Data Residency
LumoAuth offers regional hosting so EU customers' data stays in the EU and US customers can opt for US-only processing. This page is the canonical reference for regulators, security reviewers, and procurement teams.
Available regions
| Region | URL | Plans |
|---|---|---|
| United States | https://app.lumoauth.dev | All plans |
| European Union | https://eu.app.lumoauth.dev | All plans |
The two regions are independent deployments: nothing replicates between them. Your organization's region is decided by which deployment it is created on: the sign-up form opens with a Data region selector (United States by default) that takes you to the chosen region's sign-up page and reminds you that the region cannot be changed later, and the sign-in page has the same switch so you can reach the region your organization lives in. The region cannot be changed from the portal; the Data residency & transfers section of Privacy overview → Settings explains that residency is enforced at the deployment level, with no application-layer controls. To move an organization between regions, contact us.
What's stored where
For an organization in region X, all of the following stay in region X:
- User records (email, name, password hashes, MFA (multi-factor authentication) enrolment, profile)
- Session state (refresh tokens, device fingerprints, IP history)
- OAuth client configuration (secrets, redirect URIs, scopes)
- Audit logs
- Organization signing keys (private keys encrypted with the region's encryption key, or held in your own key storage provider)
- Webhook delivery logs (encrypted)
- Data provisioned over SCIM (automatic user provisioning)
- AI agent registry (agent identifiers, public keys, capabilities)
- JIT permission requests + approval history
What may transit through other regions
The following operations involve transient data flow outside the region, depending on how the deployment and your organization are configured:
| Operation | Transient location | Data | Safeguard |
|---|---|---|---|
| TLS termination, DDoS / WAF | Cloudflare global edge, when the deployment is fronted by Cloudflare | Headers, IP, request URL | No data at rest; Cloudflare DPA + SCCs in place |
| Email send | The platform mailer, or your own email provider (Amazon SES, SendGrid, Mailgun, Resend, Postmark or SMTP) | Recipient email, message content | DPA + SCCs; choose a provider and region yourself |
| SMS send (if enabled) | Your own SMS provider (Twilio, Vonage, AWS SNS or MessageBird) | Recipient phone, one-time code | DPA + SCCs; SMS is off until you configure a provider |
| AI requests (if enabled) | The AI provider configured for the deployment (OpenAI, Anthropic, Google or Mistral) | Prompts | Per-organization disable; an EU provider (Mistral) for EU-only AI |
For EU-only data flow:
- Use the EU region (
eu.app.lumoauth.dev) - Route email through your own provider under Integrations → SMS & email delivery
- Leave SMS unconfigured (no text-message codes)
- Disable AI features, or pin them to Mistral (FR)
Cross-border transfer mechanism
Where transient data flow crosses jurisdictions, LumoAuth relies on the EU Standard Contractual Clauses (SCCs) Module 3 in the LumoAuth DPA, supplemented by:
- UK International Data Transfer Addendum (IDTA) — for UK-origin transfers
- Swiss FADP supplemental clauses — for Swiss-origin transfers
- Transfer Impact Assessment (TIA) — performed and documented for each sub-processor; available on request under NDA
A copy of the DPA is at lumoauth.dev/legal/dpa and is part of the standard customer agreement on Pro and above.
Data sovereignty & government access
LumoAuth has never received a government data request. We commit to publishing a transparency report annually, even when the count is zero.
Encryption at rest
Sensitive columns — signing keys, webhook secrets, integration credentials, MFA secrets — are encrypted with the region's own encryption key (authenticated encryption; the key is generated once per region and never leaves it). Signing keys can instead live in a key storage provider or HSM you control. Disk encryption below that layer depends on the hosting provider of the deployment.
Encryption in transit
- External: TLS 1.3 (TLS 1.2 minimum, weak ciphers disabled), HSTS preloaded, certificates from Let's Encrypt.
- Internal: database connections use TLS (
verify-full) with SCRAM authentication. Regions are fully independent; nothing replicates between them.
Backup residency
Backups are stored in the same region as the primary database. EU organizations' backups never leave the EU. Backups are encrypted; nightly dumps are kept for 14 days, with continuous write-ahead-log archiving for point-in-time recovery.
Audit & evidence
For SOC 2 / ISO 27001 / GDPR audit evidence:
- Sub-processor list
- GDPR overview
- Audit log export
- DPA + SCCs: lumoauth.dev/legal/dpa
- SOC 2 Type II report: under NDA, security@lumoauth.dev
- ISO 27001 Statement of Applicability: under NDA, same address
Region migration
Need to move an organization between regions? Email support@lumoauth.dev with the source and target regions. Process:
- We provision a new organization in the target region.
- We script a parallel-run migration (users, OAuth clients, audit logs, signing keys).
- You point your apps at the target region's URL.
- Source organization decommissioned after 30 days.
Typical elapsed time: 24–48 hours. No downtime if you have a brief dual-issue window in your apps.