Does your organization use Clerk? One sensor, and Openwake watches it on its own: the documents re-read daily, every moved clause told.Start free
Trains on customer data
Training posture: unknown · the documents do not say
silence is not a no
Not stated in the documents we could read. An absence here is an unknown, not a no.
Opt-out mechanism
To learn more about how to opt-out of Google Analytics’ use of your information, please click here.
“To learn more about how to opt-out of Google Analytics’ use of your information, please click here.”
AI features
present
“Inkeep – We use a service provided by Inkeep, Inc. to provide AI-powered self-service support services.”
Model providers named
none named
Not stated in the documents we could read. An absence here is an unknown, not a no.
Retention
Clerk shall (a) if requested to do so by Customer by the date of termination or expiry of the Agreement, return a copy of all Customer Personal Data or provide self-service functionality allowing Cust
“Clerk shall (a) if requested to do so by Customer by the date of termination or expiry of the Agreement, return a copy of all Customer Personal Data or provide self-service functionality allowing Customer to do the same; and (b) within 90 days of the termination or expiry of the Agreement, delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data processed by Clerk or any Sub-processors.”
Hosting regions
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Subprocessor notice
10 days
“Customer may reasonably object to Clerk’s use of a new Sub-processor (including when exercising its right to object under clause 9(a) of the SCCs) by providing Clerk with written notice of the objection within ten (10) days after Clerk has provided notice to Customer of such proposed change (an “Objection”).”
Downstream
Who's behind Clerk, as listed in its own subprocessor documents. 2 subprocessors.
Model providers
- none listed
Hyperscalers
- Google Cloudunstated
Other subprocessors
- Cloudflareunstated
Reviewer notes
Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. no training clause matched
Documents read
- privacy policy https://clerk.com/legal/privacyHTTP 200 · 2026-10-13
- dpa https://clerk.com/legal/dpaHTTP 200 · 2026-10-13
Document changes
- low 2026-10-13 · dpa +10 / −10 lines
show diff
+ Please note that the Clerk DPA has been modified to reflect Clerk’s certification under the EU-U.S. Data Privacy Framework. The Data Privacy Framework (including the Swiss-U.S. Privacy Framework and the UK Extension to the DPF) has been formally approved by the United States Department of Commerce and the European Commission and the European Commission has issued adopted an adequacy decision in favor of the DPF. This means that personal data from the European Union (EU), Switzerland and the United Kingdom (UK) can be safely transferred from those locations by Clerk customers to Clerk in the United States (U.S.). The DPF replaces the Privacy Shield and, like Privacy Shield, personal data can be transferred to companies in the U.S. who are certified under the DPF without the need to enter into additional data transfer mechanisms such as the Standard Contractual Clauses or Binding Corporate Rules.+ “LGPD” means Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais);+ (iii) With respect to Account Information, Clerk is an independent controller, not a joint controller with Customer. Clerk will process Account Information as a controller to manage the relationship with Customer; carry out Clerk’s core business operations; to comply with legal or regulatory obligations applicable to processing and retention of Account Information; and as otherwise permitted under Applicable Data Protection Laws, this DPA and the Agreement. Clerk may also process Account Information as a controller to provide, optimize, and maintain the Services, to the extent permitted by Applicable Data Protection Laws. Any processing by Clerk as a controller shall be in accordance with Clerk’s Privacy Policy.+ 5.1 Customer grants Clerk general authorization to engage Sub-processors, subject to clause 5.2, from an agreed list, as well as Clerk’s current Sub-processors listed at https://clerk.com/legal/subprocessors as of the Effective Date.+ Clerk is self-certified under the DPF and complies with the data privacy principles thereunder. To the extent and for as long as the DPF is acknowledged as a valid transfer mechanism in the relevant country/region, Personal Data originating from the EEA, UK, or Switzerland, or otherwise being subject to the GDPR shall be transferred on the basis of the DPF. See Clerk’s DPF Policy here.+ Customer and Customer End User’s contact person’s position and contact details as well as (if appointed) the data protection officer’s and (if relevant) the representative’s contact details will be notified to Clerk prior to the processing of personal data via email to or an available form provided by Clerk in Customer’s account in the Services.+ The data importer’s contact person can be contacted at . Also, the data importer’s EU representative can be contacted at+ https://verasafe.+ The competent supervisory authority is the supervisory authority in Ireland, namely the Data Protection Commission (https://www.dataprotection.ie/).+ 7. Clerk hosts Personal Data primarily in Google Cloud data centers and Cloudflare that have been certified as ISO 27001 and/or SOC2 compliant. More details on Google Cloud controls can be found here. More details on Cloudfare’s controls can be found here.