# Cal.com

> Provides booking pages that compute free slots from connected calendars, distribute incoming requests across a team by stored rules, and create the confirmed meeting with a video link and reminders.

- Vendor: Cal.com, Inc.
- Canonical URL: https://www.convios.com/en/toolbox/cal-com
- Language version: https://www.convios.com/de/werkzeugkasten/cal-com
- Area: Go-to-market & sales · Cluster: appointment scheduling
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-05 · Reviewed: 2026-08-05 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: A booking page takes coordination effort out and shortens the path to a meeting. Nobody becomes distinguishable through it, because a dozen vendors ship the same function and competitors buy it at the same price. What decides an edge sits before and after: which request is routed to whom, and what happens once the meeting is over. Both of those are settled in the customer record.

## Suitability by company size

- Solo: suitable — The single seat costs nothing and caps neither event types nor bookings. For one person who needs a booking link, the plan question is settled.
- Mid-market: suitable — Round-robin distribution, routing forms and shared event types cost 12 US dollars per user per month on annual billing. For a five-person sales team that stays predictable, as long as the per-minute cost of Cal.ai does not come on top.
- Enterprise: suitable with caveats — SAML sign-in and SCIM provisioning start at 28 US dollars per user per month; a dedicated database and a signed agreement for health data only appear in the quoted Enterprise plan. Ahead of the price sit two open points: no data processing agreement is publicly available, and the European-hosted edition Cal.eu shuts down on 1 November 2026.

## Vendor staying power

Funded: The last publicly dated funding round is from April 2022. Two directional decisions are documented for 2026: the production codebase has been in a private repository since April, and the European-hosted edition is being discontinued in November. Development continues, and the pricing page and announcements carry current dates.

- Legal entity and registered address: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States; a data protection officer is named, and the privacy policy names Peer Richelsen as EU representative without an address (source: https://cal.com/privacy, as of 2026-08-05)
- Funding: Series A of 25 million US dollars, reported on 18 April 2022, led by Seven Seven Six with OSS Capital and Obvious Ventures; no further publicly dated round could be found on 5 August 2026 (source: https://www.thesaasnews.com/news/cal-com-raises-25-million-in-series-a, as of 2026-08-05)
- Source code and licence: On 15 April 2026 the production codebase moved to a private repository and the public repository was renamed calcom/cal.diy; the community edition has carried the MIT licence instead of AGPL 3.0 since then (source: https://cal.com/blog/cal-diy-open-source-to-closed-source, as of 2026-08-05)
- European-hosted edition: Announcement of 30 July 2026: Cal.eu shuts down on 1 November 2026, users move to the international platform or export their data; Enterprise customers keep access for their contract term (source: https://cal.com/blog/cal.eu-to-cal.com-migration, as of 2026-08-05)
- Handling of vulnerabilities: In the migration post the vendor names specific fixed vulnerabilities with version numbers, among them axios 1.15.0 and handlebars 4.7.9 plus SSRF and CSRF protection (15 April 2026) (source: https://cal.com/blog/cal-diy-open-source-to-closed-source, as of 2026-08-05)

