Resources / Integrations / Sign-in and MFA (Clerk)

Sign-in and MFA (Clerk)

How people sign in, how MFA is enforced, and how verified email domains place new hires in the right organization.

Last verified against our product: October 4, 2026

Availability

Always on

How an admin connects it

Sign-in is delegated to Clerk, our authentication provider. There is nothing for an admin to connect.

Who can set it up: Everyone signs in through it. Organization admins on the Scale plan and above set sign-in policy..

  1. Members sign in with Google, Microsoft, email and password, or Sign in with Apple on iOS.
  2. Admins (Scale plan and above) can require MFA and restrict the allowed sign-in methods for their organization from the admin console.
  3. Admins can verify an email domain with a DNS TXT record so work-account sign-ins land directly in the right organization. Free-mail domains are rejected.

Permissions requested

Permission or scopeWhat it allows
(not applicable)This is sign-in, not a data integration. We verify Clerk-issued session tokens on every request. Google, Microsoft and Apple sign-in are OAuth sign-in connections, not directory access.

We do not offer SAML single sign-on today. Google and Microsoft sign-in are OAuth, and we do not describe them as SSO.

Data we read

Read

  • Verified email address
  • Name
  • Which sign-in methods the account has connected
  • Whether the session completed MFA
  • A verified phone number, only if the member adds one as a second factor

Not read

  • Passwords (held by Clerk, never by us)
  • Authenticator secrets
  • Contacts, mail or files from the Google or Microsoft account

How the data is used

  • Identifies the person and their organization on every request.
  • Enforces the organization's MFA and allowed-method policy when an admin has set one.

Sync frequency

Verified on every request. Policy checks run only for organizations that have set a non-default policy.

Disconnecting and purging data

How: Not removable: Clerk is the sign-in provider for the service.

  • A member who deletes their account is soft-deleted immediately and permanently erased within 30 days. See Data storage and residency.

What remains: See the Subprocessors page for what Clerk holds. Ask us if your review needs Clerk-side deletion detail.

Back to all integrations

Questions or a correction? [email protected]. See also: Security, Subprocessors, Privacy, Terms.