Cal.com
Cal.com, Inc. ·cal.com· As of: 2026-08-05
Work through this tool with an AI
Our verdict
A booking page takes coordination effort out and shortens the path to a meeting. Nobody becomes distinguishable through it, because a dozen vendors ship the same function and competitors buy it at the same price. What decides an edge sits before and after: which request is routed to whom, and what happens once the meeting is over. Both of those are settled in the customer record.
Evidence:The vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourcePlan prices of 12 and 28 US dollars per user per month, and the allocation of SAML, SCIM, dedicated database and the choice between US and EU hostingOpen sourceShutdown of Cal.eu on 1 November 2026 and migration of users to the international platform, announced on 30 July 2026Open sourceMove of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026Open sourceReasoning for the step with AI-driven scanning of open source code for vulnerabilities, 14 April 2026Open sourceNaming of SOC 2 Type II and ISO 27001 plus an annual third-party penetration test, without standard version, scope or retrievable reportOpen sourceCal.ai as a calling feature at 0.29 US dollars a minute, credits per plan, and the statement that most people will not notice the machine callerOpen sourceNo data processing agreement and no subprocessor list in the site index; the addresses /dpa, /subprocessors and /trust return 404Open sourceThe terms choose the law of the United Kingdom, in a version dated 14 April 2021Open source
Who it fits
Solo
suitable
The single seat costs nothing and caps neither event types nor bookings. For one person who needs a booking link, the plan question is settled.
Mid-market
suitable
Round-robin distribution, routing forms and shared event types cost 12 US dollars per user per month on annual billing. For a five-person sales team that stays predictable, as long as the per-minute cost of Cal.ai does not come on top.
Enterprise
suitable with caveats
SAML sign-in and SCIM provisioning start at 28 US dollars per user per month; a dedicated database and a signed agreement for health data only appear in the quoted Enterprise plan. Ahead of the price sit two open points: no data processing agreement is publicly available, and the European-hosted edition Cal.eu shuts down on 1 November 2026.
Buy, switch or build
Off-the-shelf
Calendly, or what the Microsoft licence already contains
Calendly covers the same job and keeps a data processing agreement publicly available, which stops a vendor review from stalling at that point. Corporates stay for a second reason: Microsoft Bookings sits inside the licence they already pay for, and the meetings stay in the same tenant as mailbox and calendar. That is rarely the better tool and almost always the shorter procurement path.
AI-native
Buying the voice agent separately
Anyone who wants the calling layer can buy it from a specialist vendor and connect it through the calendar API; Retell AI is listed as its own app in Cal.com own directory. Against Cal.ai at 0.29 US dollars a minute the arithmetic shifts with volume, and what mainly gets more expensive is the seam between two vendors. What you give up is the single contract and the single record covering both call and meeting.
Build it yourself
Running Cal.diy yourself
The community edition Cal.diy carries the MIT licence and can be self-hosted: Postgres through Supabase, delivery through Cloudflare Pages, reminders and follow-up chains through n8n, sign-in through Ory, built with Claude Code or Cursor. The effort rarely sits in the booking form. It sits in the calendar connection: Google API verification, Microsoft Graph, time zones and daylight saving, double bookings under concurrent access. Since April 2026 there is more: teams, organizations, routing forms and workflows have been removed from this edition. So a team scenario means building exactly the parts that were taken out. For the single-user case two person-days to the first booking is realistic; the bill arrives afterwards, from running it.
Our advice
- Solo: Take the free single seat and decide nothing further.
- Mid-market: Buy, but request the data processing agreement in writing first.
- Enterprise: Settle where data will sit after Cal.eu shuts down, then decide.
Who is behind it
Staying power: Funded
The last publicly dated funding round is from April 2022. Two directional decisions are documented for 2026: the production codebase has been in a private repository since April, and the European-hosted edition is being discontinued in November. Development continues, and the pricing page and announcements carry current dates.
