Security White Paper
This document provides a technical summary of Calendly’s
approach to security and compliance.

Calendly’s Service Security
Security Controls
Compliance
Additional Resources

Calendly’s Service Security
About Calendly
Calendly is the market-leading scheduling solution. Our platform allows for secure andefficient scheduling, eliminating the hassle of back-and-forth communication so you canget back to work.
Security starts with the people Calendly employs. We implement security controls for
employees and contractors before, during and after their tenure at Calendly.
Before Hiring
Before hiring, all employees and contractors undergo background checks in accordancewith applicable laws. The background check reviews areas such as criminal and financial
background indicators and includes a credit check for senior finance positions.
All new hire references, both requested and unrequested, are carefully scrutinized.
Employees and contractors are made aware of their responsibilities, plus operational andsecurity policies, as well as repercussions for failure to adhere to said responsibilities
and policies.

1Upon Hiring
Upon hiring, all employees and contractors go through an onboarding processthat includes:•

Signing a Proprietary Information & Inventions Agreement (PIIA). The PIIA states theconfidentiality obligations as a Calendly employee or contractor.

•

Completing the employment onboard and security awareness training and security
policy/procedure acknowledgement. This training helps new hires understand theirsecurity responsibilities as a Calendly employee or contractor.

While Working for Calendly
Calendly uses endpoint encryption, antivirus protection, and endpoint management tools
to ensure security of company-owned devices. We use Multi-Factor Authentication (MFA) for
all SaaS products where it’s available.
Security awareness training is an ongoing educational process throughout employment with
Calendly that helps employees and contractors understand their responsibilities over dataprotection. Training includes assorted cybersecurity topics, including learning about security
vulnerabilities and prevention of exploiting vulnerabilities in the application.
In addition, Calendly’s security team performs progressive social engineering tests andawareness campaigns to build security into the culture of the company.
When Departing Calendly•

All Calendly employees and contractors are remindedof their confidentiality obligations upon leaving.

•

Their user accounts, passwords, hardware, andbadges are revoked within 24 hours.

The Calendly Cloud Service
The Calendly cloud service is a software as a service (SaaS) solution built and maintained
by Calendly. As a true cloud-native service, it is fully designed and assembled for the cloudand provides some key benefits:•

Subscription-based and cost-efficient•

Drastically reduces setup, operational complexity, and total cost of ownership•

Globally available, 100% multi-tenant, redundant with multiple availability zones•

Regularly updated with security updates and new features•

Minimum downtime as we apply regular updates on the fly where possible (tracked here)2

Calendly InfrastructureWith the proliferation of cloud computing and cloud services, Calendly has adopted a
cutting-edge approach of fully adopting cloud-native services. As part of this adoption,
we’ve partnered with Google on utilizing infrastructure as a service (IaaS) as part of theGoogle Cloud Platform’s (GCP) offering.
Google Cloud Platform is a suite of cloud compute services offered, hosted, and managed
by Google, which runs on the same infrastructure that is used internally for all end-user
products (Search, Gmail, YouTube). GCP utilizes continuous monitoring, distributed data
centers with layered security, continuous availability, secure by design infrastructure, as wellas encryption at rest and in transit. By leveraging GCP, we are able to provide our customers
with reliability, security, scalability, and elasticity that meets the demands ofmodern businesses.

Calendly’s Approach to Security
Calendly’s software as a service is built, managed, monitored, and updated with security as
a top priority. As part of our commitment to security, quality, consistency, and compliance,
Calendly has adopted the shared security responsibility model.

Shared Responsibility Model
The shared responsibility model is a framework used by all major cloud providers(Google, Amazon, Microsoft, etc.). It serves a specific purpose of identifying the distinct
responsibilities of the cloud provider and the customer. As we build our applications andinfrastructure platform on top of Google Cloud, we utilize this responsibility matrix to govern
our internal infrastructure controls.

Security Controls
As a SaaS service provider, Calendly is responsible for providing and/or overseeing throughits partners the security of the Calendly cloud application service.
The security controls in place are classified into the following general categories:•

Data classification and accountability•

Client and end-point protection•

Identity and access management•

Application-level controls•

Network controls•

Host infrastructure•

Physical security

3

Infrastructure & Physical Security
As part of Calendly’s expertise and requirements for underlying services, infrastructure,
security, reliability, and scalability, our technical team selected a cloud provider that fit ourneeds. Calendly partners with a cloud platform provider, Google Cloud Platform, to manage
the cloud services, hardware, and networking resources underpinning our software services.
Calendly personnel do not directly access servers or networking components. Instead, werely on Google’s management services and software interfaces in a shared responsibility
model. With this approach, Calendly takes advantage of all the capabilities provided by
Google plus additional security controls in tandem.
Calendly creates a virtual private cloud (VPC) within Google Cloud to add another layerof virtual separation of services. We install and fine-tune a firewall configuration, create
appropriate organizational structure within GCP, and utilize strict access and security
controls to cloud services. This includes Identity & Access Management (IAM) roles andpermissions, groups based on responsibility and function.

