Enterprise-grade security. Verified by SOC 2.
Cal.com, Inc. is SOC 2 Type II certified. An independent auditor tests our security, availability and confidentiality controls over months, not on one day, and every audit since our first certification in 2022 has been flawless. Between audits, Vanta monitors the controls. This page says what that covers, why it matters for the scheduling you run on Cal.com, and how to get the report.
Last reviewed on 6 November 2026. This page is information, not legal advice.
Trusted by fast-growing companies around the world
Three facts your security team can check
No trust required: the report itself is the proof, and you can ask for it today.
01
Independently audited
SOC 2 is a framework of the AICPA. An independent auditor, not Cal.com, tests our controls and writes the report.
02
Type II, tested over time
A Type II report covers how the controls worked over a period of months, not only how they were designed on one day.
03
Flawless since 2022
Every audit since our first certification in 2022 has been flawless. Vanta watches the controls every day in between.
Every audit since 2022: flawless
SOC 2 Type II and ISO/IEC 27001 are audited by independent third parties. Since our first certification in 2022, every one of those audits has been flawless.
- SOC 2 Type IIFlawless
- ISO/IEC 27001Flawless
The year of the first certification. The latest SOC 2 Type II report and ISO/IEC 27001 certificate carry the auditors' own words.
Why SOC 2 matters when you run your scheduling on Cal.com
A scheduling tool is not a side app. It holds standing access to your calendars and sits between your team and everyone who books with it.
01
Your calendars are connected
Cal.com reads free and busy times and writes events into the calendars you connect. SOC 2 tests the controls around that access: who can reach the systems, how changes ship, how incidents are handled.
02
Your customers' details pass through
Every booking carries a name, an email address and a time, often a phone number and answers to your booking questions. SOC 2's confidentiality criteria cover how that data is kept.
03
Your booking page must stay up
A booking page is public and takes revenue. SOC 2's availability criteria cover monitoring, backups and recovery, so a booking link keeps working.
04
Your procurement asks for it
Vendor reviews ask for a SOC 2 Type II report first. With ours in hand, that part of the review is done.
What is SOC 2 and why it matters
SOC 2 is a framework developed by the AICPA to ensure companies handle customer data securely, following five key criteria: security, availability, confidentiality, processing integrity, and privacy.
A SOC 2 Type II certification means Cal.com consistently applies strict security practices, verified through independent audits. This certification gives you peace of mind that your scheduling data is protected and handled with transparency.
What SOC 2 compliance means for you as a user of Cal.com
You can trust Cal.com with your sensitive data. Client details that flow through our system are handled securely, and we have independent audits to prove it.
01
Verified trust and transparency
02
Enterprise-grade data protection
03
Procurement-ready compliance
04
Continuous monitoring and independent audits
Designed for smooth rollouts and SOC 2-compliant scheduling
Built for easy, organization-wide deployment. Cal.com eliminates fragmented tools and scattered accounts, ensuring **SOC 2 compliance** with unified security, consistency, and control over your scheduling operations.
01
Domain-wide delegation
02
SAML SSO, SCIM provisioning
03
Privacy compliance tools
04
Encryption and security monitoring
Proven across healthcare, sales, service, SaaS, and beyond
Cal.com meets SOC 2 compliance standards, providing secure and reliable scheduling for a wide range of industries, including healthcare, sales, service, and SaaS, ensuring data protection and privacy for diverse use cases.
Healthcare & wellness
Government & finance
Sales & GTM teams
What to do before your review
The report is the evidence. Here is where to get it and what to read next.
01
Download the report
Signed in to Cal.com, open Settings, Security, Compliance for the SOC 2 Type II report, the ISO/IEC 27001 certificate and the latest penetration test report.
02
Ask for what else you need
Bridge letters, questionnaires, a call with our security team: write to [email protected] or talk to sales.
03
Check the other frameworks
SOC 2 covers the service. For the law on the data in it, read GDPR and HIPAA; for the management system, ISO/IEC 27001.
The rest of Cal.com's compliance
Each framework answers a different question. Together they cover the security of the service, the laws on the data in it, and where that data may go.
01
ISO/IEC 27001
Our information security management system is certified to the international standard and audited to keep the certificate. Read about ISO/IEC 27001.
02
HIPAA
For healthcare teams handling protected health information: a signed business associate agreement and the safeguards behind it. Read about HIPAA.
03
GDPR
A Data Processing Agreement with standard contractual clauses, the Data Privacy Framework for transfers, and Cal.eu for hosting in the EU. Read about the GDPR.
04
EU-U.S. Data Privacy Framework
Cal.com, Inc. is an active participant, with the UK Extension. See the entry or read why it matters.
