Global enterprises rely on cloud Customer Identity and Access Management (CIAM) platforms to authenticate customers, manage digital identities, and deliver secure experiences across countries. For organizations operating in highly regulated markets, authentication is only part of the challenge.
In regulated markets, the critical question is: where is customer identity data stored, processed, and accessed?
Names, email addresses, phone numbers, and other personally identifiable information (PII) handled by identity platforms may be subject to country-specific data residency, data sovereignty, privacy, and security requirements.
For enterprises using Auth0, these requirements can create a challenge. Organizations want to maintain a centralized, global identity architecture while ensuring that regulated identity data remains within the required jurisdiction.
InCountry for Auth0 addresses this challenge by adding a data residency layer between users and the Auth0 environment. Sensitive identity data remains in-country, while Auth0 continues to provide the authentication and identity capabilities enterprises depend on.
What is Auth0 data residency?
Auth0 data residency is the practice of controlling where identity data is stored and processed when using Auth0.
Data residency requirements vary by country, industry, and data type. Financial institutions, healthcare organizations, government agencies, and multinational enterprises may face regulations that restrict the storage or international transfer of personal information.
Countries such as China, Saudi Arabia, South Korea, Australia, and others have specific requirements that can affect how organizations design their cloud and identity infrastructure.
The traditional response may be to create separate identity environments for each country. However, this can result in multiple tenants, complex routing, duplicated administration, and increased operational costs.
A different approach is to separate global identity functionality from local regulated data.
The challenge: Global CIAM vs. Local data residency
A typical global CIAM architecture looks like:
User → Auth0 → Application
Auth0 manages authentication, user profiles, sessions, and identity information.
For organizations with strict residency requirements, the architecture can instead introduce a local data control layer:
User → InCountry → Auth0 → Application
In this model, InCountry operates as a data residency proxy. Relevant authentication and identity traffic passes through an InCountry node, where regulated data can be identified and cloaked before it reaches the global Auth0 environment. This is only possible because InCountry operates infrastructure in-country.
This creates a hub-and-spoke model:
- Auth0 remains the global authentication platform.
- InCountry provides country-specific data residency nodes.
- Clear-text regulated PII remains within the required jurisdiction.
- Auth0 receives protected values such as hashed or tokenized data.
- Authorized administrators can access underlying information through controlled mechanisms.
The result is a global CIAM architecture with localized control over sensitive identity data.
How InCountry for Auth0 works
InCountry integrates with Auth0 at the authentication-flow level through a reverse proxy.
The proxy sits in the required country and intercepts relevant traffic before sensitive identity information is transmitted to the Auth0 tenant.
1. Identity data is intercepted and protected
When a user registers, logs in, or interacts with an identity workflow, the request can pass through the InCountry proxy.
Sensitive fields such as:
- Email addresses
- Names
- Phone numbers
- Other identity attributes can be protected before being sent to Auth0.
2. Clear-text PII stays in-country
The original identity information is stored within the designated InCountry environment in the required jurisdiction.
InCountry supports deployment across public cloud, including AWS, Azure, Google Cloud, Alibaba Cloud, local and sovereign cloud providers, private data centers, and customer-owned infrastructure.
3. Auth0 stores protected values
Instead of receiving the original PII, Auth0 can store hashed, tokenized, or otherwise obfuscated representations.
This allows Auth0 to continue performing identity operations while reducing the exposure of clear-text regulated information outside the country.
Protecting universal login, passwords, and MFA
Data residency must cover more than user-profile storage. Authentication itself can involve sensitive information.
With InCountry for Auth0, Universal Login can be rendered through the InCountry proxy, and Auth0-hosted forms and customer-built forms can continue to be used.
Password credentials are also processed with the original information retained within the local environment and a protected representation used by Auth0.
Multi-factor authentication introduces another consideration. Email and SMS authentication may require access to a user’s real email address or phone number.
InCountry can route MFA communication through an in-country SMTP or SMS proxy. The proxy maps the protected identity value used by Auth0 back to the real contact information stored locally before the message is delivered.
This enables enterprises to maintain familiar Auth0 authentication and MFA workflows while applying country-specific data controls.
One Auth0 tenant, multiple countries
A key advantage of the InCountry architecture is that enterprises can support multiple countries through a centralized Auth0 tenant and multiple InCountry nodes.
For example:
Global Auth0 Tenant
↓
InCountry China Node
InCountry Saudi Arabia Node
InCountry UAE Node
InCountry Australia Node
Each country-specific node manages regulated identity data for its jurisdiction while Auth0 continues to operate as the global CIAM platform.
