Which authentication provider is actually European? A jurisdiction comparison

Marketing pages are not evidence. Terms of service and data processing addenda are, because a company cannot say one thing in a contract and another in a court.

So this is a comparison built only from what each vendor states in its own legal documents, last verified on 30 July 2026. Where a document was ambiguous, the ambiguity is reported. Where a page would not load, the row says so instead of being filled in.

One disclosure up front: we build Adetio, a competitor to everything on this list. That is a reason to check our sources, and every one of them is linked. It is not a reason to distrust a quotation from someone else’s contract.

The question that actually decides procurement

Almost every vendor here can store data in Europe or is willing to discuss it. Far fewer can answer the second question — which legal system can compel disclosure of that data — in a way that survives a review. That answer lives in the terms of service, usually in the governing-law clause, and it is rarely on the marketing site.

Governing law, as each vendor states it

Two findings worth pausing on

Ory is not the German company most people assume. Its terms name a US entity in Arizona under New York law; the German GmbH appears as the EU representative. This is entirely lawful and entirely unremarkable — it is simply not what the brand suggests, and it is exactly the kind of thing a procurement review is supposed to catch.

Stytch is now part of Twilio. Its legal pages redirect to Twilio’s, Twilio’s sub-processor list names “Stytch by Twilio”, and Twilio’s security overview states plainly where the infrastructure sits:

Where the data actually lives

The clearest sentence in this entire comparison is in Clerk’s DPA, and it is admirably direct about the absence of a residency commitment:

WorkOS is equally explicit in the other direction — its DPA describes transfers from the European Economic Area, Switzerland, and/or the United Kingdom to the United States, with the storage location stated as the United States of America.

What enterprise SSO costs on top

The “SSO tax” is a real, published line item at three of these vendors, and it is worth pricing before you need it — because you need it exactly when a large customer is already in the room.

One vendor charges for security itself rather than for SSO: SuperTokens lists multi-factor authentication as a paid add-on at $0.01 per MAU with a $100/month minimum. Whether that is reasonable is a judgement; that it is a line item is a fact worth knowing before you design your security baseline around it.

Where the documents contradict each other

Frontegg is worth its own note here: its terms name a US entity under California law, while its DPA says the contracting party may be either the Israeli or the US entity depending on the agreement. We are not suggesting anything improper — a company can restructure, and documents update at different speeds. But two answers to the same question means neither can be stated flatly. If this matters to your review, ask which entity signs your contract and get it in writing.

What we could not verify, and are therefore not claiming

This section exists because a comparison that only reports what suits the author is not a comparison.

• Clerk’s certifications and sub-processors. Their trust centre would not render for us. The only SOC 2 / ISO 27001 sentence readable in Clerk’s own documents describes Google Cloud and Cloudflare — the infrastructure, not Clerk. We are not going to convert that into a claim either way.
• SuperTokens’ certifications, sub-processors and hosted regions. No vendor page found for any of the three.
• Whether Auth0’s or Kinde’s EU region requires a particular plan. Both document the regions; neither documents a plan gate. Absence of a stated gate is not evidence there is none.
• Any price, a month from now. Every figure here carries the date we read it. Ory’s annual tiers and Auth0’s “from $X” anchors move; treat this table as a starting point for your own check, not as a substitute for it.

The five checks worth running yourself

1. Open the terms of service and find the governing-law clause. It is usually the second-to-last section.
2. Open the DPA and search for “anywhere”, “United States” and “transfer”. Those three words locate the answer quickly.
3. Open the sub-processor list and count the non-EU entries in the authentication path — not the marketing tools, the ones that touch identity data.
4. Check whether EU residency is available on the plan you will actually buy, not on the enterprise tier.
5. Ask which legal entity signs your contract, and get the answer in writing before the security review, not after.

Where we stand, stated honestly

Adetio is being built so that the first two of those checks have a short answer: an identity platform whose operating entity, infrastructure and data all sit under EU law, so that the transfer question does not arise rather than being managed with paperwork.

We are not going to put ourselves in the table above, because we would fail our own test. We are pre-launch, our operating entity is not yet registered, and until it is, our imprint says exactly that instead of naming a company that does not exist. A vendor that publishes a jurisdiction comparison and quietly awards itself the top row, while its own legal page is a placeholder, would be doing the thing this article is about. The trust centre states what is in place today and what is on the roadmap, separately, and it will keep doing so.