Why CampPulse Uses Clerk for User Authentication

A camp's login screen guards children's birthdates, allergy lists, emergency contacts, staff background checks, and payment records. So we made a deliberate decision early on: we would not build our own login system.

Why not build it ourselves?

Authentication looks simple from the outside: an email, a password, a reset link. Underneath it is password storage, session handling, email verification, token rotation, and constant defense against automated attacks. Getting any one of those wrong is how accounts get taken over.

Doing it well takes a team whose whole job is authentication. That's what Clerk is. So sign-in to CampPulse 360 runs through Clerk, a dedicated identity provider, and our team spends its time on the parts of security only we can get right.

What Clerk handles

• Secure password storage and sign-in
• Session management across devices
• Email verification and account recovery
• Protection against common attacks on login forms

For parents, that means signing in feels like any modern app: no broken reset emails or confusing verification steps in the middle of registration season.

What CampPulse 360 handles

Knowing who someone is only answers half the question. The other half is what they're allowed to see, and that part is ours:

• Organization isolation.Every request is tied to one organization on the server, resolved from your subdomain rather than trusted from the browser, so one camp can never see another camp's data.
• Roles and permissions.Granular, role-based access, so a seasonal counselor's login doesn't include background checks or the bank reconciliation.
• Restricted documents. Medical forms, certifications, and background checks are stored privately and visible only to the roles you authorize.
• Encryption. Customer data, including backups and uploaded files, is encrypted at rest with AES-256 and in transit with TLS.

Why the split matters to you

Seasonal camps change who has access every single year. New counselors arrive in June and leave in August. When identity is handled by specialists and permissions are enforced in one place on our servers, adding and removing a summer's worth of staff doesn't open gaps.

And it means our engineering time goes into the things you actually notice: registration, capacity, billing, and placement, not maintaining a login system someone else already does better. The full picture is on our security page.