# Cal.com — Appointment Scheduling

Cal.com by Cal.com, Inc. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-10-29. Provenance: Rest of world; sovereignty: 1 of 6 dimensions proven.

- Vendor: Cal.com, Inc. (https://cal.com)
- Category: [Appointment Scheduling](https://whats-best.ai/software/appointment-scheduling.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/appointment-scheduling/cal-com
- Alternatives: https://whats-best.ai/software/appointment-scheduling/cal-com/alternatives ([markdown](https://whats-best.ai/software/appointment-scheduling/cal-com/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-29 · oldest source captured 2026-10-28

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Cal.com, Inc.
- Headquarters: Incorporated in United States [S6]
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S4]

## The panel's verdict

Cal.com is open-source scheduling infrastructure that can also be self-hosted, sold by Cal.com, Inc., a Delaware corporation. The scores cluster in narrow ranges, and no criterion showed a real split among the judges. Team scheduling sits at 8 on round-robin distribution over availability, weights and priority rules, collective and managed event types, and routing forms; integrations and data run 8-9 on a documented v2 API, webhooks across 31 trigger types, two-way Salesforce and HubSpot sync, and self-serve export of customer data at any time. Sovereignty is the low point at 4: the pages state data is processed in the United States, EU data residency is offered only on contact, and judges describe the published transfer machinery — a data processing agreement on every account, standard contractual clauses, an EU representative in Germany — as real but running through a US company. Pricing transparency scores 5-6, with yearly figures only (Teams at $12 per user/month, Organizations at $28 per user/month) and no public information on SMS credit or payment-fee costs. Booking, calendar and reminders clustered at 6-7.

**Speaks for it:**
- Team scheduling scores sit at 8 on round-robin over availability, weights and priority rules, collective and managed event types, and routing forms
- Integrations and data scores run 8-9 on a documented v2 API, 31 webhook trigger types, two-way Salesforce and HubSpot sync, and self-serve customer-data export at any time
- Self-hosting under an MIT licence and embeddable booking components are documented
- A free-forever plan for one user includes Stripe and PayPal payments, email and SMS notifications, and 100+ app integrations
- The compliance stack is public — ISO 27001, SOC 2 Type II, a HIPAA Business Associate Agreement on Teams plans and up, and a data processing agreement on every account

**Held against it:**
- Sovereignty scores sit at 4 — the contracting party is Cal.com, Inc., a Delaware corporation, data is processed in the United States, and EU data residency comes only on contact
- Pricing transparency scores run 5-6, with only yearly figures shown and no public information on SMS credit costs or payment fees
- The captured pages give different figures for payment providers — the pricing page names Stripe and PayPal, the event-type documentation says only Stripe is supported
- We found no public information on enforced cancellation deadlines, no-show fees, deposits or waiting lists, which kept reminders and no-show scores at 6-7
- We found no public information on rooms or equipment being checked for conflicts alongside a person's calendar

**Best for:**
- You run a distributed sales or service team that needs round-robin distribution, routing forms and managed booking queues
- Your developers want a documented API, webhooks across 31 trigger types, and an MIT-licensed self-hosted fallback
- You want to start free — the free-forever plan for one user includes payments, notifications and 100+ apps, with no credit card required at signup

**Avoid if:**
- You must keep booking data in Europe by default — the pages state data is processed in the United States, with EU residency available only on contact
- You need to budget the full cost upfront — the public pages show yearly prices only, with SMS credit and payment fees left unstated
- Your booking flow depends on PayPal — the captured pages give different figures for supported payment providers, so confirm with the vendor before relying on it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Practice Owner | The Salon Owner | The Sales Team Lead | The Independent Consultant | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Booking page & client experience | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 |
| Calendar sync & availability rules | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| Team, staff & location scheduling | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Reminders, payments & no-show protection | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Integrations, API & data export | 4.5/5 | 4.5/5 | 4.5/5 | 4/5 | 4.5/5 | 4.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3/5** | **3/5** |