- Legal entity and registered address: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States; a data protection officer is named, and the privacy policy names Peer Richelsen as EU representative without an addressThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open source · As of 2026-08-05
- Funding: Series A of 25 million US dollars, reported on 18 April 2022, led by Seven Seven Six with OSS Capital and Obvious Ventures; no further publicly dated round could be found on 5 August 2026thesaasnews.com/news/cal-com-raises-25-million-in-series-aOpen source · As of 2026-08-05
- Source code and licence: On 15 April 2026 the production codebase moved to a private repository and the public repository was renamed calcom/cal.diy; the community edition has carried the MIT licence instead of AGPL 3.0 since thenMove of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026Open source · As of 2026-08-05
- European-hosted edition: Announcement of 30 July 2026: Cal.eu shuts down on 1 November 2026, users move to the international platform or export their data; Enterprise customers keep access for their contract termShutdown of Cal.eu on 1 November 2026 and migration of users to the international platform, announced on 30 July 2026Open source · As of 2026-08-05
- Handling of vulnerabilities: In the migration post the vendor names specific fixed vulnerabilities with version numbers, among them axios 1.15.0 and handlebars 4.7.9 plus SSRF and CSRF protection (15 April 2026)Move of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026Open source · As of 2026-08-05
Cost of leaving: Moderate
Bookings, event types and contacts come out through the API, and moving to another vendor is a well-trodden path. What stays behind are the published links: every signature, every embedded page and every reference in campaigns points at cal.com or at the subdomain hosted there. Add the routing rules, the round-robin weights and the analytics, which no export carries along. The once-obvious escape into self-hosting reaches less far since April 2026, because teams, organizations, routing forms and workflows were removed from the community edition.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, but unfavourableno separate document available publiclyThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourceNeither among the roughly forty addresses checked nor in the site index is there a data processing agreement. The privacy policy explicitly describes the vendor as controller for the data it covers. What happens to the content inside the product, meaning the details of the people who book, is not addressed. The security page holds out access to data protection agreements without naming a destination.As of 2026-08-05 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, but unfavourableUnited States; the European edition shuts down on 1 November 2026Shutdown of Cal.eu on 1 November 2026 and migration of users to the international platform, announced on 30 July 2026Open sourceThe privacy policy names the United States as the place of processing. The pricing table lists the choice between US and EU hosting as a feature of the upper tier. At the same time, on 30 July 2026 the vendor announced that the European-hosted edition Cal.eu will shut down on 1 November 2026 and that users will move to the international platform. Those statements do not line up, so the question belongs in the contract talks.As of 2026-08-05 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, but unfavourableno maintained listThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourceThere is no dedicated subprocessor page. The privacy policy names PostHog, Google Analytics, GitHub, Twilio, Daily.co, Intercom and Stripe. No language-model or speech provider appears there, although Cal.ai is sold as a calling feature. The version is dated 24 October 2023 and still carries a sentence about the former vendor Plain inside the Intercom section.As of 2026-08-05 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | open on a point that decides usabilitytransfer to the United States with no basis namedThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourceThe privacy policy states that data is transferred to the United States and processed there. Standard contractual clauses, an adequacy decision or the EU-US Data Privacy Framework are named nowhere. Instead it says that consent to the policy and the submission of the data constitute agreement to that transfer. Whether the vendor has self-certified under the framework could not be checked on 5 August 2026, because the public list did not answer a query.As of 2026-08-05 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | open on a point that decides usabilityno statementThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourceNeither the privacy policy nor the terms state whether call content, transcripts or booking details feed model training. With Cal.ai the vendor sells a feature that makes phone calls, produces transcripts and offers sentiment analysis. So AI processes customer content, and the question stays unanswered.As of 2026-08-05 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, but unfavourableonly the necessity principle, no period givenThe vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023Open sourceThe privacy policy names no period. It says data is retained as long as necessary for the stated purposes, and usage data generally for a shorter time. What happens to bookings, transcripts and attachments after a contract ends appears neither there nor in the terms.As of 2026-08-05 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, but unfavourableSOC 2 Type II and ISO 27001 named, without version or scopeNaming of SOC 2 Type II and ISO 27001 plus an annual third-party penetration test, without standard