Vendor profile
Okta: where is customer data stored and processed?
Okta stores and processes customer data in the EU cell in Germany and Ireland, using AWS, and in the UK for some Splunk analytics. Customers outside the EU/EEA are processed in the USA by default. The customer group is not stated, so it is not clear whether the service is aimed at private individuals or businesses. Customers choose their region, and Okta also has regions outside the EU/EEA that can be avoided. Login uses TeleSign in the Netherlands and the USA, notifications use SendGrid in the USA, and support uses Salesforce in the USA plus a 24x7 team in Romania with possible access to data. AI features (Google, USA) and Cyber Defense telemetry (Google, USA) are also documented.
Checked 12 October 2026 · based on the vendor's own public documents
See the map and sources
Where data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|
| Storage | Germany, Ireland, Belgium, Netherlands | –
Only for customers in other regions: USA |
|---|
| Processing | Germany, Ireland | –
Only for customers in other regions: USA |
|---|
| Login and user account | Netherlands | USA |
|---|
| Logs and telemetry | – | USA |
|---|
| Analytics and metadata | Germany, Ireland | United Kingdom, USA |
|---|
| Notifications and email | – | USA |
|---|
| Support | Romania | USA |
|---|
| AI features | – | USA |
|---|
Only outside the EU/EEA, with no European alternative stated: Notifications and email, AI features, Logs and telemetry.
Ownership and agreements
| Headquarters | USA |
|---|
| Data processing agreement | Found and read |
|---|
| Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3, FedRAMP, PCI DSS, CSA STAR, TISAX |
|---|
Sub-processors (11)
| Name | Country | Purpose |
|---|
| Amazon Web Services, Inc. | USA | Hosting and cloud infrastructure |
| Google, Inc. | USA | Cyber Defense (detect, investigate and respond to cyberthreats) |
| Splunk, Inc. | USA | Business analytics |
| Salesforce.com, Inc. | USA | Support and maintenance ticketing process |
| Twilio, Inc. | USA | SMS authenticator |
| S.C. Computer Generated Solutions Romania S.R.L. | Romania | 24x7 customer support team |
| SendGrid, Inc. | USA | Email notifications and email access request inbox |
| TeleSign Corporation | USA | SMS authenticator |
| Snowflake Computing, Inc. | USA | Data warehouse services |
| MongoDB, Inc. | USA | Managed database services |
| DataDog, Inc. | USA | Business analytics |
Sources