How we protect your organization's data

• ✓
  Clerk is SOC 2 Type 2 and HIPAA certified, and complies with GDPR and CCPA.
• ✓
  Multi-factor authentication is available and can be required for every member of an organization — no one reaches protected content until they've enrolled.
• ✓
  Passwords, when used, are never visible to us — Clerk owns the entire credential lifecycle, including breached-password detection and bot-signup protection.
• ✓
  Session management includes active device monitoring and the ability to revoke a session immediately.
• ✓
  Clerk undergoes regular third-party security audits and penetration testing of its own platform.
• ✓
  Every organization's people, roles, and membership are managed and enforced by Clerk directly — we never store a password ourselves.

• ✓
  Every request passes through automatic DDoS protection at the network, transport, and application layers before our code ever runs.
• ✓
  A Web Application Firewall with managed rulesets covering the OWASP Top 10 sits in front of the application.
• ✓
  All traffic is encrypted in transit via TLS — there is no unencrypted path to or from the application.
• ✓
  The application runs in an isolated execution sandbox per request, not a shared long-running server process, which limits what one request could ever affect.
• ✓
  Application data is stored in Cloudflare's managed database and object storage products, encrypted at rest, with no server for us to patch or misconfigure.
• ✓
  Cloudflare operates a global network with continuous hardening against emerging attack classes, including active research into side-channel isolation risks affecting the broader serverless industry.

• ✓
  Source code lives in a private repository — it is not publicly readable.
• ✓
  Dependency vulnerability scanning is enabled, with automatic pull requests to patch known-vulnerable packages.
• ✓
  Every change is committed with full history and author attribution — nothing is deployed anonymously or edited in place on a live server.
• ✓
  Deployments run through an automated pipeline that must pass a type-checking gate before anything reaches production — a class of bug (mismatched data shapes) is caught before deploy, not after.
• ✓
  Application secrets (API keys, signing secrets) are stored as encrypted platform secrets, never committed to source control.

• ✓
  Every request is authenticated by a Clerk-verified session token — there are no passwords or session identifiers of our own invention.
• ✓
  Every request resolves which organization it belongs to from the verified session, never from a value the client supplies — one organization's data cannot be requested by naming another organization's ID.
• ✓
  Access to paid and premium features is enforced on the server for every request, not just hidden in the interface — a request that shouldn't succeed is rejected outright, not merely hidden from view.
• ✓
  All incoming data is validated against a strict schema before it's used — malformed or unexpected input is rejected with a clear error rather than processed.
• ✓
  Incoming webhooks (billing events) are cryptographically signature-verified before being trusted — an unsigned or forged request is rejected.
• ✓
  Platform-administrator access is re-verified against Clerk's live records on every request, not cached or trusted from a token claim.

• ✓
  Card numbers and billing details are entered directly into a Stripe-hosted form and never pass through our servers in any form.
• ✓
  Stripe is a PCI-DSS Level 1 certified payment processor — the highest level of certification in the industry.

We'd rather tell you what's not done yet than let you assume it is. None of the items below are hidden from our own team — they're on our roadmap, not swept under a rug.