Security and Compliance Overview
Auth0 (now part of Okta) holds SOC 2 Type II and ISO 27001 certifications, and offers data residency options (US, EU, Australia) on applicable plans for organizations with regional data requirements. Built-in protections include Breached Password Detection (checking logins against known credential-leak databases), Brute-Force Protection, and Bot Detection (CAPTCHA challenge integration for suspicious traffic).
Practical Details
For MFA, Auth0 supports push notifications via the Guardian app, TOTP authenticator apps, SMS (generally discouraged as a primary factor due to SIM-swap risk), and WebAuthn/biometric factors for the strongest option. None of these are enabled by default -- MFA policies (which factors are allowed, and whether MFA is required or risk-based via Adaptive MFA) have to be explicitly configured per tenant.
Actionable Considerations
- Confirm your required data residency region (US/EU/Australia) is available on your plan before going live if you have regional compliance requirements
- Prefer WebAuthn or TOTP over SMS as an MFA factor given SMS's SIM-swap vulnerability
- Explicitly enable Breached Password Detection, Brute-Force Protection, and MFA policy -- none of these ship active by default