a strong focus on UX and more-affordable plans.

Just because many insurance teams have succeeded with business-as-usual for decades, it doesn't mean they don't need to revamp for the future.

## Organize Your Users for Greater Security and Efficiency

For insurance teams facing a daunting set of changes, developing a clear [identity and access management - IAM](https://auth0.com/app-modernization) modernization strategy of legacy softwares is a concrete first step. IAM is a simple, initial fix that can form the basis for more updates down the line. It is a single solution for organizing and tracking customers, employees, and even business partners who are working with critical data in your system.

IAM often begins with a portal that collects, organizes, and protects customer data at the login stage. This starts with a simple welcome screen on the front end:

![Customer acquisition starts with a secured, basic identity management](https://images.ctfassets.net/23aumh6u8s0i/6skPK5VXzplAOaOIG2mXAW/d4cc7731371771ffcd5576d3fcf99044/transforming-customer-acquisition-starts-with-a-basic-identity-management-strategy)

Behind this screen, the technology tracks customer logins and platform behavior and enriches their profiles with personal details and historical records. This can be information that the insurer manually uploads or automatically pulls from public sources. Some features also include additional options, such as [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/), to help build customer data over time (e.g., location, age, and gender).

For administrators, certain features allow for a bird's-eye view of all users in a given system, noting growth in users over time, ratio of new to returning users, who is accessing what levels of information at any time– even what device(s) they're using:

![Customer data visualization in Auth0 reports allows for better reporting and analytics](https://images.ctfassets.net/23aumh6u8s0i/5iw0moRjxmuV8bvOeZ9t16/e39d7192b9ca429b294a43df722dd491/organizing-customer-data-in-a-single-location-allows-for-better-reporting-and-analytics)

Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights on customer histories and current behavior. This approach will make your company more efficient at building risk profiles, communicating with customers in a more personalized way (particularly if and when they are in distress and need to make a claim), and understanding your target audience at a granular level.

<include src="TweetQuote" quoteText="Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights."/>

## Outsourcing IAM to the Experts

While you can try to update your IAM system on your own, most insurers don't have the in-house capacity to do so — at least not at the level needed to meet future needs. This would require building a portal that is a one-stop solution for all users — yet is still flexible enough evolve alongside your business. The advantage of outsourcing IAM is having a dedicated team of experts whose entire job, 24/7, is to build and deliver these solutions — as opposed to adding it to a pile of tasks your IT team is currently balancing.

A provider like Auth0 makes sure all of its [features adhere to the highest industry standards](https://auth0.com/security), including LDAP, SAML, OAuth, OpenID, OpenID Connect, and JSON Web Tokens (JWTs). In addition, it is GDPR, EU-US Privacy Shield, and HIPAA compliant.

![Auth0 compliance and certifications](https://images.ctfassets.net/23aumh6u8s0i/35nsnoblygw4XlOUwuocQ6/c02f2b95ba00c2410da392fe049e68c4/auth0-adheres-to-the-highest-industry-standards)

[Source](https://auth0.com/security">Auth0 Security)

This eliminates the need for your team to do additional research to ensure any changes are up to code in your geographic area or industry.

Top-notch identity and access management providers like Auth0 will offer even more tools, like 2FA options, to help ease the customer experience. These features can provide a clear measure of safety that customers will immediately appreciate. Each step along the way allows your team to move further away from lagging competitors by gaining user trust, invigorating your brand, and creating more-efficient internal processes.

## Be an Early Adopter

If you're an insurer, now is the time to make bold changes to your current strategy. The early digital adopters in the industry will gain sharper insights and win and retain more customers.

No teams will be able to hide from change. With new products constantly coming to market, the industries in which insurance teams operate are themselves being revolutionized. Taking the first step to develop and implement a tight IAM system will open the door for full digital change.

<include src="asides/AboutAuth0" />


How the Right IAM Tools Will Help Insurance Teams Make the Shift to Digital

keith

Guest Author

Keith Kowal

Learn how to implement passwordless real-name and age verification policies with Auth0 and the Trusted Key Mobile App.



**TL;DR:** Learn how “self-sovereign” digital wallet Trusted Key can be leveraged with Auth0 to easily manage authenticated identity.

