SOC 2 Type II is a third-party audit of a SaaS vendor's security controls over a 6-12 month window. It's table-stakes for enterprise procurement and a strong signal for everyone else. Here's the landscape.
Who has it
Calendly: yes. Cal.com: yes (Cloud). Acuity/Squarespace: yes. SavvyCal: yes. Cal Clear: in progress (targeting 2026). For enterprise buyers, SOC 2 is often a procurement requirement; for solopreneurs, it's a nice-to-have.
Why it matters for your booking page
Is Your Scheduling Tool SOC 2 Type II? (And Does It Matter?) is a micro-decision that compounds. A single tool choice or configuration setting can mean the difference between a booking page that respects clients and one that surveils them. Cal Clear is built so these decisions default to the privacy-respecting option.
Cal Clear's take
Cal Clear ships with the privacy-first defaults: zero third-party scripts on booking pages, freeBusy-only OAuth scope, configurable auto-delete, honeypot anti-spam, and SCCs + DPA for EU data. You don't need to fiddle with settings to get good privacy — it's the baseline.
This is part of our privacy-first scheduling pillar guide — 18 articles covering every privacy angle.
Frequently Asked Questions
Is this a Cal Clear-specific issue or an industry-wide one?
Industry-wide. Most scheduling tools default to broad third-party integration and permissive data practices because that's what enterprise buyers traditionally demanded. Privacy-first is a newer product posture.
How can I verify my current scheduling tool follows these practices?
Open the booking page in DevTools, audit the network requests, read the privacy policy end-to-end, and ask for a DPA. If any step surfaces red flags, evaluate alternatives.
Try privacy-first scheduling, free
Cal Clear runs zero trackers on booking pages and auto-deletes booking data on your schedule. Start at calclear.app.