Abstract: Methods, storage systems and computer program products implement embodiments of the present invention that detecting a security token received by a cloud-based service from a cloud-based computer, the security token issued by a token service and authorizing access to the cloud-based service. A first geographic region in which the security token is deployed is identified, and a second geographic region in which the cloud-based computer is deployed is also identified. Finally, upon detecting that the second geographic region does not match the first geographic region, an alert can be generated for the security token.