Your data, handled with care.
We value your data and are committed to keeping it safe and secure. Here’s how we handle it, in transit and at rest.
Last updated January 16, 2023
- Encrypted in transit
- Every page is served over TLS 1.3.
- Encrypted at rest
- Access tokens for connected accounts are encrypted before they reach our database.
- No copies of your calendar
- We check your calendars in real time and never store your events.
- Hosted in the US
- Hosted on Fly.io in Virginia, with our database on Crunchy Bridge in AWS us-east.
Organizational security
We are a small (but mighty!) team. Here are some of the best practices we’ve adopted:
- Access to servers, source code, and third-party tools is limited to core team members.
- We use strong, randomly generated passwords stored in a password manager (1Password).
- Employees and contractors get the lowest level of access that lets them do their work. This rarely includes access to production systems or data.
- Automatic vulnerability detection tools alert us when our dependencies have known security issues. We apply patches and deploy them quickly.
- We don’t copy production data to external devices, such as personal laptops.
Authentication
When someone signs up for SavvyCal, we create a user record in our database that includes:
- First and last name
- Email address
- Hashed password (using
bcrypt)
If they sign in through an OAuth partner (Google, Microsoft, or Fastmail), we store encrypted credentials for that account (the OAuth access token and refresh token) and link them to their user account.
When someone signs in, we generate an encrypted session token that’s stored in a browser cookie.
Encryption
All application pages are encrypted with TLS 1.3, using certificates managed by Fly.io, our infrastructure provider.
When you connect a third-party account, such as Google, Microsoft, Fastmail, Apple, Stripe, or Zoom, we encrypt its access tokens before saving them to our database.
Infrastructure
Our application is hosted with Fly.io, primarily in the IAD (Virginia, US) region. Our database is hosted with Crunchy Bridge on AWS in the us-east region.
Learn more about their security practices:
Third-party access
Most people connect one or more calendar accounts, such as Google Calendar, and video conferencing providers, such as Zoom. That lets SavvyCal create calendar events and video meetings on their behalf, and account for the times they’re already busy on their scheduling links.
We store only the minimum data needed to access these accounts and use them for their intended purpose. We never store calendar events in our persistent data stores.
Logging
Application logs are stored in New Relic and kept for 30 days. All data sent to New Relic is encrypted in transit.
Software development practices
We ship quickly, but never so fast that we sacrifice quality or, most importantly, the security of your data. Every change is reviewed by a peer through a GitHub pull request. A thorough automated test suite and linters run in continuous integration before anything is deployed.
Security questions
Do you store copies of my calendar events?
No. When someone uses your scheduling link, we check the calendars you’ve chosen for conflicts in near real time. We cache the results in application memory, never in persistent storage, for up to one minute.
Are you SOC 2 or ISO 27001 certified?
Not yet. We’d love to earn these certifications eventually. Our core infrastructure providers do hold them.
How do I report a vulnerability or security concern?
Email us at security@savvycal.com. We don’t offer compensation for independent reports at this time.
Email security@savvycal.com