Security

Last updated: 21 April 2026

Encryption

All traffic to and from Chronos Calendar is encrypted using TLS 1.2 or higher. Data at rest is encrypted on disk by our infrastructure provider. OAuth access and refresh tokens for connected calendars are encrypted with AES-256 before being stored.

Authentication

Passwords are hashed with a modern key-derivation function; we never store them in plain text.
JWT access tokens are short-lived and rotated on sign-in.
OAuth sign-in is supported through Google and Microsoft.
Session activity is tied to your IP and user agent; suspicious activity triggers re-authentication.

Infrastructure

Chronos Calendar is hosted on Railway, which runs on audited cloud infrastructure. Our databases are isolated per environment, backed up regularly, and access-controlled. Production access is restricted to authorised engineers and logged.

Operational Practices

Dependencies are monitored for vulnerabilities and updated regularly.
Code changes are reviewed before deployment.
Secrets are stored in a managed secret store, never in source control.
We follow the principle of least privilege for internal access.

Responsible Disclosure

If you believe you've found a security vulnerability, please email [email protected] with details. We aim to acknowledge reports within two business days and will keep you updated as we investigate. Please do not publicly disclose issues before we've had a chance to respond.

See our Privacy Policy for how we handle personal information, and our Terms of Service for the full agreement.