A GDPR Checklist for the Auth Layer

Authentication is quietly one of the most data-hungry parts of a product. Email addresses, IP addresses, device and browser strings, timestamps, approximate location — all collected by default, all personal data, and most of it retained forever because nobody chose a retention period.

The obligations people miss

• Deletion has to reach the auth system, not just your application database.
• Export means everything you hold about the person — including login history.
• Login IP and device logs need a retention period that you can defend as proportionate.
• If your auth provider processes data on your behalf, you need a processing agreement with them.
• Where the data is stored matters, and your customers will eventually ask.

“The awkward question in an audit is rarely "do you encrypt it". It is "why do you still have it".”

Alt Auth supports soft delete, CSV export of user data, and configurable analytics so you are not accumulating detail you have no use for. Deletion propagates through the auth layer rather than leaving orphaned records behind.