Security

Encryption

All traffic to and from Chronos Calendar is encrypted using TLS 1.2 or higher. Data at rest is encrypted on disk by our infrastructure provider. OAuth access and refresh tokens for connected calendars are encrypted with AES-256 before being stored.

Authentication

• Passwords are hashed with a modern key-derivation function; we never store them in plain text.
• JWT access tokens are short-lived and rotated on sign-in.
• OAuth sign-in is supported through Google and Microsoft.
• Session activity is tied to your IP and user agent; suspicious activity triggers re-authentication.

Infrastructure

Chronos Calendar is self-hosted on infrastructure operated by Byte Size Labs. Application services and the MySQL database run in Docker containers, with the database accessible only through the internal application network.

Operational Practices

• Dependencies are monitored for vulnerabilities and updated regularly.
• Code changes are reviewed before deployment.
• Deployment secrets are kept outside source control and supplied to containers at runtime.
• We follow the principle of least privilege for internal access.

Responsible Disclosure

Related

See our Privacy Policy for how we handle personal information, and our Terms of Service for the full agreement.