See why our users love Cal.com
Read the impact we've had from those who matter most - our customers.
Thrilled with this scheduling app—it's a game-changer. The intuitive interface and advanced features streamline my time management. The standout, however, is the incredible support team—swift, expert responses to every query. A perfect combo for seamless scheduling and top-notch customer service. P.s. Way better than Calendly
Mickeyon TrustpilotWithout a doubt the best calendar/scheduling application I have ever used. It has all of the advanced features I need while also being insanely intuitive and straightforward for both end-users and booking recipients. Love it!!
davidvkimballon Trustpilotmore elegant than Calendly, more open than Savvycal, cal.com works and it feels just right.
flo merianon Product HuntAmazing. I've been sharing it with everyone I know. It's helped me create more events spontaneously, because of how smooth it is compared to Calendly and Harmonizely.
Benon Product Hunt
I just migrated from calendly to cal.com I'm liking it so far. I wasn't particularly displeased with calendly. It's fine. But I like that cal is OSS and my sub to calendly was coming up for renewal so I thought I'd check it out. Looks good.
Kent C. Dodds 🌌@kentcdodds on X(finally) made the move to @calcom after I couldn't find how to edit events in the calendly dashboard and I must say - dash is 10/10 Bravo @peer_rich and team (I should have moved over years ago!) OSS fam
Ant Wilson@AntWilson on XThis platform's open-source nature and flexible licensing are a developer's dream. Self-hosting and white-labeling empower personalization and seamless integration.
Ahmed Elnaggaron Product HuntVery easy to set up and start. Connected with my Google calendar without any problem. Connecting with Microsoft gives me an error. But other than that the user interface is very good.
Pankaj Dixiton Product Hunt
2 days of using @calcom is enough to never look back at calendly
Anuvesh Singh@singh_anuvesh on XOne of the best tools for scheduling and my favorite after so many other options tried.
Denison Product Huntfor the love of me, why do people still use Calendly? Just today I have seen products reference Calendly while they know of @calcom It's a no brainer for me to use , their brand is amazing, cool team + they even have more compelling features 🤷
Rotimi Best@rotimi_best on XJust gave it a go and it's definitely the easiest meeting I've ever scheduled! No context switching, no distractions, and works even better on mobile too.
Aria Minaeion Product Hunt
All your key tools in sync with your meetings
Connects to Slack, Salesforce, and 100+ more. Bookings show up where your team already works.
- Google CalendarChecks every calendar for conflicts and adds the booking.
- Zoom VideoGives each booking its own meeting link.
- SalesforceLogs the meeting on the contact and routes to the owner.
- HubSpot CRMAdds bookings to contacts and deals.
- SlackTells the team the moment a meeting is booked.
- StripeTakes payment when the slot is booked.
FramerPuts your booking page on a Framer site.
ElevenLabsGives voice agents a realistic AI voice.
LinearSets your status to out of office from your calendar.
Meta PixelMeasures bookings from your Meta ad campaigns.
UmamiCounts visits to your booking page, privately.
WhatsAppMeets your guests on a WhatsApp chat or video call.
Frequently asked questions about SOC 2 compliance
The short ones are here. For anything else, ask below.
Ask a questionYes. Cal.com is SOC 2 Type II certified, meaning our security, availability, and confidentiality controls have been audited and verified by an independent third party.
Type I reviews whether security controls are designed effectively at one point in time. Type II evaluates whether those controls are followed and effective over several months, meaning Cal.com’s certification proves ongoing, consistent compliance.
Cal.com undergoes an independent external audit every year to maintain our SOC 2 Type II certification. Between audits, we use Vanta to continuously monitor our internal controls and ensure compliance every day.
Yes. Enterprise customers and partners can request access to our most recent SOC 2 report. Contact our team for details by sending an email to [email protected] or by scheduling a demo.
SOC 2 compliance ensures that Cal.com maintains strict standards for security, availability, and confidentiality, meaning your organization’s data is encrypted, access-controlled, and continuously monitored to reduce risk.
Yes. In addition to SOC 2 Type II, Cal.com complies with HIPAA, ISO/IEC 27001, GDPR, and CCPA. Together, these frameworks provide a complete security foundation for organizations of all sizes.
Read the originals
Everything above comes from these documents.
- System and Organization Controls (SOC) suite of services, AICPA: what SOC 2 reports cover and who may issue them.
- Security at Cal.com: our controls, penetration testing and vulnerability disclosure.
Trusted by fast-growing companies around the world
Choose Cal.com for verified, SOC 2 compliant scheduling
Cal.com’s SOC 2 certification, independent audits, and continuous monitoring with Vanta ensure your data is always protected. Choose a platform built for trust, compliance, and enterprise-grade security.
Get startedTalk to sales