---

## Introducing Authenticated Identities

Trying to authorize user access based on real-life identity has always presented a significant technical challenge for website and application providers. Age verification is commonly attempted for mature content, and just as commonly circumvented by 14-yr old boys claiming to be born in 1972. Real-name policies have a colorful internet history and are a sure-fire topic to start a dinner argument. Regardless of your outlook, it is reasonable to assume that as technology makes authenticated identity solutions more practical to implement, there will be more service providers looking to implement enhanced age verification and real-name policies to meet the needs of regulators and to differentiate their online experience.
 
A few key technologies are making real-life identity verification closer to reality. First, advances in Optical Character Recognition (OCR), identity documents embedded with barcodes/NFC, and facial recognition allows smart devices such as mobile phones to reliably extract Identity information from government-issued documents and confirm ownership with the person pictured on the ID. Second, public key cryptography allows that identity information to be securely stored using technologies such as Apple’s Secure Enclave, and safely transported. Finally, blockchain technologies are enabling “self-sovereign” identity solutions that allow users to create a digital wallet to store their identity and be in full control of what information leaves that wallet in the form of signed identity tokens, which will, in turn, increase users’ willingness to participate in such identity transfers.

<include src="TweetQuote" quoteText="Technologies like OCR, public key, and blockchain are making real-life identity verification closer to reality."/>
 
To help illustrate these principles we will demonstrate importing real-life identities using Auth0 and Trusted Keys Digital Identity Wallet.

## Setting up the Trusted Key App

The Trusted Key App is a secure self-sovereign Digital Identity Wallet based on Ethereum with a wide range of identity applications including KYC, registration, passwordless login, transaction authorization, document signing, and even managing SSH Keys. This entire Trusted Key App setup process only takes a few minutes.

<include src="TweetQuote" quoteText="The Trusted Key App is a secure self-sovereign Digital Identity Wallet based on Ethereum"/>

**Step 1**: Download the free [Trusted Key iOS App](https://itunes.apple.com/us/app/trusted-key/id1167336246?mt=8&ign-mpt=uo%3D4) or the [Android app](https://play.google.com/store/apps/details?id=com.trustedkey.identify.wallet).
 
**Step 2**: Go through the onboarding process and create a PIN and register an email address.

![Trusted key app setup](https://images.ctfassets.net/23aumh6u8s0i/vbAJOwPBX9RftsU4YJ9Mo/1552cce6af3e296d038bc42987a245b6/enter)

**Step 3**: On the “My Identity” screen select “Add an ID” and “Driver’s License”. The App will take you through a process where you will take a picture of the front and back of your license and then automatically extract the information from the ID for review. The Trusted Key App supports driver licenses from around the world, and if you don’t have a driver’s license you can try another identity card such as a National ID. The App will then take a selfie that confirms you are a kicking breathing human, and that your face matches the picture on the ID.

![Trusted key app add driver's license](https://images.ctfassets.net/23aumh6u8s0i/3rbSxdm84i2Tt4lPF7tPBK/8c11ee736e02b5a0af6305e4752b3400/idphoto)

A key aspect of this process is that users are not able to edit or modify the Identity information extracted from the ID. This means that any identity information provided by the Trusted Key App is derived from a government-issued ID document, and the user’s ownership confirmed through the selfie process, resulting in an authenticated identity.
 
For more information please see the [Trusted Key App user guide here](https://www.trustedkey.com/product/trusted-key-app-user-guide/).

## Getting a Client ID / Secret

**Step 1**: Go to the [Trusted Key Developer Portal here](https://developer.trustedkey.com/).

**Step 2**: Click on “Sign up with Trusted Key App” in the upper navigation bar. You will be asked to enter the email address you registered on the Trusted Key App. You will get a notification on the Trusted Key mobile app asking for authorization to access the Developer Portal. Confirm the login.

![Register new trusted key app](https://images.ctfassets.net/23aumh6u8s0i/2qHU5Hhcc25umjpl5vKR25/bc42e228eecfd7d6c8a826faa2c10c56/register)

**Step 3**: Once you have logged into the Trusted Key Developer Portal click on “Register New App” where you will be asked to enter your app name and callback URI. Your callback URI is `https://YOUR_TENANT_DOMAIN/login/callback`. The portal will then provision a Client ID and Client Secret to use in your API calls to the Trusted Key Platform. Copy both values for the Auth0 setup.

