Last updated November 5, 2026
Secure authentication
Staff sign in with email and password on app.calyndr.com. Sessions are cookie-based on the application host. Password recovery uses the auth email flow. Public registration is closed unless Calyndr enables it. Invite tokens remain the path for new staff while signup is closed.
Organization-level access
Application records are scoped to an organization. Row-level policies and application checks restrict appointments, clients, and settings to that organization. Cross-organization access is not a product feature. The marketing site does not load application credentials.
Role-based permissions
Owners set calendar visibility and appointment-detail defaults per role. Admins manage people, teams, and scheduling. Managers see assigned teams. Members see their own work. Owners control billing unless they grant an admin billing access.
Encrypted connections
Traffic to calyndr.com and app.calyndr.com uses HTTPS. Public booking pages, website embeds, and the signed-in application are served over encrypted connections.
Controlled access to customer information
Guest bookings store the contact details needed to run the appointment. Guests do not receive an organization account. Reschedule and cancel links use a private token. Business website embeds may only be framed by https origins the organization has allowed. Details: Website embeds & installation.
Payment processing
Subscription payments are processed by Stripe. Stripe hosts Checkout, payment methods, and invoices. Calyndr stores subscription status and purchased seat quantity. Card numbers are not stored in Calyndr. This describes how payments are handled; it is not a PCI certification for Calyndr.
Processors and privacy
Providers used to operate the service, including hosting, authentication, email, and optional calendar connections, are listed in the Privacy Policy. That list is a processing disclosure, not a certification catalog.
Reports
Security issues: hello@calyndr.com. Do not include live credentials in the first message.