Security

How CalendarPipe accesses your calendars

CalendarPipe never receives your password. You authenticate directly with Google or Microsoft, and we receive a scoped OAuth token that you can revoke at any time from your provider’s account settings or by disconnecting the calendar in CalendarPipe.

Apple Calendar connects over CalDAV using an app-specific password that you generate — a credential scoped to CalendarPipe alone, which you can revoke from your Apple account without affecting anything else.

Disconnecting a calendar removes our access immediately.

What we store — and what we don’t

Calendar events that pass through a sync rule are fetched, transformed, delivered to the destination, and discarded. We do not keep a copy of your calendar.

There is one deliberate exception: events you create on a CalendarPipe hosted calendar are stored, because we serve those events to your calendar clients and to attendees. That is the whole point of a hosted calendar.

What we do store for every account: your email address, your encrypted calendar connection tokens, and the sync rules you have written.

Token encryption

OAuth tokens and CalDAV credentials are encrypted with AES-256-GCM before they are written to the database. An attacker with database access alone does not have your calendar access.

All traffic to and from CalendarPipe is TLS-encrypted.

The rule sandbox

Gate functions — the code that decides what syncs and how it is transformed — execute inside a QuickJS WebAssembly sandbox with no network access and no filesystem access.

A gate function can read the event it was handed and return a modified version. It cannot open a socket, reach another service, or see any other user’s data. This holds whether the rule was written by you, generated by AI, or picked from a template.

Where your data lives

Database and authentication run on Supabase in the EU Central region (Frankfurt, Germany). Background job delivery runs on Upstash QStash in the EU region (AWS eu-central-1, Frankfurt); job payloads reference internal identifiers and never contain OAuth tokens or calendar event content.

Two processors sit outside the EU and we would rather say so plainly than bury it. Product analytics events — things like “a sync run completed” — are processed by PostHog in the United States. AI rule generation calls OpenAI’s API using the gpt-4o-mini model; API inputs and outputs may be retained by OpenAI for up to 30 days. AI rule generation only runs when you explicitly ask it to.

Reporting a vulnerability

If you believe you have found a security issue, email support@calendarpipe.com with enough detail to reproduce it. We will acknowledge your report and keep you updated on the fix.

Please give us a reasonable window to ship a fix before disclosing publicly. We will not pursue legal action against researchers who report in good faith and avoid degrading the service or accessing other users’ data.