![Trusted key app configuration with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3XBKIU0SsPhr69D0NCvOkG/d5d705f12ffab520dd1502556fa1db81/clientid)

## Setting Up Auth0

[Auth0](https://auth0.com) is an ideal platform for easy configuration of connections to third-party Identity Providers such as Trusted Key, combined with a powerful backend for vetting, adding, and managing users. The setup process starts with [signing up for a free Auth0 account](https://auth0.com/signup). 

Next, go to **Connections > Social** in the Auth0 Dashboard, scroll to the bottom, and click **Create Custom**.

### Standard Trusted Key Social Connection Setup

* **Connection Name**: The name you choose for your connection
* **Authorization URL**: `https://wallet.trustedkey.com/oauth/authorize`
* **Token URL**: `https://wallet.trustedkey.com/oauth/token`
* **Scope**: `openid email`
(Depends on your requirements. Please note that any email address received will have been already verified by the Trusted Key app.)
* **Client ID and Client Secret**: Paste your Client ID and Client Secret obtained in the process described above. 
* **Fetch User Profile Script**:

```js
// Call oauth2 API with the access token and create the profile
function(access_token, context, callback) {
    request.get('https://wallet.trustedkey.com/oauth/user', {
        'headers': {
              'Authorization': 'Bearer ' + access_token,
              'User-Agent': 'Auth0'
        }
    }, (error, response, body) => {
        if (error) {
            return callback(error);
        }
        if (response.statusCode !== 200) {
              return callback(new Error('StatusCode:' + response.statusCode));
        }

        return callback(null, JSON.parse(body));
    });
}
```

### Authenticated Identity Trusted Key Social Connection Setup

To support authenticated identity we will need to make a few changes to the above settings.

In the “Scope” field you would enter the desired authenticated identity information. A convenient shortcut is to use the scope `profile`:

**Scope**: `openid email profile`

By using `profile`, the Trusted Key App will automatically provide the user’s full name, first name, last name, gender, and birth date.
 
You also have the option to force users to provide authenticated identity details to complete the registration process. There are many ways to do this both client side and within the Auth0 dashboard such as setting up a rule. A very simple way is to add some script into the User Profile Agent that mandates authenticated identity information or else returns an error. Typically, if the Trusted Key App is not providing this information it means the user has not scanned their ID, their ID does not contain the needed information, or there was an error in the scanning where identity fields are missing.

```js
// Call oauth2 API with the accesstoken and create the profile
function(access_token, context, callback) {
    request.get('https://wallet.trustedkey.com/oauth/user', {
        'headers': {
              'Authorization': 'Bearer ' + access_token,
              'User-Agent': 'Auth0'
        }
    }, (error, response, body) => {
        if (error) {
            return callback(error);
        }

        if (response.statusCode !== 200) {
              return callback(new Error('StatusCode:' + response.statusCode));
        }

        const ui = JSON.parse(body);

        if(!ui.given_name) {
              return callback(new Error("First Name missing. Please rescan your ID in the Trusted Key App"));
        }

        if(!ui.family_name) {
              return callback(new Error("Family Name missing. Please rescan your ID in the Trusted Key App"));
        }

        if(!ui.birthdate) {
              return callback(new Error("Birthdate missing. Please rescan your ID in the Trusted Key App"));
        }

        if(!ui.gender) {
              return callback(new Error("Gender is missing. Please rescan your ID in the Trusted Key App"));
        }

        return callback(null, ui);
    });
}
```

When you finish filling out the fields, you can **Create** your new social connection, and then click “**Try Connection** at the top of the page. You will be taken to the Trusted Key login. Enter your email address and then confirm the login using your Trusted Key App. If everything works correctly, you’ll get a confirmation message and an output where you can review the raw identity data provided by the Trusted Key App.

![Auth0 Trusted identity data](https://images.ctfassets.net/23aumh6u8s0i/1NuXCcala9EwS2tqNBkknR/2b27e6c394e4df6f1684e003ffa60868/app)

Upon exiting the window make sure your Trusted Key custom social connection is turned on.

