How we collect, use, and protect your data. No surprises.
This Privacy Policy describes how Auth1, Inc. ("Auth1," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our authentication platform, APIs, SDKs, and related services (collectively, the "Service").
We believe in transparency. This policy is written to be clear and readable, not buried in legal jargon. If anything is unclear, please reach out to privacy@auth1.ai and we will explain it.
By using the Service, you agree to the collection and use of information as described in this policy. This policy should be read alongside our Terms of Service.
When you create an Auth1 account, we collect:
When you or your end users authenticate through Auth1, we process:
We automatically collect certain information when the Service is used:
If you are an Auth1 customer (tenant), we store:
To comply with TCPA, CAN-SPAM, and GDPR, we maintain detailed consent records including:
We use the information we collect for the following purposes:
What we do NOT do with your data:
We use the following third-party services to operate the Auth1 platform. Each provider is bound by a data processing agreement and processes data only as necessary to deliver their service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Twilio | SMS delivery (OTP codes) | Phone numbers, message content |
| AWS SES | Email delivery (verification codes, magic links) | Email addresses, message content |
| AWS (RDS, ElastiCache, EB) | Infrastructure hosting | All data (encrypted at rest and in transit) |
| Netlify | Marketing site hosting | None (marketing site only, no user data) |
| Stripe | Payment processing | Billing information (handled directly by Stripe) |
We do not share personal data with any other third parties unless required by law or with your explicit consent.
We implement multiple layers of security to protect your data:
| Layer | Implementation |
|---|---|
| Passwords | Argon2id hashing via compiled Rust binary — never stored in plaintext, never reversible |
| PII at rest | Optional AES-256-GCM encryption (Enterprise tier) |
| Transport | TLS 1.3 enforced for all API connections |
| Tokens | httpOnly cookies only — no localStorage, no client-accessible tokens |
| Audit trail | Immutable consent and activity logs — append-only, no deletions |
| Post-quantum | Optional ML-DSA-65 (Dilithium) signatures on audit records for tamper-proof, quantum-resistant evidence |
| Secret comparisons | Constant-time (timing-safe) algorithms to prevent side-channel attacks |
| Resilience | Circuit breakers, rate limiting, and structured logging for incident response |
Despite these measures, no security system is perfect. If we discover a breach that affects your data, we will notify you as required by applicable law and take immediate steps to mitigate the impact.
We retain data only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account data (email, name, phone) | Until account deletion |
| OTP codes | Auto-deleted after verification or 10-minute expiry |
| Session data | 7 days after last activity |
| Authentication audit logs | 2 years (or as required by applicable law) |
| Consent records | 7 years (TCPA statute of limitations requirement) |
| Billing records | 7 years (tax and accounting requirements) |
After account deletion, all personal data is purged within 30 days, with the exception of records we are legally required to retain (consent audit logs and billing records). Retained records are anonymized where possible.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@auth1.ai. We will respond to verified requests within 30 days (or sooner as required by law). We may ask you to verify your identity before processing a request.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
If you use Auth1 through one of our customers' applications (for example, when you log in to an app that uses Auth1 for authentication), please note the following:
Our customers are contractually required to have a lawful basis for processing your data through Auth1 and to inform you about their data practices.
Auth1 is not directed at children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children below these ages.
If we become aware that we have collected personal data from a child without verified parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@auth1.ai.
Auth1's infrastructure is hosted in the United States (AWS us-east-1 region, Northern Virginia). If you access the Service from outside the United States, your data will be transferred to and processed in the United States.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland:
We ensure that any international transfer of personal data is subject to appropriate safeguards as required by applicable data protection laws.
Auth1 uses cookies in a limited and transparent way:
Auth1's APIs use httpOnly session cookies to maintain authenticated sessions. These cookies are:
Our marketing site (auth1.ai) uses minimal analytics cookies to understand how visitors interact with our documentation and marketing content. We do not use:
We may update this Privacy Policy from time to time. When we make changes:
We encourage you to review this policy periodically. Your continued use of the Service after the updated policy takes effect constitutes your acknowledgment of the changes.
This Privacy Policy is governed by the laws of the State of Florida, United States. Any disputes relating to this Privacy Policy are subject to the mandatory binding arbitration and class action waiver provisions set forth in our Terms of Service (Section 18).
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Auth1, Inc.
Privacy inquiries: privacy@auth1.ai
Legal inquiries: legal@auth1.ai
General support: support@auth1.ai
For EU/EEA residents, if you are not satisfied with our response, you have the right to contact your local supervisory authority.