Learn Authelia - Privacy & Anonymization

#Introduction

Episode 22 closed the transport layer with HTTPS and security headers. But security and privacy are two different things: security ensures data doesn't fall into the wrong hands, while privacy ensures unnecessary data isn't collected in the first place. Episode 23 covers Authelia's privacy side: how to stay informed about what's happening without hoarding data.

Authelia's approach since birth has been privacy-first: no telemetry, no usage reports to third-party servers, and all data stays on your instance. In this episode we look at how to keep that promise alive as your configuration grows.

#Authelia Without Telemetry, Local Data

Authelia doesn't send telemetry or usage statistics to external services. User data — passwords, MFA, consent, sessions — is stored in the local storage backend you control: files, SQLite, PostgreSQL, or MySQL. No third-party API touches this data, except services you configure yourself, like Redis for sessions or SMTP for notifications.

The question to always ask when adding any component: does this component store data outside our control? If so, how important is it? That way of thinking keeps the architecture privacy-friendly.

#Logging: Data That's Really Needed

Logs are an activity trail, but they're also a collection of personal data — IP addresses, usernames, activity timestamps. The more recorded, the larger the privacy surface to manage. Authelia gives control via log_level and log_format:

log:
  level: info
  format: json
  file_path: /config/authelia.log

The log level determines how detailed:

A rule of thumb: use info and above in production. The debug or trace levels record far more user detail — enable them only while investigating an issue, then revert.

#Minimal Data Retention

Data stored indefinitely is an unwanted obligation. Some retention settings to configure:

• Sessions — bounded by expiration and inactivity, already discussed in episode 7; sessions end and session data is cleaned up.
• OIDC tokens — refresh and access tokens have limited lifetimes via the lifespans settings; expired tokens are no longer valid.
• Consent — consent records are stored as long as they aren't revoked; users can remove them via the portal.
• Logs — limit log age and size. In Docker, set rotation in docker-compose.yml:

services:
  authelia:
    image: authelia/authelia:4.39
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

With this, logs are limited to ten megabytes per file and only three files are kept. Old data disappears on its own without manual cleanup.

#Minimalist Cookies

Privacy is also reflected in cookies. Authelia uses a single session cookie named authelia_session — no cross-site tracking cookies. The cookie is marked HttpOnly and Secure (covered in episode 22), and SameSite defaults to lax, preventing cross-site sending. The session cookie is removed when the user logs out, and no additional cookies are left on the device.

#IP Address Anonymization

Authelia logs the source IP address for regulation and audit purposes. Authelia doesn't have a built-in IP anonymization feature, so the decision is in your hands:

• At the proxy level, decide whether IPs are forwarded to Authelia or replaced with an anonymized value.
• At the log aggregation level, hash or mask the last octet of IP addresses before long-term storage.
• For very strict deployments, consider hiding IPs from application-level logs and relying on proxy logs.

The trade-off is real: without IPs, ip-based regulation and forensic audit lose their source. Balance security needs against privacy commitments.

#Deleting User Data

If a user leaves the system or exercises their data rights, Authelia provides commands for identification and deletion. First inspect the stored accounts with authelia storage user identify, then run:

authelia storage user identify
authelia storage user delete arman
authelia storage user totp delete arman

First delete the user's MFA data, then their account. After the account is removed from users_database.yml and storage records are cleaned up, the user can no longer log in and their data no longer remains in Authelia. Also make sure to terminate their active sessions in Redis so a still-live session doesn't leave residual data.

#Audit Without Hoarding

Privacy doesn't mean no audit. Audit records remain important — to see who logged in, when, and from where. The key is audit in moderation: record the events that are actually needed, keep them for a reasonable duration, and delete automatically. Authelia makes this easy because all logs are structured, event-based entries that can be filtered before being sent to an external log system.

#Closing

In this episode you understood:

• Authelia without telemetry; data is stored locally and under your control.
• log_level and log_format control log detail and structure.
• Minimal retention: sessions end, tokens expire, logs rotate.
• Minimalist cookies: a single secure session cookie removed on logout.
• User data can be identified and deleted via the CLI.

With privacy preserved, your Authelia foundation is complete: authentication, authorization, transport security, and care for data. But a single instance is still fragile. In episode 24, we build a High Availability Setup — duplicating Authelia, Redis Sentinel, and a shared database so the service stays alive. See you there!