version, scope or retrievable reportOpen sourceThe security page names SOC 2 Type II and ISO 27001 and, in the same list of certifications, the General Data Protection Regulation and Californian consumer law. The latter two are statutes and are not certified against. Standard version, scope and audit period appear nowhere, and the reports are not publicly available. An annual third-party penetration test is described.As of 2026-08-05 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | open on a point that decides usabilityno statement on Article 50, although the feature calls end customersCal.ai as a calling feature at 0.29 US dollars a minute, credits per plan, and the statement that most people will not notice the machine callerOpen sourceCal.ai calls the people who booked, reminds them of meetings and follows up. The product page states in its FAQ that most people will not notice they are talking to a machine unless they are told. On the transparency duties in Article 50 of Regulation (EU) 2026/1744, which apply from August 2026, the vendor says nothing. The disclosure has to be produced by the operator in its own call script, and no setting is described that enforces it.As of 2026-08-05 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourablebooking audit log as an upper-tier feature, scope undefinedMove of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026Open sourceThe vendor describes a booking audit log as an enterprise feature and lists it explicitly among the functions removed from the community edition during the source code move. Which events it records, how long it is kept and whether it can be exported into your own systems appears nowhere publicly.As of 2026-08-05 |
What it really costs
Entry price
The single seat costs nothing and caps neither event types nor bookings. Teams costs 12 US dollars per user per month on annual billing, Organizations 28. Monthly billing is 25 per cent more expensive according to the toggle on the pricing page. The Enterprise plan is quoted on request.Plan prices of 12 and 28 US dollars per user per month, and the allocation of SAML, SCIM, dedicated database and the choice between US and EU hostingOpen source
As of 2026-08-05
What gets expensive
In three places. First at the jump to 28 US dollars: SAML sign-in, SCIM provisioning, your own subdomain and roles all sit on that tier. Second at the Enterprise plan without a list price, which carries the dedicated database, availability commitments and the signed agreement for health data. Third at Cal.ai: a minute costs 0.29 US dollars, individual users get no included balance, teams receive 750 and organizations 1,000 credits per member per month, which works out at roughly 26 and 34 call minutes respectively.
What it displaces
- Email ping-pong over three proposed slots
- Scheduling polls for one-to-one conversations
- Distributing inbound requests by hand in sales
Interfaces
- API version 2 for event types, bookings and availability
- Webhooks on booking, rescheduling and cancellation
- Embedding of the booking page and React components for your own interfaces
- Two-way sync with Salesforce and HubSpot
- Calendar connections to Google, Outlook, Apple and Zoho
- Payments through Stripe and PayPal
- Zapier and Make
Matching methods
- Bowtie Funnel / Revenue ArchitectureThe meeting is the point where the method places the handover from attention to commitment, and Cal.com makes exactly that handover countable.
- GTM Stack Signal RoutingThe method requires a signal to reach the right person without detours, and the routing forms and attribute-based distribution are where that rule is executed.
- Lead Scoring: Best Leads to Best ClosersThe method distributes inbound requests by their scored value, and weighted round-robin is the lever that enforces such an assignment without anyone having to intervene.
- Predictable Revenue / Cold Calling 2.0The separate qualifying role needs a clean handover to closing, and the booked meeting is the record that makes that handover measurable.
Sources
- 1.The vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023 (opens in a new tab)cal.com/privacy · As of 2026-08-05
- 2.Plan prices of 12 and 28 US dollars per user per month, and the allocation of SAML, SCIM, dedicated database and the choice between US and EU hosting (opens in a new tab)cal.com/pricing · As of 2026-08-05
- 3.Shutdown of Cal.eu on 1 November 2026 and migration of users to the international platform, announced on 30 July 2026 (opens in a new tab)cal.com/blog/cal.eu-to-cal.com-migration · As of 2026-08-05
- 4.Move of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026 (opens in a new tab)cal.com/blog/cal-diy-open-source-to-closed-source · As of 2026-08-05
- 5.Reasoning for the step with AI-driven scanning of open source code for vulnerabilities, 14 April 2026 (opens in a new tab)cal.com/blog/cal-com-goes-closed-source-why · As of 2026-08-05
- 6.Naming of SOC 2 Type II and ISO 27001 plus an annual third-party penetration test, without standard version, scope or retrievable report (opens in a new tab)cal.com/security · As of 2026-08-05
- 7.Cal.ai as a calling feature at 0.29 US dollars a minute, credits per plan, and the statement that most people will not notice the machine caller (opens in a new tab)cal.com/ai · As of 2026-08-05
- 8.No data processing agreement and no subprocessor list in the site index; the addresses /dpa, /subprocessors and /trust return 404 (opens in a new tab)cal.com/sitemap_en.xml · As of 2026-08-05
- 9.The terms choose the law of the United Kingdom, in a version dated 14 April 2021 (opens in a new tab)cal.com/terms · As of 2026-08-05
- 10.thesaasnews.com/news/cal-com-raises-25-million-in-series-a (opens in a new tab)As of 2026-08-05
Last reviewed: 2026-08-05 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.