Compliance work splits in two. Your users need to see your terms and privacy policy when they sign in. You need a record of what Authdog did with their identity, and a way to request Authdog's own terms, privacy policy, and data processing agreement.
What your users see
Hosted sign-in can link to your legal pages. Open Redirects > Compliance and set the terms of service URL, the privacy policy URL, and any consent copy the flow should show.
Those URLs are yours. Authdog does not write your privacy policy. Point them at the pages your counsel already published, on a host you control. Set them per environment if dev should not send people to the production policy, or point every environment at the same production URLs if the policy is one document.
Allow user to delete their account (Users > Settings) exposes account deletion in the product UI. Turn it on when your policy says people can delete themselves. Deletion is not a substitute for an export or for a retention schedule you run in your own database.
What you can show an auditor
Identity events are already recorded: sign-ins, role changes, provisioning updates, MFA resets, impersonation grants. Read them in Audit logs and forward the same trail to your SIEM with events and webhooks. Verify the webhook signature before that system treats the body as evidence.
Each environment has its own user store and keys. A customer or a stage that must stay apart gets its own environment, not a filter on a shared user table. See Multi-tenancy.
Impersonation and MFA reset are privileged. If your policy requires a reason and an approval, keep that approval beside the audit row. The product records the action. It does not collect the ticket number unless you put it in the process around the click.
Authdog as a processor
Authdog's terms, privacy policy, and subprocessors are public:
Request a data processing agreement through support. The subprocessors page is the list those agreements refer to.
Related
| Read | To learn how to |
|---|---|
| Redirects | Compliance URLs on hosted pages |
| Audit logs | The identity events you can export |
| Events and webhooks | Copy that trail into your SIEM |
| Multi-tenancy | Keep environments and user stores apart |