## Testing it Out

To provide a “real life” example we set up a demo WordPress website. We then downloaded and installed the [“Login by Auth0”](https://auth0.com/wordpress) WordPress plugin. After activating the login you will be asked to log into your Auth0 Account, and a client will automatically be set up in your Auth0 dashboard. In the WordPress Admin settings under Settings > General > Membership make sure the “Anyone can Register” box is checked.
 
On your WordPress website if you go to login with the Auth0 module there should be a button reflecting the name you choose for your Trusted Key Social Connection—in this case, we called it “Trusted-Key”.

![Auth0 trusted key login demo](https://images.ctfassets.net/23aumh6u8s0i/7jLaydDKEuGmY6yLkPODSu/ddd00cc90e27c8d1c14c2a752ea7588a/login)

Click on the login button and the Trusted Key window should appear. Enter the email address associated with your Trusted Key Wallet, and then confirm the login using the Trusted Key App. You should now be registered and logged into the WordPress website.
 
Back in the Auth0 dashboard if we look at “Users” in the left-hand toolbar we will see the login showing the name and email address associated with your Trusted Key App. If you click on the User a window will open showing the entire user profile. This includes the user’s full name, given name, last name, birthdate, gender, and verified email address. This information can also be stored in the WordPress user profile, although some fields such as birthdate and gender will require customization of the profile input fields.
 
Now that you have the user’s authentic identity information you have a wide range of choices on how to use that data to create customized registration and user experiences. Auth0 provides a powerful set of capabilities in their rules engine or database setup. You also have the option to set up policies or custom flows in the website front end.

![Auth0 trusted key identity data](https://images.ctfassets.net/23aumh6u8s0i/7pO6ipHvHOJAiSbsYeX8XS/e485657b580f1241af0184ac7afb641f/userprofile1)

## Conclusion

The ability to create authenticated identity user profiles provides website and application creators exciting opportunities to redefine and segment their user experience. A new generation of “self-sovereign” digital wallets like Trusted Key makes the ingestion of government identities documents easy and secure. When combined with Auth0’s powerful user management and flexible backend, managing and leveraging authenticated identity is made easy for everyone.


Implementing Authenticated Identity with Trusted Key and Auth0

Learn what SOC2 is and how we implemented it at Auth0



The SaaS model is built on one thing—trust. Data breaches can cost millions, so it’s paramount companies can trust their SaaS providers with their data. As a SaaS, if people don’t trust you with their data, it will destroy you.

However if they do trust you, you can become the go-to SaaS provider in your sector for all companies, from bootstrappers up to enterprise. This will [significantly increase your potential customer base](https://resources.auth0.com/unlock-b2b-saas-growth-iam/) as you expand into these enterprise areas, and drastically increase your revenue from these companies.

So showing that you can be trusted is essential for a SaaS company moving into enterprise, and one of the best ways to build trust in your service is through SOC 2 attestation.

We’ve recently successfully completed our SOC 2 Type II audit. Here’s why we went for this report and why every SaaS should consider this as the future of trust in the cloud.

## **What’s SOC?**

<div class="" style="text-align: center;"><img style="margin: 0;" src="https://images.ctfassets.net/23aumh6u8s0i/4XXnbYxXgvFvpfb26YP1vk/fec0d857d5dc08afcb2cfd3d6cfd6d8c/soc2-logo" alt="SOC Logo" />
</div>

Back in the day there was no cloud. Enterprise companies had their own datacenters, performed their own processing, and calculated their own analytics. They only had internal data. To fight against internal fraud, the American Institute of Certified Public Accountants, AICPA, came up with a way of reporting how financial institutions controlled their internal data, called SAS 70. It focused on the risks related to this internal control of sensitive data—principally the privacy and the integrity of the data.

This was all well and good, but then SaaS came along. This paradigm shift from internal data to data living in the cloud and constantly moving back and forth between different cloud providers left these previous protocols in the past. Now internal data controls weren’t the only problem, there were also complex issues surrounding the security of this data as it moved between the different providers, and the availability of all these external systems.

For some time, SAS 70 continued to be used, but it [became widely abused](http://blogs.gartner.com/french_caldwell/2012/10/09/time-to-stop-misusing-ssae-16-in-vendor-marketing/comment-page-1). Renamed SOC 1 (Service Organization Controls 1), some SaaS providers touted a SOC 1 attestation as proof that their service is secure and can be trusted, but that was never the intent. SOC 1 helped firms comply with financial audits and prevent fraud, but it says nothing about what controls external providers should have in place to protect customer data in the cloud.