− Please note that the Clerk DPA has been modified to reflect Clerk’s certification under the EU-U.S. Data Privacy Framework. The Data Privacy Framework (including the Swiss-U.S. Privacy Framework and the UK Extension to the DPF) has been formally approved by the United States Department of Commerce and the European Commission and the European Commission has issued adopted an adequacy decision in favor of the DPF. This means that personal data from the European Union (EU), Switzerland and the United Kingdom (UK) can be safely transferred from those locations by Clerk customers to Clerk in the United States (U.S.). The DPF replaces the Privacy Shield and, like Privacy Shield, personal data can be transferred to companies in the U.S. who are certified under the DPF without the need to enter into additional data transfer mechanisms such as the Standard Contractual Clauses or Binding Corporate Rules.− “LGPD” means Brazilian General Data Protection Law (Lei Gerai de Proteção de Dados Pessoais);− (iii) With respect to Account Information, Clerk is an independent controller, not a joint controller with Customer. Clerk will process Account Information as a controller to manage the relationship with Customer; carry out Clerk’s core business operations; to comply with legal or regulatory obligations applicable to processing and retention of Account Information; and as otherwise permitted under Applicable Data Protection Laws, this DPA and the Agreement. Clerk may also process Account Information as a controller to provide, optimize, and maintain the Services, to the extent permitted by Applicable Data Protection Laws. Any processing by Clerk as a controller shall be in accordance with Clerk’s Privacy Policy.− 5.1 Customer grants Clerk general authorization to engage Sub-processors, subject to clause 5.2, from an agreed list, as well as Clerk’s current Sub-processors listed at https://clerk.com/legal/subprocessors as of the Effective Date.− Clerk is self-certified under the DPF and complies with the data privacy principles thereunder. To the extent and for as long as the DPF is acknowledged as a valid transfer mechanism in the relevant country/region, Personal Data originating from the EEA, UK, or Switzerland, or otherwise being subject to the GDPR shall be transferred on the basis of the DPF. See Clerk’s DPF Policy here.− Customer and Customer End User’s contact person’s position and contact details as well as (if appointed) the data protection officer’s and (if relevant) the representative’s contact details will be notified to Clerk prior to the processing of personal data via email to privacy@clerk.dev or an available form provided by Clerk in Customer’s account in the Services.− The data importer’s contact person can be contacted at privacy@clerk.dev. Also, the data importer’s EU representative can be contacted at− https://verasafe.− The competent supervisory authority is the supervisory authority in Ireland, namely the Data Protection Commission (https://www.dataprotection.ie/).− 7. Clerk hosts Personal Data primarily in Google Cloud data centers and Cloudflare that have been certified as ISO 27001 and/or SOC2 compliant. More details on Google Cloud controls can be found here. More details on Cloudfare’s controls can be found here. - low 2026-10-13 · privacy policy +10 / −11 lines
show diff
+ * Job Applications. We may post job openings and opportunities on our Services. If you reply to one of these postings by submitting your application, resume, and/or cover letter to us, we will collect and use your information to assess your qualifications. If you respond to a job opening, your information will be shared with our talent management provider, Ashby, Inc., and is subject to its privacy policy.+ * Analytics. We may use Technologies and other third-party tools to process analytics information on our Services, such as Google Analytics. For more information, please visit Google Analytics’ Privacy Policy. To learn more about how to opt-out of Google Analytics’ use of your information, please click here.+ PostHog – We use a service provided by PostHog, Inc. to provide us with analytics data regarding user interaction with our Site and Services. PostHog’s tracking and use of information collected about you as the Customer is governed by the PostHog privacy policy available at https://posthog.com/privacy.+ We also use PostHog’s session-replay technologies to record your interactions with the Services to help us diagnose problems and improve our Services. These technologies allow us to watch a DVR-like visual video playback of user sessions on our Services and capture user activities such as clicks, mouse movements, scrolls, and keystrokes/key touches when you use our Services, and may collect personal information from and about you. You can opt-out of session recording by PostHog at https://posthog.com/session-replay.+ Koala – We use a service provided by Koala to provide us with analytics. See their privacy policy here https://getkoala.com/legal/privacy.+ Inkeep – We use a service provided by Inkeep, Inc. to provide AI-powered self-service support services. See their privacy policy here https://inkeep.com/policies/privacy.+ Plain – We use a service provided by Not Just Tickets Ltd (d/b/a Plain) to provide services related to support tickets. See their privacy policy here https://www.plain.com/legal/privacy-policy.+ Algolia – We use a service provided by Algolia, Inc. to power search on our documentation and to collect search analytics (such as queries and clicks on results) that help us improve search relevance. See their privacy policy here https://www.algolia.com/policies/privacy.+ * Cookies and Interest-Based Advertising. