How Calendox Protects Your Data
How Calendox protects your data: no event content stored, OAuth-only access with no passwords, per-account isolation, and encryption in transit and at rest.
Calendox is designed to know as little about you as possible: it never stores the content of your calendar events, connects to your calendars only through OAuth — never a password — and isolates and encrypts the little it does store. This page summarizes that posture; the pages linked below cover each area in detail.
Security at a glance
| Area | What Calendox does |
|---|---|
| Event content | Never stored — titles, descriptions, locations, and meeting passwords are never written to the Calendox database |
| Change detection | A one-way content fingerprint that cannot be reversed to recover the original text |
| Calendar access | OAuth 2.0 with scoped, provider-issued tokens stored server-side only — Calendox never sees your Google or Microsoft password |
| Sign-in | Passwordless — magic links or Google/Microsoft sign-in; there is no Calendox password to phish or reuse |
| Account isolation | Row-level security enforced at the database layer |
| Encryption | TLS 1.2 or higher in transit; encrypted at rest at the storage layer |
| Hosting | Microsoft Azure |
Does Calendox store my calendar events?
No. Calendox stores only the metadata needed to run the sync service — calendar and event identifiers and sync state. The content of your events — titles, descriptions, locations, and meeting passwords — is never written to our database. To detect whether an event has changed since the last sync, Calendox keeps only a one-way content fingerprint that cannot be reversed to recover the original text; event details shown in the Unified Calendar are read live from Google or Microsoft each time.
Booking pages follow the same principle: visitors see only computed free/busy slots — never event titles, attendees, or any other calendar contents.
See Data Security for exactly what is stored and for how long.
How does Calendox access my calendars?
Through OAuth 2.0 only. You authorize Calendox on Google's or Microsoft's own consent screen, and Calendox receives a scoped token in return — it never sees or stores your provider password, and you can revoke access from your provider account at any time. Tokens are stored server-side only and are never exposed to your browser, included in logs, or returned by any API response. The complete scope list, and why each scope is needed, is on OAuth Permissions.
Signing in to Calendox itself is passwordless too — magic links or Google/Microsoft sign-in — so there is no Calendox password to store, leak, or reuse.
How is my data isolated and encrypted?
Calendox uses row-level security enforced at the database layer, so every database query is scoped to the authenticated user, or to the tenant for Business/Enterprise accounts — a user cannot read or write another user's data through the application, even if application code has a bug.
All data in transit is protected by TLS 1.2 or higher. Calendox is hosted on Microsoft Azure, and the database encrypts data at rest at the storage layer.
Learn more
- Data Security — storage, encryption, retention, and deletion in detail
- OAuth Permissions — every scope requested from Google, Microsoft, and Zoom, and how to revoke access
- Privacy Policy and the Data Security statement — the formal policies
- Vulnerability disclosure — how to report a security issue
Notifications
How Calendox in-app and email notifications work — sync, billing, team, and booking notification categories, and which preferences you control.
OAuth Permissions
The complete list of OAuth scopes Calendox requests from Google, Microsoft, and Zoom, why each one is needed, and how to revoke access at any time.