### The judges

- **The Practice Owner** (v1.0): Runs a physiotherapy practice with six therapists, two treatment rooms that must not be double-booked, and a front desk that spends its mornings on the phone. Wants patients to book and reschedule online, SMS reminders that cut the no-shows, rooms and therapists checked together, and patient data that stays in Europe under a data processing agreement the practice can show.
- **The Salon Owner** (v1.0): Owns two hair and beauty salons with eleven stylists and a Saturday that is booked out by Wednesday. Wants every service with its own duration and price on one booking page, clients who pick their stylist, a deposit for colour appointments, a fee when someone does not show, and a monthly bill that does not grow with every chair.
- **The Sales Team Lead** (v1.0): Leads fourteen account executives in three time zones and gets every demo request from the website. Wants inbound demos routed by company size and region, round-robin that is fair and can be checked, two-way sync with Outlook and Google so nobody is double-booked, a video link in every invite, and the booking written into the CRM before the call starts.
- **The Independent Consultant** (v1.0): Sells coaching sessions and workshop days on her own and books clients from Germany, Austria and Switzerland. Wants a booking page that looks like her own website, payment taken when the session is booked, a buffer after every call, her private calendar respected, reminders she never has to send herself, and a price that makes sense for one person.
- **The Data Protection Officer** (v1.0): Signs off booking tools for a group of medical and legal practices, where an appointment alone reveals who is a patient or a client. Wants the contracting entity and hosting named, every subprocessor listed down to the SMS gateway and the email service, calendar access limited to what booking needs, and bookings and customer records that can be exported and deleted on request.
- **The Skeptic** (v1.0): Has seen "free forever" booking pages that put the vendor's logo in front of every client, SMS reminders that turn out to be credits sold separately, round-robin and payments locked in the top tier, and calendar sync that reads far more than free and busy. Reads the price list for what scales per seat, the subprocessor list for where the reminders are sent from, and asks how the bookings get out again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 6 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Incorporated in US | 0/2 | [S6] |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AI training: no [S6]
- Applicable laws: GDPR · UK GDPR · Swiss FADP · US State Privacy Laws [S7]
- Audit rights: 30 · 1 · yes [S7]
- Automated compliance platform: compliance automation platforms used for continuous compliance monitoring [S8]
- Baa available: yes [S6]
- Baa HIPAA: yes · yes [S7]
- Breach notification: without undue delay · yes [S5]
- Certifications held: ISO 27001 · SOC 2 Type II · CCPA · GDPR · HIPAA [S8]
- DPA available: yes [S8]
- DPA signed by default: cal.com/dpa · yes [S5]
- Dpf certification: yes [S7]
- Dpf certified: yes · yes [S5]
- Dpf ftc enforcement: yes [S5]
- Dpf response time: 45 [S5]
- Dpf switzerland not applicable: no [S5]
- Dpf UK inquiries: privacy@cal.com · 2261 Market Street #4382, San Francisco, CA 94114, United States [S5]
- HIPAA baa: Teams plans and up · yes [S5]
- ISO 27001 certification available: yes [S8]
- Legal bases: Contract, contract/legitimate interests, legitimate interests, legitimate interests (opt-out available), consent where required, legal obligation [S5]
- No dnt sale: no · no [S5]
- No minor health collection: yes · no [S5]
- No third party cookies product: yes · no [S5]
- Pentest report available: yes [S8]
- Phree prohibited without baa: yes [S6]
- Scc fallback: 2021 EU SCCs · UK Addendum · Swiss amendments · cal.com/dpa-scc [S5]
- Security measures: yes · yes · yes · yes [S7]
- Security measures: encryption in transit · encryption at rest · least-privilege access · SSO · 2FA · audited infrastructure · bug bounty · cal.com/security [S5]
- SOC 2 report available: yes [S8]
- UK addendum swiss: yes · yes [S7]

**Data**
- Aggregated use: yes [S6]
- Cal video recordings: own cloud storage · yes [S5]
- Customer ownership: yes [S6]
- Deletion: return then deletion · deletion · DPA §10 [S6]
- Deletion confirmation: yes [S7]
- Deletion schedule: 90 [S7]
- Export: yes [S6]
- Export and deletion: yes · yes · yes [S5]
- Export period: 30 [S7]
- Prohibited payment card: yes [S6]
- Retention export window: 30 · 90 [S5]
- Retention sentry: Sentry · internal user and organization IDs only · 90 [S5]
- Retention tax records: 7-10 [S5]

**Hosting**
- EU residency: yes [S5]
- Oauth callback URL: OAuth callback is <API_URL>/v2/conferencing/{app}/oauth/callback; self-hosted instances must register it as redirect URI [S17]
- Processing location: United States · yes [S5]