As SaaS took off, it became increasingly important for businesses to know that these external companies had the right security in place to protect any sensitive data. A new standard was needed, built around increasing the trust financial firms could put in SaaS.

Along came SOC 2.

### SOC 2 Is All About Trust

SOC 2 was set up to define the criteria for how external SaaS companies should manage their customers' data. It uses 5 Trust Principles set out by the AICPA so companies know whether the SaaS can be trusted. An independent third party audits the SaaS provider and generates a report for the SaaS, showing they do what they say. The [5 Trust Principles](http://www.aicpa.org/interestareas/informationtechnology/resources/soc/trustservices/pages/trust%20services%20principles%E2%80%94an%20overview.aspx) are:

* Security: The system is protected against unauthorized access.
* Availability: The system is available for operation and use as committed or agreed.
* Processing Integrity: System processing is complete, accurate, timely, and authorized.
* Confidentiality: Information designated as confidential is protected as committed or agreed.
* Privacy: Personal information is collected, used, retained, disclosed and destroyed in conformity with the commitments in the entity’s privacy notice and with criteria set forth in Generally Accepted Privacy Principles issued by the AICPA and CICA (Canadian Institute of Chartered Accountants).

A SOC 2 report can include just 1 of these principles or all 5 depending on what the SaaS does with other companies' data. Most companies want to know two main things from potential SaaS providers: do they have the security in place to prevent a data breach, and will their service be available constantly? These 2 Trust Principles—Security and Availability—were the the principles Auth0 has been audited on.

### Type II Is All About CONSISTENCY

Both SOC 1 and SOC 2 reports have two types, Type I and Type II.  Last year we announced our [SOC 2 Type I](https://auth0.com/blog/2014/12/11/auth0-achieves-soc-2-certification/) report. Today we’re announcing our SOC 2 Type II report. What’s the difference?

The distinction is in what each attestation reports:

* Type I—reports on whether the systems are **suitably designed**. It gives an overview of the systems a SaaS has in place to satisfy the Trust Principles it’s being audited on.
    * This type of report looks at your company and your procedures to determine whether they are designed to do the job you say they do. For instance, does your secure communications app correctly encrypt data?
    * However, a Type I report doesn’t take into consideration how well these actually work in practice. For that, you need:
* Type II—these reports look at the actual effectiveness of the system design and if it’s **operating as designed**.
    * They audit how well your software, team, and procedures worked with actual data within that timeframe.
    *  Were there any security lapses? Was your service down for any significant time? Was the data processed effectively? Did your secure comms app continually encrypt data over the timeframe, 12 months in our case, the auditors tested your system?

It’s the Type II reports that your customers really want. They want to see whether your system operates effectively over the long term.

When you have a SOC 2 Type II report, you can show it to customers as evidence that you do what you say. It shows that external auditors have agreed that the control systems you have in place work as you say they do, observed over an extended period.

Any potential enterprise customer can see that you conform to the highest standards of the AICPA and that you walk the walk, not just talk the talk. When it comes time for your customers to satisfy *their* auditors of *their* compliance, they can point to your SOC 2 report and show they are using compliant services themselves. For instance, to satisfy our  auditors, the security team here at Auth0 reviews the SOC 2 assessments of our hosting providers to make sure their security controls are operating effectively.

## The Benefits of SOC 2

Having a SOC 2 report available for potential customers opens you up to entirely new billion-dollar industries.

First and foremost, the financial industry: banks, investment companies, mortgage providers, even firms printing customer statements will only work with providers that have SOC 2 attestation. Adoption of these security standards and protocols makes CIOs and CSOs much more confident about using SaaS solutions.

Beyond finance institutions, health, insurance, payroll, and HR businesses all deal with sensitive data that require the highest standards of data protection that SOC 2 represents. They may also require their own certification, but having SOC 2 attestation shows you are serious about data security. In fact, all companies have sensitive data, so being able to show your security has been audited and that you can be trusted builds confidence in your business for all potential customers.

And SOC 2 goes even further. Because these billion-dollar enterprise firms require SOC 2 compliance throughout all the SaaS providers they work with, these SaaS providers also need to use SOC 2 compliant vendors. Therefore if you want to sell to other SaaS providers you have to be SOC 2 compliant. Then these 3rd party vendors can also become a new customer base.

