This page provides information about how Identity-Aware Proxy (IAP) meets data residency requirements. Data residency describes where your data is stored and processed. When you data is stored and not being accessed or transferred, it is considered "at rest". When your data is being processed by IAP to provide authentication and authorization, it is considered "in use". IAP only handles data in use.
IAP only supports region locations and does not adhere to multi-region or other geographical boundaries for compliance.
Requirements for Data Residency
Identity-Aware Proxy is enabled on a load balancer, and will support at most the location capabilities of the chosen load balancer. Due to the nature of authentication flows and redirects, IAP cannot offer data residency support for global load balancers. For all other load balancers, IAP will process your data only in the location(s) of the load balancer.
When Is Data In Use?
The following data is considered in use by IAP:
- Request headers, for example `"foo": "bar"
- URL query parameters, such as "?param=data"
How Data Residency Is Enforced
IAP enforces data residency for in use data in all locations, all the time.
Request Headers
IAP uses request headers, such as authorization and proxy-authorization, to process requests properly. IAP does not send, route, receive, or redirect any incoming headers to a different location.
URL Query Parameters
To ensure your data is not lost during authenticating redirects, IAP sets cookies on the browser to temporarily store query parameters until authentication is complete. The cookie is paginated to comply with varying browser cookie size specifications.
__Secure_GCP_IAP_QUERY_PARAMS_page_<n>
Limitations
The number and size limitations of cookies is largely dependent on the specific browser. However, IAP enforces a limit of 16kb for query param size after necessary encoding, or about 12kb plaintext. If this limit is exceeded the query params will be lost in redirects during authentication with no way to retrieve them from IAP.