## Cost of leaving

Moderate: Bookings, event types and contacts come out through the API, and moving to another vendor is a well-trodden path. What stays behind are the published links: every signature, every embedded page and every reference in campaigns points at cal.com or at the subdomain hosted there. Add the routing rules, the round-robin weights and the analytics, which no export carries along. The once-obvious escape into self-hosting reaches less far since April 2026, because teams, organizations, routing forms and workflows were removed from the community edition.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | no separate document available publicly — Neither among the roughly forty addresses checked nor in the site index is there a data processing agreement. The privacy policy explicitly describes the vendor as controller for the data it covers. What happens to the content inside the product, meaning the details of the people who book, is not addressed. The security page holds out access to data protection agreements without naming a destination. | partially evidenced | 2026-08-05 |
| Storage location | United States; the European edition shuts down on 1 November 2026 — The privacy policy names the United States as the place of processing. The pricing table lists the choice between US and EU hosting as a feature of the upper tier. At the same time, on 30 July 2026 the vendor announced that the European-hosted edition Cal.eu will shut down on 1 November 2026 and that users will move to the international platform. Those statements do not line up, so the question belongs in the contract talks. | partially evidenced | 2026-08-05 |
| Subprocessors | no maintained list — There is no dedicated subprocessor page. The privacy policy names PostHog, Google Analytics, GitHub, Twilio, Daily.co, Intercom and Stripe. No language-model or speech provider appears there, although Cal.ai is sold as a calling feature. The version is dated 24 October 2023 and still carries a sentence about the former vendor Plain inside the Intercom section. | partially evidenced | 2026-08-05 |
| Third-country transfer | transfer to the United States with no basis named — The privacy policy states that data is transferred to the United States and processed there. Standard contractual clauses, an adequacy decision or the EU-US Data Privacy Framework are named nowhere. Instead it says that consent to the policy and the submission of the data constitute agreement to that transfer. Whether the vendor has self-certified under the framework could not be checked on 5 August 2026, because the public list did not answer a query. | not evidenced | 2026-08-05 |
| Training on customer data | no statement — Neither the privacy policy nor the terms state whether call content, transcripts or booking details feed model training. With Cal.ai the vendor sells a feature that makes phone calls, produces transcripts and offers sentiment analysis. So AI processes customer content, and the question stays unanswered. | not evidenced | 2026-08-05 |
| Retention and deletion | only the necessity principle, no period given — The privacy policy names no period. It says data is retained as long as necessary for the stated purposes, and usage data generally for a shorter time. What happens to bookings, transcripts and attachments after a contract ends appears neither there nor in the terms. | partially evidenced | 2026-08-05 |
| Certifications | SOC 2 Type II and ISO 27001 named, without version or scope — The security page names SOC 2 Type II and ISO 27001 and, in the same list of certifications, the General Data Protection Regulation and Californian consumer law. The latter two are statutes and are not certified against. Standard version, scope and audit period appear nowhere, and the reports are not publicly available. An annual third-party penetration test is described. | partially evidenced | 2026-08-05 |
| EU AI Act, Article 50 | no statement on Article 50, although the feature calls end customers — Cal.ai calls the people who booked, reminds them of meetings and follows up. The product page states in its FAQ that most people will not notice they are talking to a machine unless they are told. On the transparency duties in Article 50 of Regulation (EU) 2026/1744, which apply from August 2026, the vendor says nothing. The disclosure has to be produced by the operator in its own call script, and no setting is described that enforces it. | not evidenced | 2026-08-05 |
| Audit logging | booking audit log as an upper-tier feature, scope undefined — The vendor describes a booking audit log as an enterprise feature and lists it explicitly among the functions removed from the community edition during the source code move. Which events it records, how long it is kept and whether it can be exported into your own systems appears nowhere publicly. | partially evidenced | 2026-08-05 |

## Cost

- Entry: The single seat costs nothing and caps neither event types nor bookings. Teams costs 12 US dollars per user per month on annual billing, Organizations 28. Monthly billing is 25 per cent more expensive according to the toggle on the pricing page. The Enterprise plan is quoted on request. (as of 2026-08-05)
- Where it gets expensive: In three places. First at the jump to 28 US dollars: SAML sign-in, SCIM provisioning, your own subdomain and roles all sit on that tier. Second at the Enterprise plan without a list price, which carries the dedicated database, availability commitments and the signed agreement for health data. Third at Cal.ai: a minute costs 0.29 US dollars, individual users get no included balance, teams receive 750 and organizations 1,000 credits per member per month, which works out at roughly 26 and 34 call minutes respectively.

## Three routes compared

### Calendly, or what the Microsoft licence already contains

Calendly covers the same job and keeps a data processing agreement publicly available, which stops a vendor review from stalling at that point. Corporates stay for a second reason: Microsoft Bookings sits inside the licence they already pay for, and the meetings stay in the same tenant as mailbox and calendar. That is rarely the better tool and almost always the shorter procurement path.

