Legal

Last updated: November 28, 2025

# Security & Compliance

CalendarJet is built with security at its core. We protect your data using industry-leading practices and enterprise-grade infrastructure.

## Security Overview

Calendar Jet takes the security of your data seriously. Our application is designed with multiple layers of protection to ensure your calendar data, personal information, and integration credentials remain secure.

- TLS 1.2+ encryption for all data in transit  
- AES-256 encryption for data at rest  
- OAuth 2.0 for third-party integrations  
- Row-Level Security (RLS) database policies  
- Regular security audits and updates  
- SOC 2 Type II certified infrastructure

## Infrastructure & Dependency Management

Calendar Jet is built on enterprise-grade, SOC 2 Type II certified infrastructure providers to ensure the highest levels of security and reliability.

- **SupabaseDatabase**  
  SOC 2 Type II, ISO 27001  
  PostgreSQL database with AES-256 encryption at rest, automated backups, point-in-time recovery, and Row-Level Security (RLS) policies.

- **ClerkAuthentication**  
  SOC 2 Type II  
  Enterprise-grade authentication with secure session management, JWT tokens, and multi-factor authentication support.

- **StripePayments**  
  PCI-DSS Level 1, SOC 2  
  All payment data is handled directly by Stripe. Calendar Jet never stores credit card numbers or sensitive payment information.

## Data Protection & Retention Policy

### Data Encryption

- **In Transit:** All data encrypted using TLS 1.2 or higher  
- **At Rest:** AES-256 encryption in Supabase database  
- **OAuth Tokens:** Encrypted with Row-Level Security policies

### Data Retention

- **Active Accounts:** While active + 30 days  
- **Booking History:** 12 months  
- **OAuth Tokens:** Until revoked  
- **Backups:** 7 days

### Data Minimization

We only collect and store data that is necessary for providing our scheduling services. We do not sell, share, or use your data for advertising purposes. Calendar data is never used for AI/ML model training.

## Vulnerability Management Policy

### Dependency Management

- **Automated Scanning**  
  npm audit & GitHub Dependabot  
- **Critical Patches**  
  Applied within 24-48 hours  
- **Regular Updates**  
  Weekly dependency updates

### Code Security

- All code changes reviewed before deployment  
- Input validation and sanitization on all user inputs  
- Protection against OWASP Top 10 (XSS, SQL Injection, CSRF)  
- Content Security Policy (CSP) headers implemented

### Security Monitoring

- Real-time monitoring  
- Application logging  
- Automated alerts  
- Supabase dashboards  
- Clerk dashboards

## Incident Management & Response

### Incident Classification

#### Critical (P1)

Data breach, service outage, security exploit  
Response: < 1 hour

#### High (P2)

Partial degradation, vulnerability found  
Response: < 4 hours

#### Medium (P3)

Minor issues, non-critical bugs  
Response: < 24 hours

### Response Process

1. Detection  
   Monitoring, user report, or automated alert  
2. Assessment  
   Evaluate scope and impact  
3. Containment  
   Isolate affected systems  
4. Resolution  
   Fix issue and restore operations  
5. Notification  
   Inform users within 72 hours  
6. Post-Mortem  
   Document and prevent recurrence

## Access Control & Authentication

- **Secure Auth**  
  Clerk authentication with email verification  
- **OAuth 2.0**  
  Google Calendar & Zoom (no passwords stored)  
- **Session Tokens**  
  Automatic expiration for security  
- **Row-Level Security**  
  Users can only access their own data  
- **API Protection**  
  Authentication middleware on all endpoints  
- **MFA Support**  
  Multi-factor authentication available

## Compliance & Certifications

### Infrastructure Certifications

- Supabase: SOC 2 Type II, ISO 27001  
- Clerk: SOC 2 Type II  
- Stripe: PCI-DSS Level 1, SOC 2

### Data Protection Compliance

- GDPR compliant data handling  
- Google API Limited Use compliance  
- Zoom OAuth security requirements  
- Data processing in EU regions available

## Contact Security Team

If you discover a security vulnerability or have questions about our security practices, please contact us. We take all reports seriously and will respond within 24 hours.

- **Security Issues:**  
  [security@calendarjet.com](mailto:security@calendarjet.com)  
- **General Inquiries:**  
  [hello@calendarjet.com](mailto:hello@calendarjet.com)

[Privacy Policy](/content/privacy/index.html) • [Terms of Service](/content/terms-of-service/index.html) • [Data Deletion](/content/data-deletion/index.html) • [Back to Home](/content/site-root.html)