Security

Calendo runs on the Cloudflare platform: the application runs on Cloudflare Workers, the database is Cloudflare D1, and files (backups and attachments to booking forms) are stored in Cloudflare R2 in private buckets with no public access.

Calendo has no servers or database machines of its own that would need separate updates; Cloudflare maintains the platform's operating systems and network.

All traffic between the browser and Calendo is encrypted (HTTPS, TLS). Browsers are told to always use an encrypted connection (HSTS). Pages also send protective headers: the admin pages cannot be embedded in other websites (clickjacking protection), the browser does not guess file types (nosniff), and the full address is not passed on to other websites (Referrer-Policy). Only the public booking page may be embedded on the business's own website.

You sign in to Calendo with a Google or Microsoft account, and in the iOS app also with Sign in with Apple. Calendo does not store passwords. After sign-in, the browser gets a signed session cookie (HttpOnly, Secure, SameSite=Lax) that is valid for 7 days. You can remove a sign-in method linked to your account in the settings, after which it can no longer be used to access the account.

When you connect a Google or Microsoft calendar, Calendo receives access tokens (OAuth). They are stored in the database encrypted with AES-GCM using a 256-bit key, which is kept as a Cloudflare secret separate from the database. Calendo asks only for the permissions bookings need: free and busy times, calendar events and sending booking emails from your own address. Other events in your selected calendars are shown only to you in the booking calendar and are not stored. The content of your emails is not read.

You can revoke access at any time in the settings or in your Google or Microsoft account. If the connection breaks, Calendo notices it in a scheduled check, shows a warning in the dashboard and sends you one email.

• Every admin API request checks the signed-in account, and an account sees only its own data.
• Team members do not sign in to Calendo. They connect their calendar with a personal link, which can be renewed, after which the old link stops working.
• Links customers use to manage a booking are random, unguessable identifiers. Customers' "My bookings" and data request links are signed and expire (after 24 hours and 2 hours).
• Booking form attachments can be downloaded only by the account owner while signed in, through a signed link valid for 5 minutes. Attachments are always downloaded as files and never opened in the browser as a page.
• Only specifically designated administrator accounts can access the service's own admin pages.
• The Pro plan's activity log shows who did what and when (bookings, settings, meeting types, team and sign-ins). Events are kept for 365 days.

Public forms (booking, attachment upload, requests for sign-in links) are rate limited. For this, only a one-way hash calculated from the network address and browser is stored, and it is deleted after 48 hours. Only images (JPG, PNG, WebP, GIF) and PDF files of up to 10 MB are accepted as attachments, and the type is checked from the file's content. Attachments are not scanned for viruses, so open only files you are expecting.

The database is backed up once a day to private R2 storage, and copies are kept for 30 days. Once a week the latest backup is opened and its rows are checked automatically (a restore test); any anomaly sends an alert to the operators. Backups contain the same data as the database, including the encrypted calendar tokens in encrypted form. For server errors, only the time, the URL path and a short error message without personal data are logged, and the log entries are deleted after 30 days.

• Bookings, their answers and attachments are deleted automatically after the retention period set by the business (by default 365 days after the meeting, adjustable from 30 to 3650 days).
• An attachment that was never linked to a booking (the form was not submitted) is deleted after one day.
• Waiting list sign-ups are deleted once the day has passed.
• Abuse prevention hashes are deleted after 48 hours and error log entries after 30 days.
• The activity log is kept for 365 days.
• AI booker conversations are deleted 24 hours after the last message.
• Customers can download or delete their own booking data themselves at calendo.fi/omat-tiedot.

• Cloudflare, Inc.: hosting, database, file storage and visitor statistics (without cookies).
• Google LLC and Microsoft: sign-in, calendar events, video meeting links and booking emails through the account the business has connected. Google also for Reserve with Google bookings, if the business has turned the feature on.
• Stripe Payments Europe, Ltd.: payments for Calendo subscriptions, the business's own booking payments and monthly memberships (card details are handled only by Stripe).
• Twilio Inc.: text message and WhatsApp reminders, if the business uses them. WhatsApp messages are also delivered by Meta Platforms Ireland Ltd.
• Zoom Communications, Inc.: Zoom meetings, if the business connects Zoom.
• Anthropic, PBC: the optional AI summary on the Pro plan, only when the user asks for it, the AI booker's replies, if the business turns it on, and answers from the Ask for help assistant (questions are not stored).
• Apple Inc.: Sign in with Apple, App Store subscriptions and iOS app notifications.
• 650 Industries, Inc. (Expo): delivery of mobile app notifications without customer names, via Apple (iPhone) and Google Firebase Cloud Messaging (Android).

More on how data is processed: privacy policy and data processing agreement.

Calendo has no security certification of its own (such as ISO 27001 or SOC 2), and the service has not had an external security audit or penetration test. The platform provider's own certifications are described on Cloudflare's website; they cover Cloudflare's service, not the Calendo application.

If you find a vulnerability or suspect a security problem, please tell us at support@calendo.fi. Describe what you observed as precisely as you can. Do not test using other users' accounts or data.