Country-aware routing can be based on IP detection, user-selected country, identity metadata, or other authentication logic.
This approach can reduce the complexity of maintaining separate identity tenants for every regulated market.
Supporting Auth0 actions and management APIs
A data residency architecture must also account for administrative and API-based identity operations.
InCountry supports Auth0 Management API traffic through the proxy, allowing user-management operations to continue while regulated fields are handled by the residency layer.
Auth0 Actions and related user-management workflows can also work with the proxy architecture.
This means organizations can preserve existing identity workflows instead of redesigning their applications around country-specific identity stores.
Secure administration of identity data
Data residency should not prevent authorized identity administrators from doing their jobs.
InCountry provides mechanisms that allow authorized administrators to access the clear-text identity information stored within the relevant country.
A Chrome extension can also display authorized clear-text values directly within the Auth0 administration interface. This allows administrators to continue using the familiar Auth0 dashboard while the underlying regulated data remains in-country.
Administrative changes can be routed through the InCountry proxy or supported APIs to keep the local and protected identity representations synchronized.
InCountry for Auth0 is available on the Auth0 marketplace
Organizations looking to extend Auth0 with data residency capabilities can discover InCountry for Auth0 on the official Auth0 Marketplace.
Being available through the Auth0 Marketplace makes the integration easier for Auth0 customers and teams to evaluate alongside other identity and security integrations.
The integration is designed for enterprises that want to add country-specific data residency controls without replacing their existing Auth0 investment or rebuilding application-level authentication.
Customers can use the InCountry integration to introduce capabilities including:
- In-country storage of regulated identity data
- Hashing and tokenization of sensitive PII
- Data residency for authentication and user-profile flows
- MFA data routing through in-country infrastructure
- Auth0 Management API support
- Country-aware identity routing
- Flexible deployment across cloud and sovereign infrastructure
For enterprises already using Auth0, this provides a practical path toward addressing identity data residency requirements as they expand into regulated markets.
Auth0 data residency for regulated industries
The need for identity data residency is particularly relevant to regulated industries.
Financial Services
Banks, insurers, fintech companies, and other financial organizations often operate across jurisdictions with strict requirements around customer information.
A data residency layer can help organizations maintain global CIAM capabilities while applying local controls to sensitive identity information.
Healthcare/Life Sciences
Healthcare and life sciences organizations manage highly sensitive personal information and may face stringent national and regional privacy requirements, especially in the realm of clinical trials
Keeping regulated identity information within the appropriate jurisdiction can become an important component of the overall data protection strategy.
Public Sector
Public sector organizations may have requirements around sovereign infrastructure, local hosting, and access to citizen information.
InCountry’s flexible deployment model supports public cloud, local cloud, sovereign cloud, and customer-owned environments.
Global Enterprises
For multinational companies, the challenge is often the inconsistency of requirements between countries.
Rather than creating an entirely independent CIAM architecture for every market, enterprises can use a centralized Auth0 environment together with localized InCountry data residency nodes.
Balancing compliance and performance
Introducing an intermediary proxy can add network overhead. For organizations operating globally, latency should therefore be considered when designing a data residency architecture.
InCountry’s hub-and-spoke model is designed to minimize this impact by deploying in-country nodes close to users or within required local infrastructure.
For regulated enterprises, however, performance is only one consideration. Organizations must balance authentication latency with regulatory requirements, data sovereignty obligations, security, and the operational cost of maintaining separate identity environments.
In many cases, keeping sensitive data within the required jurisdiction can be a more sustainable approach than creating completely separate CIAM architectures for every country.
Build a global Auth0 architecture with local data control
Global enterprises should not necessarily have to choose between a centralized CIAM platform and country-specific data residency.
InCountry for Auth0 provides a data residency layer that enables organizations to keep regulated identity data in-country while continuing to use Auth0 for global authentication and identity management.
The architecture combines:
- Global CIAM through Auth0
- In-country PII/PHI/PFI storage through InCountry
- Hashing and tokenization of regulated fields
- Country-aware authentication routing
- MFA data residency
- Management API support
- Flexible cloud and sovereign infrastructure
- Centralized identity management with localized data control
For enterprises expanding into China, Saudi Arabia, the UAE, South Korea, Australia, and other regulated markets, this approach can help extend an existing Auth0 investment while addressing country-specific data residency requirements.
InCountry for Auth0 is available on the Auth0 Marketplace, making it easier for enterprises to explore a data-resident architecture for their global identity environment.