Data residency and sovereign keys
Some data cannot leave a jurisdiction, and some security teams need to hold the keys themselves. The hosted service offers an EU region and a US region, with no cross-region replication of your organization's data, and lets you keep signing keys in your own key management service.
"Where is my data?" is often a deal-breaker
Public sector, healthcare and regulated industries need to answer precisely. Most identity providers offer one answer: our cloud, in our region.
How LumoAuth solves it
Hosted in the EU or the US
Choose the region when you create your organization. Data stays in that region. Docs
Keys in your KMS or HSM
AWS KMS, CloudHSM, Azure Key Vault and Managed HSM, Google Cloud KMS, HashiCorp Vault, OpenBao, Akeyless, Thales, Fortanix, Entrust, OCI Vault, IBM Key Protect or any PKCS#11 device. Private keys never leave the provider. Docs
Secrets from your secrets manager
Read integration credentials from 1Password, Doppler, Infisical, AWS Secrets Manager, CyberArk Conjur or Vault instead of storing them. Docs
Observability you own
Logs to your SIEM, traces to your collector, metrics from the dashboard. Docs
Everything encrypted at rest
Credentials, keys and secrets are encrypted with a key you hold. The security practices and the production checklist are documented. Docs
Records for your auditors
Records of processing, impact assessments and transfer documentation come from the compliance pages. Docs
Setting it up
Create the organization in the EU or US region
The region is fixed for the life of the organization.
Connect your KMS
Generate signing keys inside it.
Point your secrets manager at the integrations
Credentials are read at use time, not stored.
Export the compliance records
Processing records and impact assessments, ready for procurement.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- Transport
- TLS 1.2+ with strict transport security
- Keys
- JWKS, PKCS#11, cloud KMS APIs
- Transfers
- SCCs module 2 for cross-border data
Which plan you need
The EU and US regions are available on every plan. Bring-your-own signing keys is a $299/month add-on on Business. The full compliance suite is on Business or the Audit & Compliance add-on.
Documentation
Questions
Can I move an organization between regions?
Who can read my signing keys?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.