Concerned with vendor's usage of Auth0