### Buying the voice agent separately

Anyone who wants the calling layer can buy it from a specialist vendor and connect it through the calendar API; Retell AI is listed as its own app in Cal.com own directory. Against Cal.ai at 0.29 US dollars a minute the arithmetic shifts with volume, and what mainly gets more expensive is the seam between two vendors. What you give up is the single contract and the single record covering both call and meeting.

### Running Cal.diy yourself

The community edition Cal.diy carries the MIT licence and can be self-hosted: Postgres through Supabase, delivery through Cloudflare Pages, reminders and follow-up chains through n8n, sign-in through Ory, built with Claude Code or Cursor. The effort rarely sits in the booking form. It sits in the calendar connection: Google API verification, Microsoft Graph, time zones and daylight saving, double bookings under concurrent access. Since April 2026 there is more: teams, organizations, routing forms and workflows have been removed from this edition. So a team scenario means building exactly the parts that were taken out. For the single-user case two person-days to the first booking is realistic; the bill arrives afterwards, from running it.

Recommendation by size:

- Solo: Take the free single seat and decide nothing further.
- Mid-market: Buy, but request the data processing agreement in writing first.
- Enterprise: Settle where data will sit after Cal.eu shuts down, then decide.

## Context

- Implements method: [Bowtie Funnel / Revenue Architecture](https://www.convios.com/en/methods/bowtie-funnel) — The meeting is the point where the method places the handover from attention to commitment, and Cal.com makes exactly that handover countable.
- Implements method: [GTM Stack Signal Routing](https://www.convios.com/en/methods/gtm-stack-signal-routing) — The method requires a signal to reach the right person without detours, and the routing forms and attribute-based distribution are where that rule is executed.
- Implements method: [Lead Scoring: Best Leads to Best Closers](https://www.convios.com/en/methods/lead-scoring-and-routing) — The method distributes inbound requests by their scored value, and weighted round-robin is the lever that enforces such an assignment without anyone having to intervene.
- Implements method: [Predictable Revenue / Cold Calling 2.0](https://www.convios.com/en/methods/predictable-revenue) — The separate qualifying role needs a clean handover to closing, and the booked meeting is the record that makes that handover measurable.
- Displaces: Email ping-pong over three proposed slots, Scheduling polls for one-to-one conversations, Distributing inbound requests by hand in sales

## Evidence

- The vendor as controller, transfer to the United States, retention by the necessity principle, named subprocessors, dated 24 October 2023 — https://cal.com/privacy (as of 2026-08-05)
- Plan prices of 12 and 28 US dollars per user per month, and the allocation of SAML, SCIM, dedicated database and the choice between US and EU hosting — https://cal.com/pricing (as of 2026-08-05)
- Shutdown of Cal.eu on 1 November 2026 and migration of users to the international platform, announced on 30 July 2026 — https://cal.com/blog/cal.eu-to-cal.com-migration (as of 2026-08-05)
- Move of the production codebase to a private repository, rename to calcom/cal.diy, licence change from AGPL 3.0 to MIT and the list of removed features, 15 April 2026 — https://cal.com/blog/cal-diy-open-source-to-closed-source (as of 2026-08-05)
- Reasoning for the step with AI-driven scanning of open source code for vulnerabilities, 14 April 2026 — https://cal.com/blog/cal-com-goes-closed-source-why (as of 2026-08-05)
- Naming of SOC 2 Type II and ISO 27001 plus an annual third-party penetration test, without standard version, scope or retrievable report — https://cal.com/security (as of 2026-08-05)
- Cal.ai as a calling feature at 0.29 US dollars a minute, credits per plan, and the statement that most people will not notice the machine caller — https://cal.com/ai (as of 2026-08-05)
- No data processing agreement and no subprocessor list in the site index; the addresses /dpa, /subprocessors and /trust return 404 — https://cal.com/sitemap_en.xml (as of 2026-08-05)
- The terms choose the law of the United Kingdom, in a version dated 14 April 2021 — https://cal.com/terms (as of 2026-08-05)