Invite-only coordinator access
Workspaces are invite-only. Your team signs in with single-use codes emailed to them that expire after a short time. There are no passwords to reuse, phish or leak.
Security & privacy
Built for introductions that have to stay private
Confidential deals depend on discretion. These are the practices Caly follows today to protect sellers, buyers and the teams that coordinate them.
Access
Only the people who need to be involved can reach anything in Caly.
Private links per participant
Every seller and buyer receives their own link. Links are long, unguessable, scoped to a single listing or introduction, expire automatically and can be revoked by a coordinator at any time.
Optional one-time codes, no passwords
Links are private to each person. A firm can also ask each device to confirm a one-time code emailed to that address, on every deal or deal by deal. Sellers and buyers never create accounts or passwords.
Confidentiality
Caly is designed so that each side sees only what it needs to.
Separate invitations per side
Sellers and buyers receive separate calendar invitations. Buyers never see seller attendee details and sellers never see buyer attendee details. Invitations use a neutral listing reference such as “Listing A17”, and sellers see a buyer code such as “Buyer B204”. Names are revealed only on the call.
No meeting recordings
Caly does not record meeting audio or video. From video calls we use only attendance events (who joined and when) to send reminders and record follow-through.
Data protection
Connected accounts and deal data are handled conservatively.
Encrypted connection tokens
OAuth tokens for Zoom and HubSpot are encrypted at rest with AES-256-GCM using a key held separately from the database. All traffic is served over HTTPS.
Least-privilege integrations
We request only the OAuth scopes Caly needs: creating the video meetings it books and updating the deals you connect. Caly never connects to your calendar; invites go out by email. You can disconnect an integration at any time.
Verified webhooks
Incoming webhooks from our video provider, HubSpot and our email provider are verified against their signatures before Caly acts on them. Unsigned or mismatched requests are rejected.
Audit trail
Emails, invitations, bookings, reschedules, cancellations, link revocations and sign-ins are recorded with who did what and when, so every introduction has a clear history.
Infrastructure & your data
Simple, well-understood hosting and a clear path to deletion.
Managed hosting
Caly runs on Vercel with a managed PostgreSQL database. Production access is limited to the small team that operates the service.
Deletion on request
You can ask us to delete a listing, an introduction, or your entire workspace. We remove the data from our production systems and confirm when it’s done.
Questions from your security or compliance team?
We’re happy to walk through how Caly handles data for your firm. See also our privacy policy.