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our Services may not work properly. Please note that cookie-based opt-outs are not effective on mobile applications. However, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. You may also access our cookie management dashboard at by clicking "Cookie Manager" in the footer for cookie management options.+ * The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.− * Job Applications. We may post job openings and opportunities on our Services. If you reply to one of these postings by submitting your application, resume, and/or cover letter to us, we will collect and use your information to assess your qualifications. If you respond to a job opening, your information will be shared with our talent management provider, Ashby, Inc., and is subject to its privacy policy.− * Analytics. We may use Technologies and other third-party tools to process analytics information on our Services, such as Google Analytics. For more information, please visit Google Analytics’ Privacy Policy. To learn more about how to opt-out of Google Analytics’ use of your information, please click here.− PostHog – We use a service provided by PostHog, Inc. to provide us with analytics data regarding user interaction with our Site and Services. PostHog’s tracking and use of information collected about you as the Customer is governed by the PostHog privacy policy available at https://posthog.com/privacy.− We also use PostHog’s session-replay technologies to record your interactions with the Services to help us diagnose problems and improve our Services. These technologies allow us to watch a DVR-like visual video playback of user sessions on our Services and capture user activities such as clicks, mouse movements, scrolls, and keystrokes/key touches when you use our Services, and may collect personal information from and about you. You can opt-out of session recording by PostHog at https://posthog.com/session-replay.− Koala – We use a service provided by Koala to provide us with analytics. See their privacy policy here https://getkoala.com/legal/privacy.− Inkeep – We use a service provided by Inkeep, Inc. to provide AI-powered self-service support services. See their privacy policy here https://inkeep.com/policies/privacy.− Plain – We use a service provided by Not Just Tickets Ltd (d/b/a Plain) to provide services related to support tickets. See their privacy policy here https://www.plain.com/legal/privacy-policy.− Algolia – We use a service provided by Algolia, Inc. to power search on our documentation and to collect search analytics (such as queries and clicks on results) that help us improve search relevance. See their privacy policy here https://www.algolia.com/policies/privacy.− * Cookies and Interest-Based Advertising. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our Services may not work properly. Please note that cookie-based opt-outs are not effective on mobile applications. However, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. You may also access our cookie management dashboard at by clicking "Cookie Manager" in the footer for cookie management options.− * The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.− privacy@clerk.dev - low 2026-10-08 · dpa +1 / −1 lines
show diff
+ Clerk will promptly notify Customer in writing in the event of any breach of this DPA, Applicable Data Protection Laws or any instruction by Customer in connection with the processing of Customer Personal Data under this DPA. Without limiting the generality of the foregoing, Clerk shall notify Customer in writing without undue delay after becoming aware of any Security Incident, and reasonably cooperate in the investigation of any such Security Incident and any obligation of Customer under Applicable Data Protection Laws to make any notifications to individuals, supervisory authorities, governmental or other regulatory authority, or the public in respect of such Security Incident. Clerk shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and shall, without undue delay, send Customer timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Clerk’s notification of or response to a Security Incident under this clause 8 will not be construed as an acknowledgment by Clerk of any fault or liability with respect to the Security Incident.− Clerk will promptly notify Customer in writing in the event of any breach of this DPA, Applicable Data Protection Laws or any instruction by Customer in connection with the processing of Customer Personal Data under this DPA. Without limiting the generality of the foregoing, Clerk shall notify Customer in writing without undue delay after becoming aware of any Security Incident, and reasonably cooperate in the investigation of any such Security Incident and any obligation of Customer under Applicable Data Protection Laws to make any notifications to individuals, supervisory authorities, governmental or other regulatory authority, or the public in respect of such Security Incident. Clerk shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and shall, without undue delay, send Customer timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Clerk’s notification of or response to a Security Incident under this clause 8 will not be construed as an acknowledgement by Clerk of any fault or liability with respect to the Security Incident.
Fact changes
- medium 2026-10-13 · 1 field change(s), +0/−0 subprocessors, +0 model providers
Corrections
No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.
Facts are as stated in Clerk's public documents on the date read. This is a record, not legal advice. Work for Clerk? Claim this profile · Something wrong? Request a correction.