Security at ClackID

Sign in with a passkey

Passkeys use your device or password manager to sign you in. ClackID stores the public key, not the private key. Your fingerprint, face or device PIN is not sent to ClackID. Passkeys are bound to the sign-in site, helping protect against phishing.

Review an app before connecting

Being signed in to ClackID does not approve a new app. Before its first connection, you review the app, its domain, your account and the requested sign-in information. You can allow the request, cancel or use another account. An approved app can sign you in again without repeating that approval. A request for additional sign-in permissions asks for approval again.

Your ClackID password is not shared with connected apps. The approval screen explains which account information the app requests. Only continue if you expected the request and recognise the app and domain.

Disconnecting and signing out

Revoking an app connection ends its ClackID approval. A later sign-in needs your approval again. It does not delete data the app already holds. App data and account deletion are managed separately by that app.

ClackID can ask apps that support its sign-out integration to end their sessions. An app may still have its own active session, so sign out in the app as well when you need to end access there.

Understand the information we hold

ClackID keeps account information, sign-in methods and app connections. Connected apps keep their own product data. Our privacy notice explains what is stored and how information can be shared.

Report a security problem

If you think you have found a security issue, contact us privately. Include the affected address and steps to reproduce the issue. Do not send passwords, recovery links or private keys.

Our reporting contact is also listed in security.txt.