![Being SOC compliant lets you sell to companies that require it](https://images.ctfassets.net/23aumh6u8s0i/2PDdLKgGtSLZZzWZ6YeFBB/3be5aef0289124780e1cd4c68c5a5f92/soc2-compliance)

Not only can you increase your customer base through a SOC 2 audit, branching out into financial sectors, health sectors, and other areas with sensitive data, it also works as a marketing tool for more general customers, implicitly demonstrating how well your company works.

This report shows that you have been externally audited as trustworthy. More than marketing materials, or your word, it's objective proof that you can be trusted with someone else's data.

## **How We Got Our SaaS Ready For SOC 2**

If you want to [go upmarket](https://auth0.com/blog/2015/08/18/how-to-go-upmarket-and-grow-your-revenue-by-20x/) and start to [attract big enterprise customers](https://resources.auth0.com/unlock-b2b-saas-growth-iam/) then SOC 2 attestation can often be a deal-breaker. Companies dealing with sensitive data want end-to-end compliance and not having SOC 2 means that they won’t even talk to you.

Here’s how our methods and procedures helped get Auth0 SOC 2 ready in the 2 Trust Principles we were audited on—security and availability—and can give you an insight into what’s needed to get this attestation.

### Security

A big part of Auth0 is our continual deployment. We deploy three to four times a day without downtime.

<include src="TweetQuote" quoteText="A big part of Auth0 is our continual deployment. We deploy three to four times a day without downtime."/>

To make this work, we need to be continually testing and integrating new code through staging and into production. Nobody at Auth0 can push to production without the approval of another team member, and no code goes live without making its way through our continuous integration and delivery server. This orchestrates all the tests needed for each job:

* **Unit Testing**—every core project at Auth0 has its own unit tests specifically built to verify code functionality. No job continues into production until all the unit tests for its specific project go green.
* **Functional Testing**—if the project is part of our frontend we have to test if it’s working as expected. For that we simulate a human workflow (such as opening up [auth0.com](http://auth0.com/) and trying to login into the dashboard) and check that all the elements on the page load as expected and that the action was able to be executed. We check over multiple browser and machine configurations. Again, if there are errors, the job is stopped and the errors logged.
* **HTTP Tests**—we run automated HTTP tests using [Runscope](https://www.runscope.com/) to validate that our APIs are working correctly. The results show the HTTP response, body, and headers of the response, the result of the assertions, and any custom script we might have defined. In case of failure, the Slack integration notifies our Slack channel. These test suites are executed on a scheduled basis targeting our production environment and after our CI server deploys to our staging environment.

As we use Slack integrations to run these tests, the Slack history then serves as our central repository for what happened when, as traceability is key for compliance. In case anything does go wrong, we can also automatically roll back the most recent release.

We keep our customers up-to-date on the latest releases at [releases.auth0.com](http://releases.auth0.com/), where customers are notified of any significant additions, fixes, or changes to the application.

With Auth0, data is encrypted in transit through Transport Layer Security (TLS) and at rest in an [AWS Elastic Block Store](https://aws.amazon.com/ebs/) (EBS). EBS encrypts both data and backup snapshots, is constantly monitored, and employs multiple redundancies. We also regularly perform failover tests to make sure we can move to backup effectively and securely.

In terms of detecting security issues with our app or site, we use a security monitoring platform to detect anomalies occurring within our infrastructure.

Our codebase is audited quarterly by [Lift Security](https://liftsecurity.io/), who are Linux and Node.js experts, and we encourage responsible security research on Auth0 through our [white hat](https://auth0.com/whitehat) program. If anyone discovers a security vulnerability in Auth0, we’ll work with them to validate and respond to all reported issues, and will happily put them on our [Researcher Hall of Fame](https://auth0.com/whitehat) to thank them.

### Availability

Availability is integral to SaaS, and at Auth0 we have designed our systems with the goal that our users, and your users, never see any down time.

