Calendly
Scheduling · calendly.com · last read 2026-10-12
Identity
| Legal entity | Calendly |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | calendly.com · 2026-10-08 |
Data location
No data-location observation recorded yet.
Subprocessor chain
20 third parties · 20 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Aiven | US | Infrastructure |
| Amazon Web Services | US | Infrastructure |
| Assembled | US | User support management |
| Cloudflare | US | Content Delivery Network (CDN) and Distributed Denial of Service (DDoS) mitigation |
| Datadog | US | Infrastructure performance monitoring and business Analytics |
| E-HAWK | US, NL | Malicious actor detection and prevention |
| Elasticsearch | US | In-app search services |
| US | Infrastructure and analytics | |
| Hex | US | Product related data analysis and visualization |
| Hyperdoc (a.k.a. Recall.ai) | US | Processes audio/video recording for Calendly Notetaker |
| Intercom | US | Customer support enablement |
| Loris.ai | US | Customer support tool |
| Monte Carlo | US | Data quality observability |
| OpenAI | US | AI features, Notetaker meeting summaries, SMS compliance |
| Redis | US, IL | Manages in-memory data storage and caching services |
| Sprig | US | Customer feedback tool |
| Temporal Technologies | US | Supports background workflows to sync Gmail metadata for contact email threads |
| Twilio | US | SMS provider and domain-based message authentication, reporting and conformance |
| Upscope | US, GB | Interactive screen sharing for customer support assistance |
| Zendesk | US | Customer service communication tool |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · calendly.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | 30 days in advance notice of intended changes to the Sub-Processor list (SCC Clause 9 Option 2) |
| Notice of new subprocessors | 30 days prior, via notification mechanism to customers who sign up; non-subscribers waive prior notice |
| If you object to one | Data exporter is given the opportunity to object to intended Sub-Processor changes |
| If you object to one | Object by email within 30 days on reasonable data protection concerns; parties work in good faith; if unresolved, customer may terminate affected portion of Services without penalty |
| Breach notification | without undue delay |
| Audit | Within 30 days of written request, no more than once annually: most recent third-party audit/certification reports (e.g. SOC 2, ISO 27001) to customer or mutually agreed third-party auditor; further information on written request as agreed in good faith |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA STAR · CSA | Claimed | — | calendly.com | 2026-10-08 |
| ISO/IEC 27001 · ISO27001 | Claimed | — | calendly.com | 2026-10-08 |
| PCI COMPLIANT · PCIDSS | Claimed | — | calendly.com | 2026-10-08 |
| SOC 2 (Type 2) · SOC2T2 | Claimed | — | calendly.com | 2026-10-08 |
| SOC 3 · SOC3 | Claimed | — | calendly.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Calendly LLC | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Calendly LLC | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Calendly LLC | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Calendly
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Calendly
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Calendly
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Calendly
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Calendly
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Calendly
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-04-10; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.