Infrastructure
Global infrastructure.
Local data residency.
Multi-region deployment across 4 regions. Edge locations for low-latency auth. Your tenant data stays in the region you choose.
Available on Free and above. See pricing
Regional data planes
Four regions. Data stays local.
Data residency is an architecture choice, not a checkbox. AuthFI runs an independent data plane in each region — its own database, its own object storage, its own keys. You choose your data region when you create a tenant, and that decision pins every user record, secret and audit row to one of these planes for the life of the tenant. Auth traffic routes to the nearest edge; tenant data never leaves the selected region.
- Sovereignty by partition: an EU tenant's rows physically live in
europe-west1— there is no global table they could spill into. - The problem it removes: the GDPR / Schrems-II argument about transatlantic transfers never starts, because the data was never in transit across the border.
- The payoff: you point an auditor at one region instead of reasoning about a replicated global fleet.
# a login, end to end
User → Cloudflare Edge (300+ PoPs)
↓ anycast: nearest PoP wins
CF Worker → reads tenant slug from subdomain
acme.authfi.io → tenant: acme
D1 lookup → region: us-central1
↓
Cloud Run → us-central1
auth-service · admin-service · connect-service
↓
Response → JWT issued → back to user
latency ≈ 80ms (edge cache hit ≈ 15ms)Every auth request routes through Cloudflare, resolves the tenant, and hits the correct regional backend.
Edge routing
Login lands at the nearest PoP — ~80ms cold, ~15ms cached.
Latency on a login page is conversion, not vanity. AuthFI fronts every region with BGP anycast: one IP advertised from 300+ Cloudflare points of presence, so the user's packets are pulled to the closest edge by the routing fabric itself — no geo-DNS guesswork. The edge worker reads the tenant slug from the subdomain, looks up the home region, and proxies to the right data plane. TLS terminates at the PoP and JWKS is cached there, so signature checks and handshakes stay near the user.
- Mechanism: anycast + edge worker means routing is a packet-level decision, not a backend round-trip.
- The payoff: a global user base sees a local login — the edge cache hit returns in ~15ms, a cold path in ~80ms.
- Routing the request near the user and keeping the data regional are independent — fast edge, pinned plane.
Nothing crosses the border
Residency is enforced at the routing layer.
The edge can sit anywhere; the data cannot. The tenant→region mapping is resolved before any backend is touched, so a request for an EU tenant can only ever reach the EU plane. That separation is what turns "we promise" into "the architecture makes it impossible."
Tenant → region resolution
A D1 lookup at the edge maps the tenant slug to its home region before the request is proxied. The backend a login reaches is decided by data residency, not by which PoP answered.
One plane per tenant
Each region is a self-contained data plane — database, storage and keys. There is no cross-region replica of tenant rows, so there is no path by which one region's data appears in another.
Keys stay regional
Encryption keys live with the data they protect. Data at rest is sealed with AES-256 and only ever decrypted inside its own region — the ciphertext is meaningless outside it.
Edge + cloud architecture
A thin global edge over deep regional compute.
The edge is stateless and everywhere; the compute is stateful and regional. Cloudflare handles the things that must be close to the user — DNS, TLS, DDoS, routing — while the auth services run as autoscaling containers inside each region, scaling to zero when idle and back up on demand.
Cloudflare edge
300+ PoPs worldwide. DNS, TLS termination, DDoS protection, tenant routing. JWKS caching at the edge.
GCP Cloud Run
Autoscaling containers per region. Zero to N instances. Pay per request. No cold start for auth.
Homelab edge (India)
Bare-metal K8s cluster for Asia-South1. 2 nodes, WireGuard mesh, eBPF agent. Low-latency for Indian tenants.
Serverless containers mean you pay per request, not per idle VM — and there's no cold start on the auth path, so the first login of the day is as fast as the millionth.
Security posture
Encrypted end to end. Built for the security review.
Every byte is encrypted twice over: TLS 1.3 on the wire and AES-256 at rest. Residency satisfies GDPR by construction, audit logging underpins HIPAA, and a zero-telemetry stance means we don't ship your auth events to anyone — no data sharing, no third-party analytics riding along on your sign-ins.
- The problem it removes: the security questionnaire that stalls an enterprise deal — most rows are already a "yes" with evidence.
- GDPR by data residency, not by addendum: the data plane is the control.
- Zero telemetry: your identity traffic is yours; nothing is exfiltrated for "product improvement."
Uptime commitment
An availability target that scales with the plan.
Auth is on the critical path of every other product you ship — if it's down, everything is. The SLA rises with the tier, topping out at 99.99% on Enterprise: roughly 52 minutes of allowed downtime a year, backed by per-region failover and the autoscaling, no-cold-start compute above.
Get started
Ready to get started?
Free for 5,000 monthly active users. No credit card required.