GDPR Compliance

Avnology ID provides built-in tools to help you comply with the EU General Data Protection Regulation (GDPR).

Data subject rights

Right of access (Article 15)

Users can view all data Avnology ID stores about them through the self-service settings page. Programmatically:

Right to data portability (Article 20)

Export user data in a machine-readable JSON format:

const exportData = await auth.admin.exportUserData({
  userId: "user_abc123",
  format: "json",
});
// Includes: profile, credentials metadata, sessions, consents, permissions

Right to erasure (Article 17)

Delete a user and all associated data. This triggers a cascade cleanup:

await auth.admin.deleteUser({
  userId: "user_abc123",
  cascade: true, // Deletes all associated data
});

The cascade deletes:

1. User identity and profile
2. All credentials (passwords, passkeys, TOTP)
3. All active sessions
4. All OAuth consents
5. All refresh tokens
6. All permission tuples
7. Organization memberships
8. Recovery codes
9. Verification records
10. Social login connections
11. Device fingerprints
12. Audit log references (anonymized, not deleted)
13. Webhook delivery records
14. SCIM provisioning records

Scheduled deletion

Users can request account deletion with a grace period:

await auth.admin.scheduleUserDeletion({
  userId: "user_abc123",
  gracePeriodDays: 30, // User can cancel within 30 days
  notifyEmail: true,   // Send daily reminders
});

Right to rectification (Article 16)

Users can update their profile through self-service settings or via the API:

await auth.admin.updateUser({
  userId: "user_abc123",
  traits: { name: { first: "Jane", last: "Smith" } },
});

Data processing

Consent management

Avnology ID records OAuth consent grants with timestamp, scopes, and purpose:

const consents = await auth.admin.listUserConsents({
  userId: "user_abc123",
});

// Users can revoke consents
await auth.admin.revokeConsent({
  userId: "user_abc123",
  clientId: "app_xyz789",

Data retention

Configure data retention policies:

Next steps

• SOC 2 -- SOC 2 alignment
• Security -- Security practices