Secure scheduling software: Your calendar, kept private.
Caletus is secure scheduling software with a SOC 2 Type II report, GDPR compliance, HIPAA-ready safeguards and required multi-factor sign-in. Here's what it collects, how it's protected and who can see it, in plain language.
- TLS 1.3 · AES-256Your data is encrypted in transit and at rest
- Free/busy onlyCaletus sees when you're busy, not what your events say
- Audio discardedDeleted right after transcription, never used to train public AI models
- 30 daysUntil all your data is deleted after you close your account
This page covers the Caletus web app, REST and webhook APIs, edge calendar cache and AI Notetaker 2.0 engine. Owned by Caletus's Security Operations and Cloud Infrastructure Engineering teams.
What Caletus collects, and what happens to it.
- 01What we collectYour work email, full name, avatar URL, organization name and billing identifiers.
- 02Why we need itTo sign you in, verify your session, run your workspace and send your bills.
- 03How it's keptEncrypted at rest with AES-256. Passwords are hashed and salted with Argon2id, and OAuth 2.0 tokens are kept isolated.
- 01What we collectFree/busy flags for each time slot, plus conflict markers, across up to 6 connected calendars.
- 02Why we need itTo show open times as soon as your calendar changes, prevent double booking and lock a slot while someone books it.
- 03How it's keptHeld briefly in memory only (under 150ms). Caletus does not copy or store past event details, attendee lists or private notes.
- 01What we collectNames and emails of the people booking, the meeting location (for example, a Google Meet link) and answers to your booking questions.
- 02Why we need itTo send meeting invites, place the hold on both calendars through two-way sync, and run your CRM workflows.
- 03How it's keptStored in encrypted database tables with row-level security, and kept according to your workspace's retention settings.
- 01What we collectMeeting audio while the call is live, the written transcript and the action items pulled from it.
- 02Why we need itTo write the meeting summary automatically and fill in your CRM fields.
- 03How it's keptProcessed briefly at the edge. Audio is deleted as soon as it's transcribed. No customer audio or text is ever used to train public AI foundation models.
Sign-in and admin controls.
Decide who can get in: required multi-factor sign-in, roles for each person, and a record of who changed what.
Required multi-factor authentication (MFA)
Require everyone in your workspace to use a second sign-in step: a hardware security key (WebAuthn/FIDO2) or an authenticator app (TOTP).Admins can make MFA mandatory across the whole organization, with a grace period they can monitor.- 02
Roles and permissions (RBAC)
Give each person the access they need with role-based access control: Organization Owner, Workspace Admin, Team Host or Read-Only Auditor.Only the right people can change round robin weighting, team pools or billing settings. - 03
Audit logs
A timestamped record of sign-in attempts, permission changes and calendar connections. The logs are immutable, so nobody can edit them.Export them as CSV, or stream them straight into your SIEM, such as Splunk or Datadog.
Secure scheduling, from the booking page down to the database.
- Cloudflare Global Anycast Edge
Global edge network and DDoS protection
Booking pages load from Cloudflare's global edge network, close to whoever is booking. It handles DDoS attacks automatically (L3/L4/L7 mitigation), filters traffic with Web Application Firewall (WAF) rules, and answers availability checks in under 150ms worldwide. - TLS 1.3 & AES-256
Encrypted in transit and at rest
Everything sent to or from Caletus, from the app or the API, is encrypted with TLS 1.3 and Perfect Forward Secrecy. Databases, backups and token vaults are encrypted with AES-256, using AWS KMS envelope encryption. - 99.99% uptime SLA on Enterprise
High availability and multi-region failover
If one location has a problem, a standby copy is ready to take over. Primary databases use active-standby replication across separate availability zones in AWS US-East and EU-Central, with continuous automated snapshots.
Export your data, or have it deleted.
Disconnect a calendar
When you disconnect Google Calendar or Outlook (Microsoft 365), Caletus revokes its OAuth access and refresh tokens with the provider right away and deletes them from its database.Export your data
Workspace admins can download the full booking history, booking question answers and meeting stats at any time, as JSON or CSV.Close your account
Caletus keeps your data for 30 days after you close your account. After that, all customer database records are permanently deleted.Ask to be forgotten
Anyone can ask Caletus to erase their data (the GDPR right to be forgotten) by emailing privacy@caletus.com. Requests are handled within 5 business days.
SOC 2 Type II, GDPR and HIPAA-ready.
- Active and verified
SOC 2 Type II
An outside auditor checks Caletus's controls against the Security, Availability and Confidentiality Trust Services Criteria, with no exceptions.Independent audit every yearEnterprise customers, and companies evaluating Caletus, can get the full report under a mutual NDA.Request the SOC 2 report - Fully compliant
GDPR and UK GDPR
Caletus follows EU and UK data protection law, with Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) in place.Reviewed continuouslyAny paid workspace can sign the DPA inside the app.Ask about the DPA - BAA available
HIPAA-ready scheduling
Physical, administrative and technical safeguards, designed around the HIPAA Security Rule, protect patient health information (PHI) in healthcare scheduling.Risk assessment every yearCaletus signs Business Associate Agreements (BAAs) on the Enterprise plan.Ask about a BAA
Found a security issue?
Email the Caletus security team directly. Critical reports are acknowledged within 24 hours, and a PGP key is available on request.Caletus security FAQs.
What security and procurement teams usually ask before they sign off.
Talk it through with our teamNo. Caletus never sells, rents or trades customer data. To prevent scheduling conflicts, it only reads whether your calendar is busy or free, not what your events say. Every type of data Caletus handles is listed under 'What we handle' on this page, and in full in the Privacy Policy.
Yes. An independent auditor reviews Caletus for SOC 2 Type II every year, covering physical security, access controls, infrastructure encryption and disaster recovery. Enterprise teams evaluating Caletus can request the full auditor's report under NDA by emailing security@caletus.com. GDPR and HIPAA-ready details are covered on this page too.
Yes. Caletus's security operations team fills out enterprise vendor assessments, including SIG, CAIQ and custom VSA questionnaires. Send yours through the Contact page and pick the "Security, privacy and legal" topic, or email security@caletus.com. The team replies within 1 business day, so your review doesn't stall.
On the Legal page, which has Caletus's counsel-approved Privacy Policy, Terms & Conditions and Cookie Policy. Each one shows its version and date. This Security page explains in plain words how your data is protected. The Legal page has the exact, legally binding wording your legal team will want to check.
Try it while legal reads the paperwork.
Start free and test with your own calendar. Ask us for the SOC 2 report, DPA, or questionnaire answers whenever you're ready.
- No credit card required
- Two-way calendar sync
- Set up in under 2 minutes