What we ask for, and what we do with it.
Every claim on this page is a mechanism you could point at in the code, not an adjective. Where the answer is “not yet”, it says so — this is the page where being caught overclaiming costs the most.
Hotline reads your calendar twice, and writes to it once
The access is deliberately narrow, and it is narrow by design rather than by configuration. Hotline reads free/busy while you are choosing times, and writes exactly one event when somebody claims a slot. That is the whole of it. There is no continuous two-way sync, so no mirror of your calendar accumulates on our side — the events, titles and attendees of everything you did not schedule through Hotline stay where they are.
Calendar credentials are encrypted before they are stored
Each one is an AES-256-GCM envelope with a fresh random 12-byte initialisation vector per encryption, stored alongside the ciphertext, and an authentication tag that is verified on every decrypt — a failure is treated as tampering and thrown, never retried or ignored. The key is not in the database and not beside it: it lives in our secrets manager only, so a copy of the database on its own decrypts nothing.
The person you invite never makes an account
They open a link, see the times you chose, and tap one. There is no password, no profile and no record of them beyond the meeting you booked — the safest data is the data nobody collected. If they want to check your times against their own calendar, that check runs in their browser: their calendar is read on their machine and never reaches us.
A slot cannot be claimed twice
The claim is a single atomic operation in the database, not a check followed by a write. Two people opening the same proposal at the same moment cannot both take the same time; exactly one wins and the other is told immediately, rather than both being told yes and one finding out at the meeting.
Organizations are separated in the database, not just in the code
The scheduling tables carry row-level security policies, and the application connects as a database role that cannot bypass them. That means the separation between one organization's data and another's is enforced one layer below the application — a query that forgot its filter returns nothing rather than returning somebody else's roster.
You can take it out, and you can end it
Schedules, rosters and tracked time export as spreadsheets, and an account can be copied in full before it is closed. Deleting the account is available to you directly rather than by asking us — what goes and what is kept is set out on the account deletion page.
If you find something, tell us
Write to hello@hotlinecal.com with what you found and how to reproduce it. We would rather hear about it from you than not hear about it, and we will tell you what we did.
What we do not have yet
Hotline has no SOC 2 report, no ISO 27001 certificate and no third-party penetration test to show you. It is built by a small studio and it is honest about the stage it is at. A data processing agreement is available on the invoiced plans. If your procurement process needs something specific, tell us what — a straight answer about what exists is more useful to you than a badge that does not.