Our High Availability system has been architected to incorporate multiple redundancies at all levels:

![Auth0 High Availability Architecture](https://images.ctfassets.net/23aumh6u8s0i/MAyeqSnbl89SXxLd6lkoq/bf97f35038be7b75c2c89304a3776366/high-availability-architecture)

The 3-part strategy is actually quite simple:

* **Redundancy in critical systems**—If one database is taken down, a secondary database from a different availability zone is elected as primary.
* **Rapid failure detection**—If there is an outage on the primary datacenter, the DNS immediately detects that and start redirecting requests to another datacenter in a different location.
* **Quick, safe failover**—We take a database snapshot every few hours, so we always have an up-to-date backup of all data available in case of catastrophe.

Our database snapshots also lets us recover from any issue quickly. It also has a feature that has come in very helpful for some of our customers. We can query the backup snapshot without having to restore the full dataset. This means that if a customer makes a mistake and, say, accidentally deletes all their data, we can recover their data in a matter of minutes.  A few of our customers have been very grateful for this service so far!

Our commitment to availability goes further than just the system architecture. The application is built to assure extra availability. How we manage user sessions, partition functionality, prioritize availability of modules, and handle transient conditions all facilitate increased availability of the app.

To keep our customers up-to-date on our availability, we use 2 systems:

* [status.auth0.com](http://status.auth0.com/) shows our customers the current status of our site, API, and dashboard. This is externally hosted (by [StatusPage.io](http://statuspage.io/)) so if we ever go down, any of our customers can still access this page and find updates from the team that are working on the outage.
* [uptime.auth0.com](http://uptime.auth0.com/) gives our customers in-depth uptime information, via [Pingdom](http://pingdom.com/), about pages from our site, so if they are suffering a slow connection they can check this page to see what current responses times are.

Additionally, we hit up Twitter and email whenever we need to get in contact with our customers quickly.

### Common Criteria: People & Procedures

As important as the software and infrastructure we use are the people, procedures, and policies we have instituted to optimize our workflow at Auth0.

Internally we keep track of our policies and procedures with versioning, so we can easily review how they’ve changed over time. Whenever a policy or procedure is approved we simply add the approver and date to the end of the document so everyone know it’s up-to-date.

To comply with SOC 2 we needed certain documents in place, which we already had as best practices. We’ve created written policies on password protection (something close to our hearts), patch management, encryption, and employee code of conduct.

For procedures, we have approved measures for change management, data breaches, DoS attacks and system backup and recovery. More specifically for us, we also document exactly who has access to certain code projects. This last point is important, particularly for SaaS startups. Openness and all-access to commonplace among these types of companies, but when it comes to SOC 2, access control is a fundamental requirement.
——
For companies that deal with financial data, or any data of a sensitive nature, SOC 2 is non-negotiable. Though it may seem like a significant burden for you and your team to pursue this attestation, the rewards can be immense.

A SOC 2 banner on your site starts to put you in line for an entirely new level of company, large enterprise businesses that need to protect their customer data, their employee data, and their corporate data with the highest levels of security. Successfully completing a SOC 2 audit shows these companies that you meet these high standards and that you’re serious about compliance if its required in their industry.

Not only that, but it also shows them that you can be trusted and that your entire team is dedicated to this security mission and the protection of your customers data.

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


How to Build Customer Trust in Your SaaS Through SOC 2

2ffc83fcccf746c783f921f186d1e619?s=60 avatar

2ffc83fcccf746c783f921f186d1e619?s=60

Former Auth0 Employee

Kelsey Flittner

What customers and developers think of IoT security



_**TL;DR**: Auth0 recently surveyed both developers and consumers and it turns out everyone has concerns over device and application security when it comes to the Internet of Things._

---------

While IoT is one of the world’s fastest growing technology sectors, it is also poised to become one of the fastest growing sources of security vulnerabilities for both consumers and enterprises. Here at Auth0, we were curious about both developer and consumer sentiment when it comes to the current state of IoT security, and what people think about the future (especially with the upcoming holiday season where folks are more likely to make bigger IoT purchases), so we decided to find out.

We started with consumers that were either familiar with or currently use an IoT connected device. When asked about IoT devices on the market right now, we found that **nearly 52 percent of consumers believe that these products do not have the necessary security in place**.

In a separate survey, we also polled our own network of subscribers (developers) to determine what they thought about the state of IoT security. **When asked if they’ve ever felt pressured to rush an application to market despite security concerns, over 85 percent of developers admitted that they had**.

