Provider-native authorization
Use OAuth or a provider-approved delegated flow. CalendarFuse should never ask a user to send a Google, Microsoft, or Salesforce password.
Trust center
Security without theater.
Clear statements about what exists today, what production integrations require, and what CalendarFuse does not claim.
Current posture: the public demo uses fictional data and makes no provider API calls. CalendarFuse does not currently claim SOC 2, ISO 27001, HIPAA, or other third-party certification.
Production requirements
Access should be scoped, observable, and easy to revoke.
These controls are the security bar for enabling real calendar connections in the private beta.
Least-privilege scopes
Request only the scopes required for the enabled workflow, explain them before consent, and separate read-only access from event editing.
Protected credentials
Keep provider tokens out of browser storage and source control, encrypt sensitive secrets at rest, and restrict backend access by service role.
Explicit delegated access
Executives and administrators control who may view private details, edit events, resolve duplicates, and manage provider connections.
Audit history
Record actor, action, time, source, and affected record for assistant changes and automated synchronization decisions.
Sync-loop protection
Track provider record IDs and CalendarFuse ownership metadata so an update is not repeatedly copied from one calendar into another.
Deletion and revocation
Disconnecting a provider invalidates its connection. Account deletion has a documented workflow and removes active service data after verification.
Incident response
Security reports go to support@calendarfuse.com for triage, containment, provider revocation, remediation, and customer communication as appropriate.
Data boundaries
Calendar data is operational data, not ad inventory.
The product design does not rely on selling calendar content or using it for behavioral advertising. Google-connected data is subject to Google's API Services User Data Policy, including Limited Use requirements.
Private event policyEnabled
Busy
Tuesday · 3:00–4:00 PM
Assistant viewTitle hiddenNotes hiddenAttendees hidden
The executive can grant more visibility for specific assistants, calendars, or event categories.
Report a concern
Found a security issue?
Send a concise report with the affected URL, reproduction steps, impact, and a safe contact method. Do not access another person's calendar or data while testing.