# \#security-compliance **URL:** https://community.auth0.com/tag/security-compliance/2122.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [SOC2 report / whistic not working?](https://community.auth0.com/t/soc2-report-whistic-not-working/201554)
**Author:** [@MrShadow](https://community.auth0.com/u/MrShadow)\ **Replies:** 1\ **Last updated:** [July 11, 2026, 8:45pm UTC](https://community.auth0.com/t/soc2-report-whistic-not-working/201554 "2026-07-11T20:45:28Z")
I am trying to get access to the SOC2/SOC3 report and am redirected to whistic.com. I sign up and it just gives me a login redirect loop. I sign in, it brings me back to sign in screen. Has anyone access beeen able to ge… --- ## [Looking to access password inside Actions workflow for Signup or Reset password request](https://community.auth0.com/t/looking-to-access-password-inside-actions-workflow-for-signup-or-reset-password-request/200555)
**Author:** [@ankit.joshi](https://community.auth0.com/u/ankit.joshi)\ **Replies:** 1\ **Last updated:** [June 5, 2026, 6:52pm UTC](https://community.auth0.com/t/looking-to-access-password-inside-actions-workflow-for-signup-or-reset-password-request/200555 "2026-06-05T18:52:17Z")
Hi, I am looking for the way to access password submitted by the end user via Auth0 driven signup or reset password form inside Actions (pre/post) triggers workflow with the purpose to integrate breach password validati… --- ## [SOC 2 Type II FY26 Auditor vs. Bridge Letter Auditor Mismatch](https://community.auth0.com/t/soc-2-type-ii-fy26-auditor-vs-bridge-letter-auditor-mismatch/197412)
**Author:** [@kpryce](https://community.auth0.com/u/kpryce)\ **Replies:** 1\ **Last updated:** [February 19, 2026, 4:48pm UTC](https://community.auth0.com/t/soc-2-type-ii-fy26-auditor-vs-bridge-letter-auditor-mismatch/197412 "2026-02-19T16:48:00Z")
Hello, I’m working with our internal compliance group on vendor risk documentation and had a question regarding the latest SOC materials. The SOC 2 Type II Report for FY26 lists Ernst & Young (E&Y) as the service audit… --- ## [Accessing SOC2 Report](https://community.auth0.com/t/accessing-soc2-report/196244)
**Author:** [@bre](https://community.auth0.com/u/bre)\ **Replies:** 3\ **Last updated:** [January 26, 2026, 7:06pm UTC](https://community.auth0.com/t/accessing-soc2-report/196244 "2026-01-26T19:06:24Z")
Hi, I was wondering if I could get assistance in accessing Auth0’s SOC2 report. I’ve requested access to via the Okta Trust Center but I keep getting denied and I’m not sure why. Thanks for your help! --- ## [Forgot Password API Receiving Excessive Requests Despite Brute-Force Protection Enabled](https://community.auth0.com/t/forgot-password-api-receiving-excessive-requests-despite-brute-force-protection-enabled/196182)
**Author:** [@artha.tech](https://community.auth0.com/u/artha.tech)\ **Replies:** 1\ **Last updated:** [January 12, 2026, 8:59pm UTC](https://community.auth0.com/t/forgot-password-api-receiving-excessive-requests-despite-brute-force-protection-enabled/196182 "2026-01-12T20:59:08Z")
Hello Support Team, We are facing an issue with the Auth0 Forgot Password API being abused through what appears to be a brute-force style attack. Currently, the API is receiving nearly 1000 requests from the same IP, w… --- ## [Forgot Password API Receiving Excessive Requests Despite Brute-Force Protection Enabled](https://community.auth0.com/t/forgot-password-api-receiving-excessive-requests-despite-brute-force-protection-enabled/196146)
**Author:** [@dev.nareshch](https://community.auth0.com/u/dev.nareshch)\ **Replies:** 1\ **Last updated:** [January 12, 2026, 8:54pm UTC](https://community.auth0.com/t/forgot-password-api-receiving-excessive-requests-despite-brute-force-protection-enabled/196146 "2026-01-12T20:54:27Z")
Hello Support Team, We are facing an issue with the Auth0 Forgot Password API being abused through what appears to be a brute-force style attack. Currently, the API is receiving nearly 1000 requests from the same IP, w… --- ## [HIPAA Compliance in auth0](https://community.auth0.com/t/hipaa-compliance-in-auth0/195311)
**Author:** [@daniel20](https://community.auth0.com/u/daniel20)\ **Replies:** 1\ **Last updated:** [December 9, 2025, 4:45pm UTC](https://community.auth0.com/t/hipaa-compliance-in-auth0/195311 "2025-12-09T16:45:15Z")
Hey, I hope you’re all doing well. I’m working on a product that needs to be HIPAA-compliant. I’m using Auth0 for authentication, and we’ll only store the user’s email and password, no patient metadata. I’m a bit confus… --- ## [Security compliance question for Auth0](https://community.auth0.com/t/security-compliance-question-for-auth0/195138)
