Security Policy

At Clockify, we secure and protect the information of millions of users worldwide with transparency and 24/7 support.

Bug Bounty Program
Bug Bounty Program
We're under a 24/7 security audit performed by the people in the reward program.
Report vulnerability →
ISO/IEC 27001:2013 certified
ISO/IEC 27001:2013
The most rigorous global security standard for Information Security Management Systems.
See certification →
SOC 2 Compliance
SOC 2 Type II
Annual audit certification for Service Organization Controls Trust Services Principles.
Request report →
GDPR compliance
Rules for the protection of personal data and privacy inside the European Union.
Privacy policy →

Data Safety

All Clockify data is hosted on Amazon Web Services (AWS). We take advantage of all the security and privacy features AWS provides, plus our team takes additional pro-active measures to maintain a secure infrastructure and make sure there are always multiple backups for infrastructure disaster recovery purposes (though we can't offer backup in case of user made errors on a per account basis). For more specific details regarding how AWS keeps data secure, please refer to

We don't publicize exactly what features, services, and data center we use for security reasons, but we can give you a brief overview of how we make sure your data is safe. We recommend you also review our Terms of Use and Privacy Policy.

Data Center Security

AWS maintains an impressive list of reports, certifications, and independent assessments to ensure complete and ongoing state-of-the-art data center security. They have many years of experience in designing, constructing, and operating large-scale data centers, which makes them the industry standard when it comes to security.

The exact physical location of the data center that stores Clockify's data is private. Only those within Amazon who have a legitimate business know the actual location of Amazon's data centers. Additionally, data centers are secured with a variety of physical controls to prevent unauthorized access.

Data Hosting

The main data location for Global Data Region is Frankfurt, Germany. But, we have caching mechanisms that enable fast data access in other parts of the world for performance purposes. This means data is NOT exclusively stored in Germany but across multiple servers across the world so everyone can quickly access Clockify no matter where they are.

If you wish to store your data exclusively in some region - EU (Germany), UK, USA or Australia - be sure to choose the right data region when creating an account.

Infrastructure Security

All Clockify servers are run from own virtual private clouds (VPCs), with rules that prevent unauthorized requests from entering our network.

Clockify infrastructure is hosted in a fully redundant, secure VPN environment, with access restricted to operations support staff only. This way we can leverage complete firewall protection, private IP addresses, and other security features.

The whole system on which Clockify runs is behind a firewall and only the necessary ports are open to the outside network. Also, only authorized personnel, using SSH keys, have access to the system. Access is enabled only over a VPN connection.

Application Security

All data to and from Clockify is sent securely over HTTPS. The initial connection is established over 2048 bit TLS, and the rest of the communication happens over 256 bit SSL. This is the standard technology for keeping an internet connection secure and prevents anyone from reading and modifying any information. Any data transferred between a user and Clockify is impossible to read or modify.

We use the same level of encryption as do banks and financial institutions. All data is encrypted using SHA256withRSA algorithms, which scramble data in transit, preventing hackers from reading it.

Your company-specific data inside Clockify is kept separate through a logical separation at the data tier, based on application-level access permissions and roles you set up in your workspaces.

All Clockify data is encrypted at rest. At-rest encryption means that all our databases, files, and other storages of content have their files encrypted when they're backed up or otherwise sitting idle. If someone was somehow able to get ahold of a backup of the database, it'd be useless, because they wouldn't have the key to decrypt it.

Operational Security

Our system is constantly monitored. We get reports in real time so we can instantly react in case a potential issue arises. All actions taken on production consoles are logged.

We constantly monitor security, performance, and availability 24/7/365. We run automated security testing on an ongoing basis. We prioritize, resolve, and deploy discovered security issues quickly after discovery. Because we follow Continuous Delivery and Deployment best practices, we can update Clockify on a daily basis and fix things as soon as we see them.

We never access your data in Clockify, unless required for support reasons and with your explicit permission.

Secure Personnel Inc. takes the security of its data and that of its clients and customers seriously and ensures that only vetted personnel are given access to their resources.

Secure Development

Secure Testing Inc. deploys third party penetration testing and vulnerability scanning of all production and Internet facing systems on a regular basis.

Cloud Security Inc. Cloud provides maximum security with complete customer isolation in a modern, multi-tenant cloud architecture. Inc. Cloud leverages the native physical and network security features of the cloud service, and relies on the providers to maintain the infrastructure, services, and physical access policies and procedures.

Compliance Inc. is committed to providing secure products and services to safely and easily manage billions of digital identities across the globe. Our external certifications provide independent assurance of Inc.'s dedication to protecting our customers by regularly assessing and validating the protections and effective security practices Inc. has in place.

SOC 2 Type II Inc. successfully completed the AICPA Service Organization Control (SOC) 2 Type II audit. The audit confirms that Inc.'s information security practices, policies, procedures, and operations meet the SOC 2 standards for security.

An unqualified opinion on a SOC 2 Type II audit report demonstrates to the Inc.'s current and future customers that they manage their data with the highest standard of security and compliance.

Our SOC 2 Type II report is available upon request. Please request the latest report through this form.