Platform
Data residency
Where your users' identity data lives, who can reach it, and the parts of a sign-in that leave that boundary. The commercial version of this page is at authalla.com/european; this one is for the engineer filling in a security questionnaire.
The short answer
Authalla Oy is a Finnish company. The service itself, and everything we store, runs on infrastructure from Hetzner Online GmbH, a German company, in its Helsinki data centre in Finland — application servers, the PostgreSQL database and its backups, object storage and authoritative DNS.
There is no US parent company and no US holding structure, so no US court order can be served on an entity that controls your data.
What is stored
| Data | Where |
|---|---|
| User records (email, profile attributes, external IDs) | PostgreSQL, EU |
| Passkey credentials (public keys and metadata — never a private key) | PostgreSQL, EU |
| Sessions, refresh tokens, authorization codes | PostgreSQL, EU |
| Audit and activity logs | PostgreSQL, EU |
| Tenant configuration, apps, SSO and SCIM connections | PostgreSQL, EU |
| Uploaded branding assets (logos, images) | Object storage, EU |
Authalla stores no passwords, because the product has none — there is no password field, no password hash column and no reset flow. See Passkeys and Magic links for what is stored instead.
What leaves the boundary, and when
Three things, all of them a consequence of a choice you make.
Transactional email. Magic links and one-time codes are delivered through Brevo (Sendinblue SAS), a French company. The recipient's email address and the message content reach it, because that is what sending an email means. EU-owned, and on the subprocessor list. Brevo states that it stores data on its own servers and on Google Cloud in Belgium: the data stays in the EU, but part of the infrastructure under it belongs to a US company.
Identity providers you enable. If you turn on social login (Google, GitHub, Microsoft, Facebook, X, LinkedIn, Discord) or connect a customer's enterprise IdP over OIDC or SAML, that authentication happens in that provider's jurisdiction under their terms. Passkeys and email sign-in involve nobody but us.
TLS certificates. Certificates for authalla.com and for custom domains are issued by Let's Encrypt (Internet Security Research Group, US). Domain names are the only thing that reaches them — no user data is involved in issuance.
What this means for your paperwork
Storing your identity data in Authalla removes the third-country transfer question for that dataset: no transfer impact assessment, no standard contractual clauses, and no dependence on an adequacy decision.
It does not make your product GDPR or NIS2 compliant — nothing you buy can do that. If you sell to enterprises, it answers one question on their supply-chain assessment without a caveat.
The current subprocessor list, with each company's ultimate parent country, is published at authalla.com/subprocessors and we give notice before it changes.