Security of Data Centers
Google designs and builds its own data centers, which incorporate multiple layers ofphysical security protections. Access to these data centers is limited to only a very small
fraction of Google employees. Multiple physical security layers are used to protect thedata center floors. In addition, technologies like biometric identification, metal detection,
cameras, vehicle barriers, and laser-based intrusion detection systems are being used.
Google additionally hosts some servers in third-party data centers, where they ensurethat there are Google-controlled physical security measures on top of the security
layers provided by the data center operator. For example, in such sites they may operate
independent biometric identification systems, cameras, and metal detectors.

Data Security
Calendly understands that your data is a valuable asset and we treat it as such. We
encrypt all data, in transit and at rest. Calendly requires HTTPS for all services using TLS (v1.2
or higher using non-deprecated cipher suites) with HSTS enabled and SHA-256 with 2048
bit RSA encryption.
We store passwords using an industry standard modern hashing algorithm with therecommended work factor to create a one-way, salted hash that can’t be decrypted. Loginpages and logins using Calendly APIs have brute force protection. Run time systems aresupported with high availability data stores that are configured with hot failover replicas.
Calendly has stringent security policies for database data storage, cloud storage, andbackups. We utilize Google Cloud Persistent Disk (Block Storage) and Google Cloud
Storage (Object Storage) for persisting data. Backups are performed daily and data ispersisted on multiple clouds (AWS and GCP). Within cloud providers, we restrict access atthe bucket level and only permit certain authenticated users read/write access based on a
combination of bucket, roles, policies, and IAM grants.

4

Least Privilege Access
Calendly requires that all access to its infrastructure, application, and data be controlled
based on business and operational requirements. Role based access to systems and data
is requested, approved, tracked, and monitored. Right to access is restricted based on
employee role and audited for continued need, at a minimum, quarterly. System and datainteractions are captured in system logs and retained for one year.

Network Security
Calendly leverages Google Cloud in tandem with best-of-breed security solutions toprovide protection against traditional network security threads. They include some of
the following:
Virtual Private Networks
We utilize Google’s virtual private network capabilities to create and connect the necessary
private networking infrastructure and isolate traffic between any of the underlying
components from the public. This includes peering with third-party service providers.
Distributed Denial of Service (DDoS) attacks
Successfully handling DDoS attacks is a shared responsibility between Google Cloud andCalendly. It involves detection systems, barriers, and scalability in order to absorb attacks.
As part of the shared responsibility model, we’ve provided extra layers of protection by
actively reducing the attack surface for our deployments, isolating all internal traffic fromthe external world, utilizing proxy-based load balancing, and autoscaling.
Our added DDoS mitigation infrastructure provides protection against attacks at
Layer 3, 4, and 7.
Man in the Middle (MITM) attacks
For every machine or container, Calendly uses automation services to issue secure TLS
certificates via Internet Security Research Group’s (ISRG) Let’s Encrypt. We leverage secure
APIs to access the certificates before using an instance.
IP Spoofing
Google provides anti-spoofing protection of IP addresses in virtual private networks bydefault. Furthermore, isolation between virtual networks comes by default. Anti-spoofing
checks are performed against traffic, ensuring that traffic exiting virtual machines (VMs)
uses VM IP addresses and pod IP addresses as source addresses. The checks verify that VMs
don’t send traffic with arbitrary source IP addresses.
Port scanning & Packet sniffing
Calendly utilizes the existing built-in protection of GCP along with firewalls and VPCs
to protect against those types of attacks. All network communication is encrypted andnetwork ports explicitly opened when necessary. In addition, we utilize security tools formonitoring and prevention of attacks

5Secure Personnel Practices
Software Development Life Cycle (SDLC)
Calendly’s Software Development Life Cycle is designed to identify and reduce security risks
from feature inception through delivery and maintenance of our software to the production
environment. As an idea becomes a feature concept, we perform research and user testing
to gather requirements that undergo architecture evaluation of system and application
design. Architecture works closely with engineering in the design phase to create an
implementation plan that enumerates data flows as well as potential security andprivacy concerns.
Upon passing security review, the implementation plan moves into the development
phase. Changes to our codebase are required to include unit tests, integration tests,
and end-to-end tests to confirm functionality. One or more code reviews are required toaddress standards adherence. Changes are also run against our continuous integration
server and include static code analysis as well as vulnerability scanning. This enables us toautomatically detect any issues in development.
The change set is then evaluated by our quality assurance team to thoroughly test areasof expected impact, regression test, and further evaluate the user experience. After all
checks are completed successfully, deployments are secured with image scanning, logging,
and anomaly detection. Our 24/7 response procedures backed with a suite of monitoring,
logging, detection, and alerting tools provides protection against real-time risks andenforces patching of newly identified vulnerabilities.
Development Practices
Our rigorous application development processes adhere to Open Web Application Security
Project (OWASP) and with the CLASP concepts. Continuous training for developers helps toensure appropriate awareness, focus and protection for various types of potential attacks,
such as:•Malformed input•

