Learn how Ory solves data homing and data locality in a multi-region IAM network.
How Apple broke "Sign in with Apple" with an unannounced and silent redirect
Ory Network now allows you to choose where your user's personal data - also known as personally identifiable information or PII - is stored geographically.
But wait, I thought Ory Network was a global network?
This choice affects your user's personal data only. That are email addresses,
phone numbers, devices, IPs and so on.
Ory distinguishes between personal data and operational data. Operational data is everything not personal data. That includes for example permissions, access tokens, sessions. Operational data is replicated globally across all Ory Network datacenter locations to give you the lowest possible latency and highest availability. Personal data stays in the region you choose.
Data privacy regulations like GDPR require you to safeguard your user's personal data. A common provision, known as data homing, data domiciling, and a slew of other terms, says that data must be kept inside the geographical boundaries of where that regulation is in effect.
Ory Network makes it easy to comply with data regulations, without sacrificing performance, availability, or ease of use.
You’ve probably seen options to choose a deployment region for software in other products before. Typically, this choice affects everything: data storage location and where the software components are actually run. Different regional deployments in those products are distinct from one another. You might have a project based in the US and one in the EU. They are unaware of each other, and you have to manage them separately. You might not even be able to aggregate data between those deployments or query and manipulate your data across them in a uniform way.
Ory Network is different.
It is a single, global network, uniformly accessible from around the globe. No
regional endpoints, no regional deployments, no disjunct data, no divergence
between your projects in separate regions.
With Ory Network your user's personal data is still stored in the region you choose, and only there. You can focus on running your business, while we take care of compliance, no engineering effort is required.
The best news is that you don't have to do anything. Personal data storage is enabled for all projects, on any plan. Simply choose your storage location during project creation, and your users' personal data will be stored only there.
You can still query your data from anywhere in the world, of course. Ory Network will internally route your request to the location where it can best be served. If your request does not involve any personal data, we can serve it with the lowest possible latency from the geographical location closest to you. When you query or modify personal data, we will transparently route your request to the storage location where that data is held.
For existing projects, you can check the project settings in the Ory Console to find out where personal data is stored.
Ory Network enterprise customers have the option of choosing the "Global" personal data storage location. In this configuration, each of your individual users will still have their personal data stored in one region. That region is chosen based on the user's location on the first signup. Users from the EU will have their personal data stored in the EU, users from the US in the US, and so on.
This option is ideal for companies that have a global user base, yet want to comply with data privacy regulations. It allows you to store personal data in the region where your user is located, while still providing a uniform, global service.
Similarly, the "US Continental" storage location has your user's personal data stored geographically closest to them within the contiguous United States.
The Ory team is working on a Compliance API, which will allow you to move personal data between storage locations. Let's say one of your European users was visiting the US while signing up for your product. They would have their personal data stored in the US. Still, they are an EU citizen and will want to have their data stored there as well. You'll be able to perform a data move through the API and the Ory Console for them. No downtime or data loss, and no lost login session. Just shuffle the data over and be compliant.
We're excited to roll out this feature and more like it in the future.
Reach out to us with questions or feedback.
Do we have your use case covered?
What would you like to see next?
We're looking forward to hearing from you!
