Snapshot 255157
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Compliance
Compliance Documentation Access:
Our SOC 2 Type II report is available only to Enterprise and Business plan customers.
For all other customers and perspective customers, we make the following resources available upon request:
- CAIQ Lite: Our completed CAIQ provides detailed answers about our security posture aligned to the Cloud Security Alliance framework.
- Bridge Letter: Available to cover any gap between our most recent SOC 2 report period and the current date.
Security
Policies
Subprocessors
PlanetScale
Cloud database provider
Data location: United States
DataDog
Cloud infrastructure & monitoring
Data location: United States
Vercel
Webpage deployment
Data location: US
Cloudflare
Cloud infrastructure, CDN, DNS, and cloud security
Data location: United States
Google Cloud Platform (GCP)
Infrastructure
Data location: United States
Twilio
Twilio - SMS / Voice Sendgrid - email delivery
Data location: United States (primary), with global edge network processing via ...
FAQ
5
All plans, including Hobby, are covered by the Clerk Standard Terms. They incorporate our Data Processing Addendum and apply from when you register an account. You don't need to sign anything separately.
Clerk is self-certified under the EU-U.S. Data Privacy Framework. The DPA includes the Standard Contractual Clauses, the UK Addendum and the Swiss Addendum as fallbacks.
It has come up a few times that a CASA assssor flags the `__session` cookie as lacking `HttpOnly`. This is a response that should ensure `__session` is assessed correctly:
> We would ask that `__session` be assessed as a stateless session token under CASA 2.3.4 ("Stateless session tokens shall use digital signatures, encryption, and other countermeasures to protect against tampering, enveloping, replay, null cipher, and key substitution attacks"), which it satisfies, and that CASA 2.3.1 and 2.3.2 be applied to the cookie-based session token in Clerk's model, `__client`, which carries both the `Secure` and `HttpOnly` attributes. The CASA Test Guide maps 2.3.2 to OWASP ASVS 4.0.3 requirement 3.4.2, which sits under V3.4 "Cookie-based Session Management", while signed stateless tokens such as `__session` are covered by V3.5 "Token-based Session Management" (3.5.3).
For RPO we theoritically have zero data loss. Between our regular backups we stream write-ahead logging (WAL) to a storage system which allows us to replay the data from the last backup until the moment of failure. Practically the last few moments of WAL could be lost in transit during a catastrophic failure, resulting in a loss of only a few seconds of data.
When you delete an end user, Clerk removes the user record, its identifiers, and its sessions from our primary database at the time of the API call. Nothing about that user remains in a form the authentication service can act on.Residual copies can exist for a bounded period in
- Hosting and backups (cloud infrastructure provider). Clock starts at the backup snapshot. Backups age out on a rolling 15-day window, after which the user no longer exists in any restore point.
- Email and SMS delivery providers. They retain message logs containing the recipient address or phone number. Clock starts when the message was sent, not at deletion. Our SMS provider keeps records for 7 days; our email providers purge recipient and event data within 37 days."
- Logging and monitoring. Request logs may contain user and session IDs. Clock starts at log ingestion. Retained 15 to 90 days depending on the provider, then purged.
Privacy details
Privacy policy describing how Clerk collects, uses, and shares personal information and to help customers understand and exercise their privacy rights.
Privacy URL