GDPR checklist for authentication tools.
Authentication providers see every sign-in: identifiers, email addresses, sessions and access logs. Compare 14 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Memberstack | Usually a processor | Set per account or project | Obtained through the vendor |
 Auth0 | Usually a processor | Set per account or project | Obtained through the vendor |
 Clerk | Usually a processor | Usually the United States | Published by the vendor |
 WorkOS | Usually a processor | Usually the United States | Published by the vendor |
 Okta | Usually a processor | Set per account or project | Obtained through the vendor |
 Stytch | Usually a processor | Usually the United States | Obtained through the vendor |
 Descope | Usually a processor | Set per account or project | Published by the vendor |
 Ping Identity | Usually a processor | Set per account or project | Published by the vendor |
 OneLogin | Usually a processor | Set per account or project | Published by the vendor |
 Hanko | Usually a processor | Usually Germany | Published by the vendor |
 Ory | Usually a processor | Set per account or project | Obtained through the vendor |
 Memberful | Usually a processor | Set per account or project | Published by the vendor |
 MemberSpace | Usually a processor | Set per account or project | Obtained through the vendor |
 Outseta | Usually a processor | Set per account or project | Obtained through the vendor |
What to check for authentication tools
- Confirm where user records are stored and whether you can choose the region.
- Check how long sign-in logs are kept and how users are deleted.
- Keep the provider in your privacy policy as a recipient of account data.
- Review the provider’s security documentation for the controls you rely on.
All authentication tools
Questions, answered.
What should I check before using an authentication tool under the GDPR?
Confirm where user records are stored and whether you can choose the region. Check how long sign-in logs are kept and how users are deleted. Keep the provider in your privacy policy as a recipient of account data. Review the provider’s security documentation for the controls you rely on.
Do I need a data processing agreement with an authentication provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which authentication tools does Privacyboard cover?
Memberstack, Auth0, Clerk, WorkOS, Okta, Stytch, Descope, Ping Identity, OneLogin, Hanko, Ory, Memberful, MemberSpace, Outseta. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.