Auth0 Compliance and Governance — Regulatory Compliance with Auth0

// GDPR right to deletion
async function deleteUserData(userId) {
  // Step 1: Anonymize user data in Auth0
  await auth0.users.update(
    { id: userId },
    {
      email: `deleted-${Date.now()}@anonymized.example.com`,
      name: 'Deleted User',
      given_name: '',
      family_name: '',
      phone_number: '',
      user_metadata: {},
      app_metadata: { deleted_at: new Date().toISOString(), gdpr_erasure: true }
    }
  );

  // Step 2: Remove from all connections
  const user = await auth0.users.get({ id: userId });
  for (const identity of user.data.identities) {
    if (identity.provider === 'auth0') {
      await auth0.users.delete({ id: userId });
      break;
    }
  }

  // Step 3: Log deletion for audit
  await auditService.logEvent('GDPR_DELETION', {
    userId,
    timestamp: new Date().toISOString(),
    deletedBy: '[system]',
    retentionPolicy: '30_days'
  });
}

// Consent management with Actions
exports.onExecutePostLogin = async (event, api) => {
  const consented = event.user.app_metadata?.gdpr_consent?.version === 'v2';
  if (!consented) {
    api.authentication.redirect({
      url: 'https://app.example.com/consent?returnTo=' + encodeURIComponent(event.request.query.redirect_uri),
      action: 'continue'
    });
  }
};