With data breaches from major companies appearing constantly as headline news, we believe consumers are cognizant that security is a major issue, but they may not have insight into why that is. According to developers we surveyed, one reason for this is because IoT devices are often pushed to market too quickly, forcing developers to cut corners. If adding security components is resulting in a slower time-to-market, the chances are greater that they won’t be implemented at all. The best security measures are the ones you actually deploy, so simplicity in implementing strong security is critical (hint: ***Auth0*** can help with that 😉).

Developers echoed and amplified the consumer concern for better security, with **a majority 90 percent of respondents believing that the IoT devices on the market currently don’t have the necessary security in place**.

![Do you believe that IoT devices are secure?](https://images.ctfassets.net/23aumh6u8s0i/43Z5eryum1VacHZxnch7JM/b89916c018c26d4726c71bbd1bed9eab/do-you-believe-iot-devices-are-secure-2)

What’s most interesting, though, is that we found the concern over security isn’t stopping consumers. We found that **nearly half (49 percent) of respondents don’t trust having their personal and private data tied to IoT applications, but continue to use these devices nonetheless**. Consumers are aware of the general security vulnerabilities that have been associated with this category of products and applications, but are still willing to put their personal data at risk – showcasing how the demand for these technologies is compromising the need for proper security.

Interestingly, millennials (ages 18-34) were nearly split on future use, with **54 percent claiming that they did not plan to purchase or regularly use IoT devices within the next two years**. Participants aged 35-54 were slightly more skeptical, with **nearly 63 percent not interested in buying IoT devices over the next two years**.

Statistics like these would typically slow progress, innovation and growth in the IoT space, with consumers and developers hesitant to use and support these technologies due to the lack of security offered for their personal and private health, home and financial data. However, even the recent breaches that large companies have experienced (e.g., Chrysler, JP Morgan, Ashley Madison, Anthem Health, Target, Home Depot) have not had a massive impact on consumer trust or interest.

**Nearly 35 percent of consumer survey respondents claimed that the breaches of major brands have not had much of an effect on the trust or consumer interest in these brands.**

<include src="TweetQuote" quoteText="The best security measures are the ones you actually deploy"/>

As consumers continue to question the security of Internet of Things devices, developers and CIOs will need to find ways to simplify the implementation of strong identity security (hint: use ***Auth0***! 😉) and be well equipped to stay up to date on the latest security vulnerabilities - keeping their devices, applications and, ultimately, their consumer and enterprise data safe.

![Do you trust your personal data tied to an IoT device?](https://images.ctfassets.net/23aumh6u8s0i/4fzx4Tgxetbu1jwnrfcWET/239b94449039d867270a6cbe611aa7eb/do-you-trust-your-personal-data-to-iot-devices)

## Summary of results from the consumer and developer surveys:

- **52%** of respondents believe that most IoT devices on the market right now DO NOT have the necessary security in place
- **49%** of respondents don’t trust having their personal/private data tied to IoT devices – but still use them
- Only **18%** of people trust having their personal data tied to IoT devices
- **Nearly 35%** claimed that the breaches of major companies have not had much of an effect on the trust or consumer interest in these brands
- **85% of developers** surveyed have felt rushed to get an application to market due to demand/pressure in the last 6 months
- **90% of developers** surveyed do not believe that IoT devices on the market currently have the necessary security in place


Surprised? Turns out, consumers don’t trust IoT security

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Providing an always-on, highly secure identity service is core to the Auth0 brand promise.

Providing an always-on, highly secure identity service is core to the Auth0 brand promise. As such, all our systems, controls and processes have always been designed with security and availability as critical design points.  

Today, we are going one step further and we are pleased to announce that we have achieved SOC 2 Type 1 certification. 





Here are a few examples of what you can read about in the report:

* Auth0 security policies 
* Auth0 encryption protocols for data at rest and in motion
* Auth0 logical and physical access controls
* Auth0 change management process
* Auth0 data backup and disaster recovery strategies
* Auth0 system monitoring, alerts and alarms

Protecting the data and privacy of our customers is a non negotiable aspect of what we do. Our SOC 2 certification provides you with an additional assurance that we have all the right controls in place to protect your data and ensure the availability of our service.

To request a copy of Auth0 SOC 2 report, please email <trust@auth0.com>

"trust"