We ask for the minimum and store even less
Calendar data is some of the most revealing data you own. Here is exactly how CalSync handles it — and how to check that we are telling the truth.
No event content at rest
We store the mapping between a source event and its copy, plus start and end times. Titles, descriptions, attendees, attachments and meeting links are read at sync time and dropped immediately after.
OAuth only — we never see a password
Google and Microsoft accounts connect through OAuth 2.0. Tokens are stored encrypted and can be revoked from your provider at any time, instantly cutting our access.
Least-privilege scopes
We request calendar read and write and nothing else. No mail, no files, no contacts, no drive. The consent screen shows exactly this.
Encrypted in transit and at rest
TLS 1.2+ everywhere, encrypted volumes for the database, and secrets held in your platform's secret manager rather than in the codebase.
You can host the whole thing
The strongest privacy guarantee is not trusting us at all. Deploy CalSync on your own infrastructure with your own OAuth credentials and no data leaves your network.
Auditable by anyone
Every API call we make is in the open. If you want to know exactly what happens to an event, read the sync engine — it is a single, documented file.
Engineering practices
Security is mostly a question of boring discipline. These are the defaults baked into the codebase, not aspirations.
- Passwords hashed with scrypt and a per-user salt
- Session tokens are signed, HTTP-only and revoked on password change
- CSRF protection on the OAuth flow with signed, single-use state
- Server-side authorisation on every mutation — ownership is re-checked, never trusted from the client
- Structured audit log for security-relevant actions
- Dependencies kept current, with automated vulnerability alerts on the repository
Data we actually store
The complete list. Everything else lives with your calendar provider.
Account
Email, name, timezone, hashed password
Calendar connections
Provider, account id, OAuth tokens, calendar names
Sync configuration
Which calendars, direction, privacy mode, filters
Sync bookkeeping
Source event id → copy id, start and end time, a content fingerprint
Booking links
Title, description, duration and rules you set
Bookings
Invitee name, email, chosen time and any note they wrote
Note the absence of event titles, descriptions, attendees and attachments.
Hosted deployment
The managed instance runs inside the EU, behind a WAF, with encrypted volumes and automated backups. Data subject requests are handled within 30 days, and a DPA is available on request.
Read the DPA →Reporting a vulnerability
Please report security issues privately through a GitHub security advisory rather than a public issue. We aim to acknowledge within two working days and to ship a fix before any disclosure.
Open an advisory →Verify it yourself
Claims are cheap. The sync engine, the provider clients and every database write are in the repository — read them, run them, or fork them.
Browse the source →A note on certifications
CalSync is a young open-source project and does not currently hold SOC 2 or ISO 27001 certification — we would rather say so plainly than imply otherwise. If your organisation requires a certified processor, self-hosting keeps the data inside your existing, already-certified environment.