Single sign-on and security your IT team can check
Everything a security review asks before a team moves its hours into Clock Clerk, on one page: which identity providers it signs in with, who sets them up, how people are added and removed, and what is recorded. Single sign-on starts on the Starter plan, at $3 per filer / month, not behind an Enterprise tier.
Thirty days of the Team plan, no card.
Single sign-on is usually sold as an upgrade
Many tools keep single sign-on for their most expensive tier, so a team of twelve that wants its people to sign in with the accounts IT already manages is pushed onto a plan priced for a thousand. The alternative is one more set of passwords, which nobody remembers to turn off when somebody leaves.
And before any of it, somebody in IT or security has to answer the same questions: which providers, who sets it up, what happens when a person leaves, what is logged, and whether another customer could ever see your data. This page answers them, with a link to the guide's steps for each.
Set up by your administrator, tested before it is switched on
Self-serve, from the Organization tab.
An administrator of an organization that signs in with passwords chooses Set up single sign-on on the Organization tab, registers Clock Clerk at the provider, enters its details and runs a test sign-in through it. Nothing changes for anybody until the test has passed and the administrator chooses Switch on. Nobody at Clock Clerk has to be asked.
- A real test first. It runs the same sign-in your people will use, and has to sign in one of your administrators on your own domain. A failed test changes nothing and says what to fix.
- Matched by email address. Before you switch on, the panel lists your administrators and their addresses, so a mismatch with the provider is caught first. Everybody else is matched the first time they sign in.
- Switching back stays open. Switch back to passwords, on the same card and on every plan, signs everybody out, and people sign in with their Clock Clerk password again.
Set up single sign-on, step by step
Starter, Team, Enterprise and the trial
The Organization tab's single sign-on panel: Okta chosen as the identity provider, the redirect URI to register, the issuer and client ID entered, and a test sign-in that passed, ready to switch on.
Sign in with the accounts your people already have
Each organization signs in one way: through its identity provider, or with an email address and a password. Clock Clerk works out which from a person's work email, so they rarely have to choose.
Okta time tracking, signed in through your own Okta.
Create an OIDC app integration in Okta with the Authorization Code grant and the redirect URI the panel shows, assign it to the people who will use Clock Clerk, then enter its issuer and client ID and test. The panel lists the steps, and an IT administrator who would rather have them by email can be sent the setup pack.
A new organization can also start its trial on Okta from the emailed sign-up link, with a test sign-in through an Okta-hosted issuer. On Enterprise, the same Okta app provisions and removes people over SCIM.
Starter, Team, Enterprise and the trial
Google Workspace timesheets, signed in with work accounts.
Create an OAuth client ID of type Web application in Google Cloud console, with the redirect URI and the consent screen's audience set to Internal, and enter its client ID and secret. There is no issuer or domain to type: the test learns your Workspace from the account Google signs in, and it has to be on one of your organization's own domains.
Once you switch on, only accounts in that Workspace can sign in, and a personal Gmail account is refused.
Register Clock Clerk in Google Cloud console
Starter, Team, Enterprise and the trial
Microsoft 365 and Entra ID sign-in, from the first day.
Start a trial with Continue with Microsoft on the sign-up page. Microsoft asks only to share your name and email, so you need not be an administrator in your directory, and colleagues from the same directory join the first time they sign in with their work accounts.
Later, one of your Microsoft Entra administrators grants admin consent, and the organization moves to full Microsoft Entra ID sign-in at once, with people found by name in your directory when they are added. A personal Microsoft account is refused.
Starter, Team, Enterprise and the trial
Any other OpenID Connect provider.
Create a web app or client at your provider that uses the authorization code flow, with the redirect URI and the standard openid, email and profile scopes, and enter its issuer, client ID and secret. Clock Clerk first checks that the issuer publishes its sign-in settings.
The provider has to say that each person's email address is verified, since that address is how they are matched. A client secret is kept encrypted and never shown again.
Starter, Team, Enterprise and the trial
Who gets in, and what is written down
SCIM provisioning from Okta or Entra ID.
On the Enterprise plan, your identity provider adds people to Clock Clerk, keeps their names and job titles up to date, and takes their access away the day they leave. An administrator creates a token on the Provisioning tab and enters it, with Clock Clerk's SCIM address, in Okta or Microsoft Entra ID.
- Deactivating somebody ends their access at once. Their Left date is set to yesterday and they are signed out everywhere, while their weeks, approvals, expenses and invoices are kept.
- Only a fingerprint of a token is kept. It is shown once, and revoking it refuses the provider from its next request.
- Nobody is added twice. Somebody already added by hand is taken over by the provider, with their role, grants and history.
Provision people from Okta or Entra ID
Enterprise
The Provisioning tab: two SCIM tokens, one for Okta and one for Microsoft Entra ID, each with the last four characters and when the provider last used it.
Two-step sign-in and passkeys, on every plan.
In an organization that signs in with passwords, anybody can add a six-digit code from an authenticator app, such as Microsoft Authenticator, Google Authenticator or 1Password, with ten single-use recovery codes for when the phone is out of reach. Once it is on, a passkey on a phone, a computer or a security key can stand in for the code.
- An administrator can require it of everybody, on the Organization tab. Anybody without it sets it up at their next sign-in, before they get in, and nobody can turn their own off.
- A lost phone is reset by another administrator, which signs that person out everywhere. Nobody can reset their own.
- Passwords are held to a rule. At least 8 characters, with a number and a special character; a password known from a data breach is refused, and five wrong ones in a row lock the account for 15 minutes.
