ISO 27001 certified. Audited, not assumed.
Cal.com, Inc. runs an information security management system certified to ISO/IEC 27001, the international standard for information security. Every audit since our first certification in 2022 has been flawless. This page says what the standard asks, why it matters when you run your scheduling on Cal.com, and how to get the certificate.
Last reviewed on 6 November 2026. This page is information, not legal advice.
Trusted by fast-growing companies around the world
Three facts your security team can check
ISO/IEC 27001 certifies a management system: the way a company finds its information risks and keeps them under control.
01
An international standard
ISO/IEC 27001 is published jointly by ISO and IEC and recognised worldwide. It is widely asked for in security reviews, especially outside North America.
02
A system, not a checklist
The standard asks for a risk assessment, controls chosen to answer it, and management that reviews and improves the system. The certificate covers the whole loop.
03
Flawless since 2022
A certificate is kept only through audits by the certification body. Every audit since our first certification in 2022 has been flawless.
Every audit since 2022: flawless
ISO/IEC 27001 and SOC 2 Type II are audited by independent third parties. Since our first certification in 2022, every one of those audits has been flawless.
- SOC 2 Type IIFlawless
- ISO/IEC 27001Flawless
The year of the first certification. The ISO/IEC 27001 certificate names its scope and validity.
Why ISO 27001 matters when you run your scheduling on Cal.com
Scheduling connects to almost everything your team uses. A certified management system is how those connections stay a known risk.
01
Scheduling touches your whole stack
Cal.com connects to your calendars, video tools, CRM and 100+ more apps. ISO/IEC 27001 asks us to know the risk of each connection and to control it.
02
Risk is reviewed, not assumed
New features and new integrations go through the same risk process, and management reviews the system regularly. Security keeps up with the product.
03
International buyers know it
Procurement in Europe and Asia often asks for ISO/IEC 27001 first. One certificate answers a large part of their questionnaire.
04
It backs your GDPR duties
Article 32 GDPR asks for appropriate technical and organisational measures. A certified management system at your scheduling vendor is evidence you can file. Read about the GDPR.
ISO 27001 and SOC 2, side by side
They answer the same question from two sides, and reviewers often ask for both. Cal.com has both.
| Feature | ISO/IEC 27001 | SOC 2 Type II |
|---|---|---|
| The framework | ||
| Published by | ISO and IEC | AICPA |
| What is checked | The information security management system | Specific controls, tested over months |
| Result | A certificate | An auditor's report |
| Most asked for | Worldwide, especially in Europe and Asia | In North America |
| Cal.com | ||
| Held by Cal.com, Inc. | ||
| Every audit since 2022 | Flawless | Flawless |
What to do before your review
The certificate is the evidence. Here is where to get it and what to read with it.
01
Download the certificate
Signed in to Cal.com, open Settings, Security, Compliance for the ISO/IEC 27001 certificate, the SOC 2 Type II report and the latest penetration test report.
02
Check the scope
The certificate names what it covers. If your review needs more, a statement of applicability or a call with our security team, talk to sales.
03
Pair it with SOC 2
ISO/IEC 27001 certifies the system; the SOC 2 Type II report shows the controls tested over time. Most reviews want both.
The rest of Cal.com's compliance
Each framework answers a different question. Together they cover the security of the service, the laws on the data in it, and where that data may go.
01
SOC 2 Type II
An independent auditor tests our security, availability and confidentiality controls over months, every year. Read about SOC 2.
02
HIPAA
For healthcare teams handling protected health information: a signed business associate agreement and the safeguards behind it. Read about HIPAA.
03
GDPR
A Data Processing Agreement with standard contractual clauses, the Data Privacy Framework for transfers, and Cal.eu for hosting in the EU. Read about the GDPR.
04
EU-U.S. Data Privacy Framework
Cal.com, Inc. is an active participant, with the UK Extension. See the entry or read why it matters.
Frequently asked questions about ISO 27001
The short ones are here. For anything else, ask below.
Ask a questionYes. Cal.com, Inc. holds an ISO/IEC 27001 certification for its information security management system. Every audit since our first certification in 2022 has been flawless.
ISO/IEC 27001 is an international certification of the management system that runs security. SOC 2 Type II is an auditor's report on how specific controls worked over a period of months. Cal.com has both.
Signed in, under Settings, Security, Compliance. You can also write to [email protected].
Cal.com and Cal.eu are the same app. Both are GDPR, SOC 2 Type II and ISO 27001 compliant; Cal.eu adds data residency in the European Union.
It covers the service Cal.com, Inc. runs. If you self-host the open-source code, the infrastructure and its security are yours to certify.
Read the originals
Everything above comes from these documents.
- ISO/IEC 27001, International Organization for Standardization: the standard for information security management systems.
- Regulation (EU) 2016/679, the General Data Protection Regulation: Article 28 on processors, Article 32 on security, Chapter V on transfers.
- Security at Cal.com: our controls, penetration testing and vulnerability disclosure.
Scheduling on a certified security system
ISO/IEC 27001 and SOC 2 Type II, flawless in every audit since 2022. Get the certificate in your settings, or ask us what your review needs.
Get startedTalk to sales