Security and data handling
This page is for the person who approves calendar apps in your organization. It lists every permission Caltsu asks for, everything it stores, where it is stored and how to take access back.
- Company
- DataDux Oy, Helsinki, Finland
- Database
- PostgreSQL on Neon, Frankfurt (eu-central-1)
- Application
- Runs on Vercel, served over HTTPS. Function region set in the Vercel project.
- Security contact
- support@caltsu.com
- Not available yet
- SOC 2 or ISO 27001 reports, SSO or SAML, a signed DPA template. Email support@caltsu.com if your review requires one.
OAuth permissions, and why each one is needed
You sign in on Google's or Microsoft's own consent screen. Caltsu never sees a password. It does not ask for mail, contacts, files or directory access.
| Scope | Why Caltsu needs it |
|---|---|
| openid, email, profile | Identifies the Google account you connect, so the dashboard can show which account each calendar belongs to. |
| calendar.readonly | Finds the primary calendar and reads its events. Caltsu uses the start, end and status, and keeps a change fingerprint of the title to notice edits. |
| calendar.events | Creates, moves and deletes the Busy blocks Caltsu places in that calendar. |
| Scope | Why Caltsu needs it |
|---|---|
| openid, email, profile | Identifies the Microsoft account you connect. |
| Calendars.ReadWrite | Reads events from the default calendar and creates, moves and deletes Busy blocks. Caltsu uses the start, end and status, keeps the subject in a change fingerprint, and checks the body preview to recognise its own blocks. Delegated permission, limited to the signed-in user's own calendars. |
| offline_access | Issues a refresh token so sync keeps running when you are not signed in to Caltsu. |
In Microsoft 365, your tenant's consent settings decide whether users can approve Caltsu themselves or an administrator must approve it first. In Google Workspace, an administrator can allow or block the app under API controls in the Admin console.
What Caltsu writes to other calendars
For every event in a synced calendar, each other calendar in the group receives one block. This is the complete list of fields on that block.
- Title
- Busy, or the text you chose during setup
- Start and end
- Same as the source event, including all-day events
- Show as
- Busy
- Reminders
- Off
- Note
- "Blocked time from" followed by the source calendar's name. A Google primary calendar is usually named after its email address, so the note reads "Blocked time from name@company.com". Rename the calendar in Google Calendar settings before you connect the account to avoid this. A Microsoft default calendar is usually named Calendar.
- Visibility
- Not set by Caltsu. In Google the block takes the calendar's default visibility, in Microsoft the default normal sensitivity. Anyone who can see event details in that calendar sees the title and the note.
- Color
- The color set for the source calendar, or your default, as the closest Google color or Outlook category
- Hidden metadata
- A marker that identifies the event as a Caltsu block, plus internal IDs linking it to its source event
Never copied from the source event
- Event titleNot copied
- AttendeesNot copied
- LocationNot copied
- Description and notesNot copied
- Meeting linkNot copied
- AttachmentsNot copied
What Caltsu stores
Everything below lives in one PostgreSQL database in Frankfurt. Event titles are kept only inside the change fingerprint. Event descriptions, attendees, locations and meeting links are not stored.
| Data | Why |
|---|---|
| Your name and email | Sign-in and account emails. |
| Connected account email and status | Shows which Google or Microsoft accounts are connected and whether they work. |
| OAuth access and refresh tokens | Stored twice. The sync engine's copy is encrypted with AES-256-GCM. The sign-in store keeps its own copy without application-level encryption. |
| Calendar ID, name and sync setting | Knows which calendars take part in sync. |
| Sync records | Links each source event ID to the block ID Caltsu created, so edits update the right block. |
| Change fingerprint | A base64 copy of the event's title, start, end and status. Encoded, not encrypted or hashed. Compared on each sync to detect edits. Never written to another calendar. |
| Sync log | Actions and errors, used when you ask support to look at a problem. No automatic cleanup: kept until you ask support to erase them, including after account deletion. |
| Webhook subscription IDs | Lets Google and Microsoft notify Caltsu when a calendar changes. |
| Session IP address and browser | Keeps you signed in. Each session expires, and is removed when you log out or delete the account. |
| Stripe customer ID and plan status | Billing. Card details are held by Stripe, not Caltsu. |
Encryption and hosting
The sync engine encrypts its copy of each access and refresh token with AES-256-GCM before writing it to the database. Each value gets its own random IV and authentication tag. The key is held in the application environment, not in the database.
The sign-in library keeps a second copy of the same tokens in its own table. That copy does not have this application-level encryption. It is deleted when you disconnect the account.
The database runs on Neon in AWS eu-central-1, Frankfurt. The application runs on Vercel. The function region is set in the Vercel project, not in this code. Caltsu is operated by DataDux Oy, a Finnish company.
Subprocessors
- VercelHosts and runs the web application
- NeonPostgreSQL database, Frankfurt region
- InngestRuns background sync and cleanup jobs
- StripeSubscription billing and payment
- ResendTransactional email, such as account notices
- PostHogProduct analytics on the website and app. The default host is in the US.
Google and Microsoft process calendar data as the providers of the calendars you connect.
Taking access back
Disconnect one account in Caltsu
The stored tokens for that account are deleted right away. A background job then stops its change notifications and removes the blocks Caltsu created in its calendar.
Revoke at the provider
Remove Caltsu under third-party connections in your Google account, or under app permissions for a personal Microsoft account. A Microsoft 365 administrator can remove it for the whole tenant under Enterprise applications in Microsoft Entra. Once revoked, Caltsu can no longer read or write that calendar.
Delete the Caltsu account
In Settings. Caltsu removes its blocks from your calendars, stops change notifications, cancels the subscription, signs out every session and replaces your name and email with anonymous values. This is not a full erasure. Connected accounts and their tokens, calendar settings and sync records stay in the database, and the sync log keeps your original email in a deletion entry. To remove connected accounts and their tokens first, disconnect each one before deleting. To have everything erased, email support@caltsu.com.
Questions from a security review
Send them to support@caltsu.com. The privacy policy covers the legal side.