GDPR Data Handling Reference

​

1. Personal Data theauth-go Stores by Default

• Raw passwords (only Argon2id PHC strings).
• Raw session tokens, magic-link tokens, or SCIM tokens (only SHA-256 hashes).
• TOTP secrets in plaintext (only AES-256-GCM ciphertext).
• Private signing keys in the database (Ed25519 private keys live in process memory only).

​

2. Data Subject Rights — How to Satisfy Each

​

Article 15 — Right of Access

​

Article 16 — Right to Rectification

​

Article 17 — Right to Erasure (Right to Be Forgotten)

• removeUser admin handler (internal/admin/) removes the user from their organization.
• Database foreign key constraints cascade deletion of sessions, OAuth accounts, WebAuthn credentials, TOTP secrets, SAML identities, and magic links when a user row is deleted (cascade behavior enforced at the storage layer).
• audit_events rows reference actor_user_id but are not automatically deleted on user removal because audit integrity requires them. The actor_user_id field may be replaced with a tombstone value (e.g., a zeroed ULID) by an operator-written sweep without losing the event record.

1. Implement a hard-delete or anonymize endpoint that removes the user row and triggers cascades.
2. Implement an audit event anonymization sweep that replaces actor_user_id, ip, and user_agent with tombstone values for the erased subject, if full GDPR erasure of audit trails is required.
3. If backup retention exceeds the erasure window, document this in the DPN and implement a backup purge or crypto-shredding strategy.

​

Article 18 — Right to Restriction of Processing

​

Article 20 — Right to Data Portability

​

Article 21 — Right to Object

​

Article 22 — Rights Related to Automated Decision-Making

​

3. Data Retention

​

Default TTLs

​

Audit Event Retention

1. Define a retention period appropriate to your legal obligations (e.g., 12 months for security logs, 7 years for financial audit trails).
2. Implement a scheduled sweep that deletes or anonymizes audit_events rows older than the retention period.
3. If you forward audit events to an external SIEM, configure the SIEM’s own retention policy to match your DPN.

​

Sweep Patterns

-- Example: delete expired sessions older than 7 days past expiry
DELETE FROM sessions WHERE expires_at < NOW() - INTERVAL '7 days';

-- Example: delete consumed or expired magic links older than 24 hours
DELETE FROM magic_links WHERE expires_at < NOW() - INTERVAL '24 hours';

​

4. Data Residency and Cross-Border Transfers

​

Where theauth-go Stores Data

• The database server location (region/AZ).
• Whether replication crosses borders.
• Whether backup destinations cross borders.

​

Audit Sink Cross-Border Risk

​

OAuth Provider Redirects

​

Sub-processor List

​

5. Privacy-by-Design Defaults

​

Credential Storage

• Passwords: Argon2id with m=64 MiB, t=3, p=4 (crypto/password.go). Parameters are embedded in the PHC string so future work-factor increases can be applied on next login without data migration.
• Session tokens, magic-link tokens, SCIM tokens: stored as SHA-256 hashes only; raw values are returned to clients in cookies or email links and are not persisted.
• TOTP secrets: AES-256-GCM encrypted before storage (internal/totp/service.go). The encryption key must be supplied by the operator via Config.EncryptionKey or the audit config.

​

Secrets and Email Addresses in Logs

• password
• secret
• token
• code
• refresh_token
• access_token

​

Session Cookie Security

​

IP and User Agent in Sessions

1. Deploy theauth-go behind a proxy that strips or replaces the real IP before it reaches the library (the library reads the IP via httpx.ClientIP, which respects TrustedProxies configuration).
2. After session creation, run an anonymization sweep that replaces the IP column with a zeroed value.

​

Argon2id Work Factor

​

6. Operator’s GDPR Checklist

• Publish a Privacy Notice (DPN) that lists every data field in Section 1 of this document and explains the lawful basis for each.
• Define a data retention schedule for each data category in Section 3.
• Set Config.SecureCookie = true in all production environments.
• Store the TOTP encryption key (Config.EncryptionKey) in a secrets manager separate from the database.
• Identify all audit sink destinations; sign DPAs with each vendor before enabling the sink.
• Choose database region(s) consistent with your DPN’s data residency commitments.

• Build a data export endpoint that calls: UserByID, session listing, listOAuthAccounts, WebAuthn credential listing, TOTP enrollment status, SAML identity listing, QueryAuditEvents filtered by user ID.
• Build an erasure endpoint that: deletes the user row (cascades to sessions, OAuth accounts, WebAuthn credentials, TOTP secrets, magic links), anonymizes audit_events rows (replace actor_user_id, ip, user_agent with tombstone values).
• Wire both endpoints to an authenticated data-subject request intake form.

• Run scheduled sweeps to purge expired sessions, magic links, and other short-TTL rows.
• Run a scheduled sweep to delete or anonymize audit_events rows beyond your retention period.
• Review role grants on a defined cadence (at minimum quarterly) using audit_events rows for role.granted and role.revoked.
• Update your DPN if you add new audit sinks or collect additional metadata fields.
• Conduct a DPIA (Data Protection Impact Assessment) if your use of theauth-go involves high-risk processing (large scale, sensitive categories, systematic monitoring).