SolidCal Security

We’re a focused team with disciplined operational practices:

• Production infrastructure, source code, and third-party admin consoles are restricted to the SolidCal core team.
• We enforce randomly generated passwords stored in 1Password and require MFA wherever available.
• Employees and contractors receive the minimum access required for their role, rarely including production data.
• Automated dependency and vulnerability scanners alert us to known issues, and we patch aggressively.
• We do not move production data to unsecured personal devices.

When someone signs up for SolidCal’s SolidCal experience, we create a user record containing:

• First and last name
• Email address
• Hashed password (bcrypt with per-user salts)

If a user authenticates via Google, Microsoft, Fastmail, or another OAuth partner, we store the encrypted access and refresh tokens necessary to maintain that connection. Session tokens are encrypted and stored in secure browser cookies during sign-in.

All application traffic uses TLS 1.3 with certificates issued and managed by Fly.io. When users connect third-party services (Google, Microsoft, Fastmail, Apple, Stripe, Zoom, etc.), SolidCal encrypts their access tokens before persisting them in our database.

SolidCal hosts its application on Fly.io, primarily in the IAD (Virginia, US) region, and relies on Crunchy Bridge on AWS (us-east) for PostgreSQL. These providers deliver managed security controls, redundancy, and compliance support.

Learn more about their practices:

• Security at Fly.io
• Crunchy Data Security

Users typically connect calendar and conferencing accounts so SolidCal can create events on their behalf and surface real-time availability. We store only the minimum credentials needed to deliver these features and never persist calendar event bodies or attendee data in long-term storage.

Application logs are streamed to Logflare and retained for 30 days. Logs are encrypted in transit and access is restricted to authorized personnel for debugging and incident response.

Every code change goes through peer review on GitHub, automated testing, and linting before deployment. We favor rapid iteration without compromising security, and CI pipelines enforce quality gates to prevent unsafe releases.

If you believe you have discovered a security vulnerability or incident, email support@solidcal.com. While we do not currently offer a bounty, we review every report promptly.