Personally Identifiable Information in Tenant Logs

Many logs in Auth0 tenant logs can contain personally identifiable information (PII). Authentication events trigger log entries that can include users’ PII. And if you use the Auth0 Management API or the Dashboard to add users, Auth0 logs the user account details. These fields in log entries can contain PII:

• Name
• Phone number (used for multi-factor authentication)
• Email address
• IP address (which can reveal location)
• Any custom user information you define

Tenant logs exclude core authentication secrets, like OTP codes, OTP seeds, biometric data, and private keys. At no point does Auth0 log access tokens from Auth0 or any identity provider. When authorization code exchanges occur, the logs show only a partial code (for example: code: 31XXXXX).

​

Filtering and PII obfuscation

Customers can choose which filter categories of their logs to stream and which to exclude to ensure the external destination receives only the relevant data. Customers can also choose to mask or hash Personal Identifiable Information (PII) in the streamed logs. Auth0 provides two ways to obfuscate PII tenant log fields when streaming to third-party destinations:

• Masking: the field values are replaced with asterisks
• xxHash: a fast, non-cryptographic hash algorithm

The customer can obfuscate the following log data and field names when streaming: