Security Policy

Calenix's security programme is based on the following principles:

1. security by design and by default;
2. least-privilege access;
3. defence in depth;
4. secure authentication;
5. encryption of sensitive information;
6. segregation of environments;
7. continuous monitoring;
8. vulnerability management;
9. secure software development;
10. incident preparedness;
11. data minimisation; and
12. continuous improvement.

Calenix assigns responsibility for information security to appropriately authorised personnel.

Security responsibilities may include:

1. security governance;
2. access management;
3. vulnerability management;
4. incident response;
5. security monitoring;
6. infrastructure security;
7. application security;
8. privacy and data protection;
9. vendor risk management; and
10. business continuity.

Calenix restricts access to systems and information based on business need and the principle of least privilege.

Access controls may include:

1. unique user accounts;
2. role-based access;
3. multi-factor authentication where appropriate;
4. privileged access restrictions;
5. periodic access reviews;
6. authentication controls;
7. session management;
8. credential management; and
9. removal of access when no longer required.

Administrative access to production systems is restricted to authorised personnel.

Calenix uses reasonable security controls to protect user authentication information.

Passwords are not intentionally stored in plaintext.

Where supported by the relevant service, Calenix may provide or require stronger authentication mechanisms such as multi-factor authentication.

Calenix uses encryption and secure transport mechanisms appropriate to the sensitivity of information.

Data transmitted between users, Calenix systems and supported third-party integrations is protected using secure communication protocols.

Calenix's production services are intended to use TLS 1.2 or higher for supported external connections.

Sensitive credentials, OAuth tokens, API secrets and similar authentication material should not be stored or transmitted in plaintext.

Calenix integrates with third-party services including, where enabled:

1. Google Calendar;
2. Microsoft Outlook;
3. Zoom;
4. Microsoft Teams;
5. Stripe;
6. HubSpot;
7. Salesforce;
8. Slack;
9. Zapier; and
10. other supported services.

Integrations operate only after the user or authorised administrator grants the applicable permissions.

Calenix seeks to request only permissions reasonably necessary to provide the relevant functionality.

For OAuth-based integrations, credentials and tokens are handled using appropriate security controls and are not intentionally exposed to unauthorised users.

Where Calenix accesses Google user data through Google APIs, such access is limited to the purposes disclosed to users and necessary to provide the requested functionality.

Depending on the features enabled, Google data may include:

1. account and profile information;
2. calendar information;
3. calendar events;
4. event attendees;
5. event availability;
6. meeting information; and
7. OAuth authentication information.

Calenix does not sell Google user data.

Google user data is not used for advertising profiling or unrelated purposes.

Calenix does not use Google user data for purposes inconsistent with the permissions and disclosures presented to the user.

Where Calenix integrates with Zoom, access to Zoom information is limited to the permissions authorised by the user and necessary to provide scheduling and meeting functionality.

Depending on the integration, this may include:

1. Zoom account information;
2. meeting details;
3. meeting identifiers;
4. meeting links;
5. participant-related information;
6. meeting settings;
7. scheduling information; and
8. OAuth credentials or tokens.

Calenix does not sell Zoom user data.

Calenix follows secure development principles throughout the software development lifecycle.

Security considerations may include:

1. secure design review;
2. code review;
3. dependency management;
4. vulnerability scanning;
5. security testing;
6. access control testing;
7. input validation;
8. authentication and authorisation testing;
9. secrets management;
10. logging and monitoring; and
11. remediation of identified vulnerabilities.

Calenix uses commercially reasonable measures to secure its infrastructure.

These may include:

1. network security controls;
2. access restrictions;
3. environment segregation;
4. hardened production systems;
5. secure configuration management;
6. logging and monitoring;
7. backup controls;
8. vulnerability management; and
9. controlled administrative access.

Calenix maintains appropriate technical logs and monitoring to support:

1. security investigations;
2. operational troubleshooting;
3. service reliability;
4. abuse detection;
5. authentication monitoring; and
6. incident response.

Logs containing sensitive information are protected and access is restricted.

Calenix seeks to avoid unnecessarily logging passwords, authentication tokens, API secrets and other sensitive credentials.

Calenix may perform security assessments appropriate to its risk profile, including:

1. vulnerability scanning;
2. SAST;
3. DAST;
4. dependency scanning;
5. penetration testing;
6. infrastructure testing; and
7. other security assessments.

Where security testing identifies vulnerabilities, Calenix manages them through its Vulnerability Management Policy.

Personnel with access to systems or customer information are expected to maintain confidentiality and follow applicable security procedures.

Access is limited according to job responsibilities.

When personnel no longer require access, their access should be removed or adjusted appropriately.

Calenix provides or requires appropriate security guidance for personnel involved in operating, developing or supporting its services.

Security awareness may cover:

1. phishing;
2. credential security;
3. handling of confidential information;
4. secure development;
5. incident reporting;
6. access management; and
7. privacy obligations.

Calenix maintains operational measures intended to support continued availability of its services.

Depending on the service and infrastructure involved, these may include:

1. system redundancy;
2. backups;
3. recovery procedures;
4. monitoring;
5. incident response;
6. infrastructure recovery; and
7. restoration testing.

Specific availability and recovery commitments are governed by applicable customer agreements or service commitments.

Suspected or confirmed security incidents are managed under Calenix's Incident Management and Response Policy.

Calenix periodically reviews its security controls and may update them based on:

1. emerging threats;
2. vulnerability intelligence;
3. security testing;
4. incidents;
5. changes in technology;
6. customer requirements;
7. applicable laws; and
8. industry practices.