- Every change is emailed to its owner: a new sign-in, a changed password, a passkey added, two-step sign-in turned off.
Two-step sign-in, in the guide
Every plan, Free included
The code step after the right password: a field for the six-digit code from the authenticator app, with a passkey or a recovery code offered instead.
An audit log nobody can edit.
Sign-ins, failed and refused sign-ins, changes to roles and access, to how the organization signs in and to its settings, and everything Clock Clerk support does to your organization are recorded on the Audit log tab. An administrator filters it by date, person and category, and exports it as CSV.
- Append-only, in the database. The app's own database role may add an event and read it, but never change or delete one, so not even an administrator can rewrite the record.
- Kept for a year, then deleted. Export what you need to keep for longer, or hand the file to an auditor.
- Not a paid extra. Every organization keeps one from the day it is created, and only its administrators can read it.
Every plan, Free included
The Audit log tab: a sign-in through Okta, a wrong password, a role changed and a provisioning token created, each with who did it and when.
Your organization's data, kept apart from everyone else's
Walled off, twice over
Each organization sees only its own clients, projects and hours. The app checks that on every request, and the database checks it again underneath with row-level security, so one safeguard backs up the other.
Closed unless allowed
Every screen is closed unless a person's role opens it. A manager sees only the clients and projects they were granted, and cannot even tell whether others exist.
Secrets kept sealed
Connections use HTTPS. Passwords are stored only as salted hashes, recovery codes and SCIM tokens only as hashes, and your provider's client secret and the keys of connected services are encrypted.
Backed up every night
A full backup every week and a smaller one on each of the other nights, encrypted and verified, with every change saved in between.
Take all your data with you
One download holds everything your organization has entered, ready to be loaded in again. Deleting your organization takes two deliberate steps, so it never happens by accident.
Where your data lives
Enterprise adds data residency, or running Clock Clerk on your own servers, with your own database and mail provider.
What it does not do
The answers a security review usually needs before a trial, including the ones that are no.
No SAML
Single sign-on is OpenID Connect, which Okta, Google Workspace and Microsoft Entra ID all speak. A provider that offers only SAML cannot be connected.
Not on the Free plan
Free signs in with passwords only. An organization that signs in through a provider switches back to passwords before it can move to Free; every paid plan keeps its provider.
One way in per organization
Switching on a provider stops passwords working for everybody in the organization. Client guests still sign in from their emailed link.
SCIM takes people, not groups
Provisioning is Enterprise only, from Okta or Microsoft Entra ID. Groups are not sent: the provider sends the people assigned to the app, and their roles, grants and projects are set in Clock Clerk.
No text-message codes
The second step is an authenticator app or a passkey, for organizations that sign in with passwords; one that signs in through a provider uses the provider's own. A passkey does not yet replace the password.
The audit log is not a change history
It records access and configuration, not edits to timesheets, expenses, invoices or the catalog. Weeks and invoices keep their own history.
Which plan includes it
Password sign-in, two-step sign-in, passkeys and the audit log are on every plan. Single sign-on starts on Starter, at $3 per filer / month, and comes with the trial; SCIM provisioning is on Enterprise.
| What is included | Free | Starter | Team | Enterprise |
|---|---|---|---|---|
| Price | $0 | $3 per filer / month | $6 per filer / month | Talk to us |
| Password sign-in | ● | ● | ● | ● |
| Two-step sign-in and passkeys, which an administrator can require | ● | ● | ● | ● |
| Single sign-on with Okta, Google Workspace, Microsoft 365 or any OpenID Connect provider | ○ | ● | ● | ● |
| Find people in your Microsoft 365 directory when adding them | ○ | ● | ● | ● |
| Provision and remove people from Okta or Entra ID (SCIM) | ○ | ○ | ○ | ● |
| Audit log of sign-ins and administrative actions, with export | ● | ● | ● | ● |
| Each organization's data walled off from the others | ● | ● | ● | ● |
| Whole-organization export and removal | ● | ● | ● | ● |
| Data residency | ○ | ○ | ○ | ● |
Reviewers, administrators and finance readers are free on every plan; Starter and Team charge only for the people who log hours that month. Compare plans in full
Asked while evaluating
Is single sign-on only on Enterprise?
No. Single sign-on with Okta, Google Workspace, Microsoft 365 or any OpenID Connect provider comes with Starter, at $3 per filer / month, with Team and Enterprise, and with the trial. Only the Free plan signs in with passwords alone.
Can we set it up without contacting support?
Yes. An administrator registers Clock Clerk at your provider, enters its details on the Organization tab, runs a test sign-in and switches on, and can switch back to passwords the same way. Where self-serve is not available, Clock Clerk emails your IT administrator the Okta setup pack and support makes the switch.
What happens when somebody leaves?
An administrator sets their Left date on the People tab, and their access ends. On Enterprise, deactivating them in Okta or Microsoft Entra ID does it for you over SCIM and signs them out everywhere. Either way, everything they recorded is kept.
Can we require two-step sign-in?
Yes, in an organization that signs in with passwords, on every plan: an administrator switches it on, on the Organization tab, and anybody who has not set it up does so at their next sign-in, before they get in. In an organization that signs in through a provider, the provider's own second factor applies.
Can another customer see our data?
Each organization sees only its own clients, projects and hours. The app checks that on every request, and the database checks it again underneath with row-level security, so one safeguard backs up the other.
Sign in the way your IT team already manages
Thirty days of the Team plan, no credit card required. When the trial ends, your data stays and stays readable. Start with your work email and set a password from the link we send you.