SQL injection•

Cross-Site Scripting (XSS)•

Cross-Site Request Forgery (CSRF)•

Broken Authentication and Session Management•

Insecure Direct Object References•

Security Misconfiguration•

Sensitive Data Exposure•

Other Open Web Application Security ProjectTop 10 threats (OWASP’s Top 10)

6

Auditing of SDLC Processes
On a regular basis, no less than annually, evidence of the above testing and change
management is gathered and analyzed to ensure that these testing flows and change
management procedures are being performed as required.

Supply Chain
Prior to engaging new vendors, Calendly compares multiple competing solutions andperforms a thorough security and compliance assessment of them. Once we havereviewed the competing solutions, accompanying documentation, and security/
compliance questionnaires that we send them, we utilize a review process to assess security,
compliance, and total cost of ownership. Every vendor that handles customer Personal
Identifiable Information (PII) is required to have a Data Protection Agreement (DPA) in placethat contractually obligates them to handle PII according to privacy law requirements. Our
sub-processor list on our website is also updated prior to onboarding vendors that handle
customer PII.
We maintain system configuration and consistency through standardized, up-to-date
images, configuration management software, and automated continuous delivery
processes. Within our application, each new library requires explicit request and evaluation
prior to inclusion into the code base. We continuously scan libraries for new Common
Vulnerabilities and Exposures (CVEs.) Any issues discovered are ranked based uponrisk, prioritized, addressed, and then validated, internally and externally, for resolution.
We deploy systems using updated images managed through versioned configuration
changes that contain the latest security updates. Once deployed, existing systems aredecommissioned and replaced with the up-to-date system.

Disaster Recovery and Continuity Planning
While we work tirelessly to prevent them, disasters happen and that is why we create,
maintain, and execute plans for them. At a minimum, once a year, we come together toassess new risks, design new plans, review existing plans, and test likely failure scenarios toexercise the plans as if they were occurring in real time. The plans include but are notlimited to:•

Incident response for security, data, and production service disruptions•

Emergency succession plan•

Data classification and protection plan•

Service classification and recovery plan•

Data backup and restoration plan•

Mass media management plan7

Compliance
Calendly goes through third-party SOC 2 Type II and ISAE 3000 security audits on anannual basis. A copy of our SOC 2 or ISAE 3000 audit can be requested under an NDA whenappropriate. Calendly routinely monitors and actively addresses compliance and regulatory
requirements. Calendly offers pre-filled security questionnaires (the SIG or CAIQ) covering
our environment upon agreement of an NDA.
Calendly is fully committed to compliance with the General Data Protection Regulation(GDPR). We incorporate privacy by design standards, cookie compliance, and otherrequirements as put forth by GDPR into our data practices. Calendly’s compliancedepartment ensures that our customer data from the EU, UK, and Swiss Economic Area ishandled in a secure and confident manner according to GDPR. Calendly also aligns to the
California Consumer Privacy Act (CCPA) requirements as well as many other extraterritorial
privacy laws around the world.
To review our vendor Google Cloud Platform’s compliance, click here.

Additional Resources
1. “Google Infrastructure Security Design Overview” Google, https://cloud.google.com/
security/infrastructure/design Accessed 1 June 2021
2. Google Cloud platform Shared Responsibility Matrix https://services.google.com/fh/
files/misc/gcp_pci_srm__apr_2019.pdf
3. Forrester Unstructured Data Security Platform - Google Cloud named a leader https://cloud.google.com/resources/forrester-unstructured-data-security-2021-report
4. Google Infrastructure Security https://cloud.google.com/security/infrastructure
5. Google Data Centers https://www.google.com/about/datacenters/
6. Google Sustainability - 2020 Environment Report https://www.gstatic.com/gumdrop/
sustainability/google-2020-environmental-report.pdf
7. Google Cloud compliance center https://cloud.google.com/security/compliance
8. Google Cloud DDoS Protection and Mitigation https://cloud.google.com/files/
GCPDDoSprotection-04122016.pdf
9. Google Cloud Security https://cloud.google.com/security

8