**Author:** [@joe.pringle](https://community.auth0.com/u/joe.pringle)\ **Replies:** 3\ **Last updated:** [December 4, 2025, 1:05am UTC](https://community.auth0.com/t/security-compliance-question-for-auth0/195138 "2025-12-04T01:05:45Z")
Hi auth0 gurus - My company is using auth0 as part of our cloud environment, which a couple of our security sensitive end-customers are using. One of our customer’s security team has asked us a specific question about … --- ## [Is there a way for users without an enterprise support fees to get the SOC2 report?](https://community.auth0.com/t/is-there-a-way-for-users-without-an-enterprise-support-fees-to-get-the-soc2-report/194248)
**Author:** [@tmae](https://community.auth0.com/u/tmae)\ **Replies:** 2\ **Last updated:** [November 24, 2025, 11:17am UTC](https://community.auth0.com/t/is-there-a-way-for-users-without-an-enterprise-support-fees-to-get-the-soc2-report/194248 "2025-11-24T11:17:46Z")
Currently, essential users cannot access the compliance page on the support center. Is it necessary to pay additional enterprise support fees to get an SOC or equivalent report from Auth0? --- ## [Regarding compliance report](https://community.auth0.com/t/regarding-compliance-report/192330)
**Author:** [@kushankurxd](https://community.auth0.com/u/kushankurxd)\ **Replies:** 1\ **Last updated:** [September 29, 2025, 3:35pm UTC](https://community.auth0.com/t/regarding-compliance-report/192330 "2025-09-29T15:35:44Z")
As we are assessing our vendors we will require your latest SOC 2 report, I tried downloading from the trust center but it seems like my access is denied. Can you help us out? Or at least point me towards the right perso… --- ## [CSP Inline Style Blocked in Auth0 React Widget after Setting INLINE\_RUNTIME\_CHUNK=false](https://community.auth0.com/t/csp-inline-style-blocked-in-auth0-react-widget-after-setting-inline-runtime-chunk-false/187205)
**Author:** [@ashpaq.inamdar](https://community.auth0.com/u/ashpaq.inamdar)\ **Replies:** 3\ **Last updated:** [June 2, 2025, 3:07pm UTC](https://community.auth0.com/t/csp-inline-style-blocked-in-auth0-react-widget-after-setting-inline-runtime-chunk-false/187205 "2025-06-02T15:07:25Z")
Hello Auth0 Support Team, I’m integrating the Auth0 React SDK in my React app built with react-scripts@4.0.3. Recently, I set INLINE\_RUNTIME\_CHUNK=false in my .env to disable inlining of runtime JS chunk. After this ch… --- ## [Security Concern: Auth Data and Encryption Keys Stored Together in SharedPreferences in React Native SDK](https://community.auth0.com/t/security-concern-auth-data-and-encryption-keys-stored-together-in-sharedpreferences-in-react-native-sdk/190522)
**Author:** [@chandru\_thillai\_edhc](https://community.auth0.com/u/chandru_thillai_edhc)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 3:57pm UTC](https://community.auth0.com/t/security-concern-auth-data-and-encryption-keys-stored-together-in-sharedpreferences-in-react-native-sdk/190522 "2025-08-25T15:57:11Z")
We are using the package-name React Native SDK (CredentialManager) in our Android app to persist authentication data. During a recent security assessment, it was found that authentication data and its encryption material… --- ## [Security scan warning: com.auth0.state cookie not Secure — expected behavior?](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844)
**Author:** [@paul.stypula](https://community.auth0.com/u/paul.stypula)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 3:16pm UTC](https://community.auth0.com/t/security-scan-warning-com-auth0-state-cookie-not-secure-expected-behavior/190844 "2025-08-25T15:16:13Z")
The com.auth0.state cookie has been flagged by our security scans for missing the Secure attribute. It is set by Auth0 during the redirect to /authorize. I previously found a post discussing other cookies not being marke… --- ## [Outlook Add-In 3rd party authorization](https://community.auth0.com/t/outlook-add-in-3rd-party-authorization/188134)
**Author:** [@JohnDoe1AUTH](https://community.auth0.com/u/JohnDoe1AUTH)\ **Replies:** 1\ **Last updated:** [June 19, 2025, 4:40pm UTC](https://community.auth0.com/t/outlook-add-in-3rd-party-authorization/188134 "2025-06-19T16:40:28Z")
I develop Outlook add-in that should be able to send data to my server. To do this I added authorization flow using Auth0 (same as I do in frontend app) I am not sure if this approach will pass add-in review for publish… --- ## [Qualys Security Verification](https://community.auth0.com/t/qualys-security-verification/187288)
**Author:** [@murilo.gomes](https://community.auth0.com/u/murilo.gomes)\ **Replies:** 1\ **Last updated:** [May 28, 2025, 4:58pm UTC](https://community.auth0.com/t/qualys-security-verification/187288 "2025-05-28T16:58:33Z")
Hi guys, We started testing Auth0 in our application to provide more security and reliability to our customers. However, one of these customers applied the Qualys TotalAppSec security verification test and identified a … --- ## [User Authorization across different Authorization Code clients](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148)
**Author:** [@skatanski](https://community.auth0.com/u/skatanski)\ **Replies:** 3\ **Last updated:** [May 7, 2025, 7:05pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148 "2025-05-07T19:05:21Z")
Hi! Does Auth0 provide a mechanism to limit potential cross-client access. Let me give you an example: we have 2 authorization code clients, one is a client used in one front-end product, the other client is used in a… --- ## [Okta/auth0 enabled domain spam/flooding/phishing activity](https://community.auth0.com/t/okta-auth0-enabled-domain-spam-flooding-phishing-activity/186426)
**Author:** [@user912390878909876](https://community.auth0.com/u/user912390878909876)\ **Replies:** 1\ **Last updated:** [May 7, 2025, 6:30pm UTC](https://community.auth0.com/t/okta-auth0-enabled-domain-spam-flooding-phishing-activity/186426 "2025-05-07T18:30:00Z")
Hi! I’ve recently noticed a smattering of account verification emails from no-reply@auth0user.net for accounts in our security catchall mailbox. It appears that a malicious third party is attempting to sign up to your … --- ## [SOC2 Compliance for Professional Plan](https://community.auth0.com/t/soc2-compliance-for-professional-plan/185519)
**Author:** [@edan](https://community.auth0.com/u/edan)\ **Replies:** 1\ **Last updated:** [April 17, 2025, 3:43pm UTC](https://community.auth0.com/t/soc2-compliance-for-professional-plan/185519 "2025-04-17T15:43:08Z")
Is auth0 professional plan soc2 compliant? I could not find a differentation of SOC2 compliance between the different plans. --- ## [OpenSAML-C++ Security Advisory - is there any Auth0 impact?](https://community.auth0.com/t/opensaml-c-security-advisory-is-there-any-auth0-impact/184207)
**Author:** [@richard.barnett](https://community.auth0.com/u/richard.barnett)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 5:01pm UTC](https://community.auth0.com/t/opensaml-c-security-advisory-is-there-any-auth0-impact/184207 "2025-03-20T17:01:13Z")
We support federation of authentication to our customers’ Idps via Auth0 using SAML & WS-Federation protocols. A customer with an OpenAthens (Shibboleth/SAML) Idp notified us of a security advisory OpenSAML-C++ / Servic… --- ## [Cookies Not Marked as Secure and Cookies Not Marked as HttpOnly](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353)
**Author:** [@robert.smith](https://community.auth0.com/u/robert.smith)\ **Replies:** 4\ **Last updated:** [March 12, 2025, 8:53pm UTC](https://community.auth0.com/t/cookies-not-marked-as-secure-and-cookies-not-marked-as-httponly/101353 "2025-03-12T20:53:56Z")
Following a Pen test on our application which is using the Auth0 SPA SDK (Angular), the following Cookies are flagging up as not being marked as secure and not being marked as HTTPOnly. Appreciate that the latter is bec… --- ## [Password Reset Link uses HTTP (again)](https://community.auth0.com/t/password-reset-link-uses-http-again/183591)
**Author:** [@mpatnode](https://community.auth0.com/u/mpatnode)\ **Replies:** 2\ **Last updated:** [March 10, 2025, 1:42pm UTC](https://community.auth0.com/t/password-reset-link-uses-http-again/183591 "2025-03-10T13:42:08Z")
I’m seeing the exact same thing described by @nikita.p here: Password reset link uses HTTP Did you, @dan.woda or anyone else figure out how to fix this? Thanks! --- ## [What characters cannot be used for passwords?](https://community.auth0.com/t/what-characters-cannot-be-used-for-passwords/182178)
**Author:** [@iamapen](https://community.auth0.com/u/iamapen)\ **Replies:** 1\ **Last updated:** [February 14, 2025, 6:40pm UTC](https://community.auth0.com/t/what-characters-cannot-be-used-for-passwords/182178 "2025-02-14T18:40:34Z")
I would like to know if there are any characters that cannot be used in the password. Can I use all of them, including multi-byte characters? --- ## [Gradle issue during compile android application - auth0 implementation](https://community.auth0.com/t/gradle-issue-during-compile-android-application-auth0-implementation/175997)
**Author:** [@kadzielas](https://community.auth0.com/u/kadzielas)\ **Replies:** 1\ **Last updated:** [January 30, 2025, 4:53pm UTC](https://community.auth0.com/t/gradle-issue-during-compile-android-application-auth0-implementation/175997 "2025-01-30T16:53:09Z")
I try to implement auth0 to my android application (flutter / dart), however when I try to do it everytime I have an error about gradle version. When I have 8.3 then error is about update to 8.- when I have 8.5 then it’s… --- ## [Does Auth0 have a 2024 SOC2 Report available?](https://community.auth0.com/t/does-auth0-have-a-2024-soc2-report-available/167825)
**Author:** [@stevep](https://community.auth0.com/u/stevep)\ **Replies:** 2\ **Last updated:** [January 8, 2025, 7:15pm UTC](https://community.auth0.com/t/does-auth0-have-a-2024-soc2-report-available/167825 "2025-01-08T19:15:45Z")
I was able to access the Okta Compliance page, where SOC and ISO reports are available. It doesn’t appear that these reports include Auth0 in their scope. --- ## [Request of SOC 2 and ISO 27001](https://community.auth0.com/t/request-of-soc-2-and-iso-27001/167613)
**Author:** [@ebru.sagir](https://community.auth0.com/u/ebru.sagir)\ **Replies:** 2\ **Last updated:** [January 6, 2025, 4:53pm UTC](https://community.auth0.com/t/request-of-soc-2-and-iso-27001/167613 "2025-01-06T16:53:09Z")
Hello, Where can l find the Auth0’s latest SOC 2 report and ISO 27001? Can anyone help me to get the latest documents please? Thanks! --- ## [Security Concerns HSTS and content Security Policy](https://community.auth0.com/t/security-concerns-hsts-and-content-security-policy/164193)
**Author:** [@matt.em](https://community.auth0.com/u/matt.em)\ **Replies:** 2\ **Last updated:** [January 3, 2025, 4:25pm UTC](https://community.auth0.com/t/security-concerns-hsts-and-content-security-policy/164193 "2025-01-03T16:25:24Z")
We recently conducted a security audit, during which two issues were flagged related to our use of Universal Login: HSTS enforcement. Content-Security-Policy directives to prevent script injection attacks. However up… --- ## [How to fix Session Fixation for Universal Login?](https://community.auth0.com/t/how-to-fix-session-fixation-for-universal-login/145502)
**Author:** [@Denis\_Maliutenko](https://community.auth0.com/u/Denis_Maliutenko)\ **Replies:** 2\ **Last updated:** [December 13, 2024, 9:31am UTC](https://community.auth0.com/t/how-to-fix-session-fixation-for-universal-login/145502 "2024-12-13T09:31:11Z")
As far as I can tell from the pentesting report, the main problem is that Auth0 doesn’t invalidate the existing session cookie after a new login. Could you please explain how I could fix Session Fixation invulnerability? … --- ## [CSP errors in Electron app](https://community.auth0.com/t/csp-errors-in-electron-app/150783)
**Author:** [@GabrielYamamoto](https://community.auth0.com/u/GabrielYamamoto)\ **Replies:** 2\ **Last updated:** [December 6, 2024, 3:33pm UTC](https://community.auth0.com/t/csp-errors-in-electron-app/150783 "2024-12-06T15:33:55Z")
Hello! Basically, I have an Electron app, which has a window that loads a login page for my app. In order to increase security, I’ve set some CSP to the app, including the windows that load the login page from Auth0. I… --- ## [Reset passwords in bulk](https://community.auth0.com/t/reset-passwords-in-bulk/96153)
**Author:** [@cmcgowan](https://community.auth0.com/u/cmcgowan)\ **Replies:** 2\ **Last updated:** [December 6, 2024, 1:06am UTC](https://community.auth0.com/t/reset-passwords-in-bulk/96153 "2024-12-06T01:06:41Z")
My company is pursuing a new security certification. We have a requirement to develop a procedure whereby passwords are changed in the event of a security incident or suspected system compromise. I know that we can rese… --- ## [Backup and Retore Process](https://community.auth0.com/t/backup-and-retore-process/152058)
**Author:** [@stef.malliaros](https://community.auth0.com/u/stef.malliaros)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 2:46pm UTC](https://community.auth0.com/t/backup-and-retore-process/152058 "2024-11-21T14:46:32Z")
Hi all. Is there any process for backing up and restoring restoring Auth0 data including tenants, and their data/users? Can this be done via any 3rd party tool or is there any backup/import functionality? As Okta/Auth0… [Next page](https://community.auth0.com/tag/security-compliance/2122.md?match_all_tags=true&page=1&tags%5B%5D=security-compliance)