**Integrations**
- API auth header: Authorization: Bearer <token>, API key prefixed with cal_ [S13]
- API routing form field limits: 255 · 3000 [S14]
- API routing form route fields: id · name · kind · action · conditions · yes [S14]
- API routing form success response: 201 · success · error [S14]
- API routing form summary field: string[] · human-readable overview [S14]
- API routing form updated at concurrency: concurrency detection for route and question edits [S14]
- API team id formats: uuid · short-uuid (Flickr Base58) · numeric id [S14]
- API team routing form auth: TEAM_ROUTING_FORM_WRITE · team admin · cal_ · routingForm.create [S14]
- API team routing form initial state: yes · yes [S14]
- App store: Slack · Salesforce · 100+ [S2]
- App store apps: integrates with Slack, Salesforce, and 100+ apps [S9]
- App store count: 100 · Slack · Salesforce [S15]
- Authentication: Bearer token: API key (cal_ prefix), managed user access token, or OAuth access token [S17]
- Automation: Zapier · Dub · Close [S5]
- Breadth: Slack · Salesforce · 100+ [S3]
- Calendars: Google Calendar · Microsoft Outlook · Apple/CalDAV · Zoho [S5]
- Conferencing apps: Cal Video (daily-video) · Google Meet (google-meet) · Zoom (zoom) · Microsoft Teams (msteams) [S17]
- CRM: Salesforce · HubSpot · Pipedrive [S5]
- Custom APIs: yes [S4]
- Custom webhooks smtp: yes · yes [S5]
- Disconnect endpoint: DELETE /v2/conferencing/zoom/disconnect removes the Zoom connection [S17]
- List endpoint: GET /v2/conferencing lists connected conferencing apps; invalid:true means credential must be reconnected [S17]
- Marketing use: privacy@cal.com · yes [S6]
- Oauth scopes: APPS_READ · APPS_WRITE [S17]
- Org endpoints: Org-level Zoom install endpoints under /v2/organizations/{orgId}/conferencing [S17]
- Org zoom concurrency: Org-level Zoom meetings hosted by authorizing admin's Zoom account; overlapping meetings may fail [S17]
- Package name: @calcom/atoms [S10]
- Team endpoints: Team-level conferencing endpoints under /v2/organizations/{orgId}/teams/{teamId}/conferencing [S17]
- Team permissions: team.read · team.update · team admin · TEAM_APPS_READ · TEAM_APPS_WRITE [S17]
- Third party services: no · yes [S6]
- Video: Zoom · Google Meet · Microsoft Teams [S5]
- Webhook auth: Bearer API key prefixed with cal_ [S18]
- Webhook create endpoint: /v2/webhooks · POST [S18]
- Webhook custom headers: 10 · 4096 · yes · yes [S18]
- Webhook header keyring requirement: CALCOM_KEYRING_WEBHOOK_HEADERS · 400 [S18]
- Webhook no show timing: DAY · HOUR · MINUTE · 1 · AFTER_HOSTS_CAL_VIDEO_NO_SHOW · AFTER_GUESTS_CAL_VIDEO_NO_SHOW [S18]

**Legal**
- Address: 94114 · San Francisco · 2261 Market Street #4382 · United States [S6]
- Contracting entity: Cal.com, Inc. · Delaware corporation [S6]
- Controller processor split: cal.com/dpa · yes · yes · yes [S5]
- Dmca agent: Bailey Pumfleet · legal@cal.com [S6]
- DPA applies all plans: yes [S7]
- DPA contact address: 2261 Market Street #4382, San Francisco, CA 94114, United States · legal@cal.com · privacy@cal.com [S7]
- DPA entity: Cal.com, Inc. [S7]
- DPA negotiation: yes [S7]
- DPA version: 2.3 · 2026-11-01 [S7]
- Entity: Cal.com, Inc. [S15]
- Entity address: legal@cal.com · Cal.com, Inc. · 2261 Market Street #4382, San Francisco, CA 94114, United States [S5]
- EU representative: Felix Kolodziej · privacy@cal.com · CAYA Postbox 1040588, 96035 Bamberg, Germany [S5]
- Feedback license: perpetual, irrevocable, royalty-free [S6]
- Governing law: Delaware, United States [S6]
- No arbitration: no [S6]
- No data sale: no [S5]
- Policy change notice: email · in-product notification · documented electronic method · yes [S5]
- Scc governing law: courts of Ireland · Ireland [S7]
- Terms version: 2.0 · 2026-11-01 [S6]
- Terms version history: 2026-10-31 · 2021-04-14 · cal.com/terms-archive-v1 [S6]
- Trademark entity: Cal.com, Inc. [S4]
- Trademark holder: Cal.com, Inc. [S8]
- Trademark owner: Cal.com and Cal are registered trademarks [S9]
- US state privacy certification: yes · yes [S7]

**Pricing**
- Billing cycle: in advance · automatic [S6]
- Enterprise custom: custom · yes [S4]
- Free plans trials: yes [S6]
- Free price: 0 · Individuals · yes [S4]
- Liability cap: 100 · USD · 12 [S6]
- Organizations plan requirement: yes · no · organizations [S16]
- Organizations yearly price: Save 25% · 28 [S4]
- Platform plan requirement: ESSENTIALS or above required for platform organizations · 403 [S17]
- Refund policy: yes [S6]
- Signup no credit card: no [S1]
- Tax treatment: yes [S6]
- Teams trial: 14 [S4]
- Teams yearly price: Save 25% · 12 [S4]

**Product**
- Advanced tab: custom calendar event name · custom booking questions · email verification for bookers [S10]
- After call emails: yes [S2]
- AI features opt in: yes · no [S5]
- Annual external pentest: annual [S8]
- Assignment tab: yes · collective · round robin · managed [S10]
- Automated reminders: sms · email · yes [S1]
- Automated vulnerability scanning: yes [S8]
- Availability settings purpose: Availability settings atom lets users define available time slots and avoid double bookings [S12]
- Availability tab: Edit existing availability or set new availability options; team events can use a common team schedule or per-host availability [S10]
- Avatarapi profile photo: AvatarAPI · yes [S5]
- Background checks: yes [S8]
- Booker atom whitelabel: booker atom allows white-labeling the scheduling widget [S9]
- Booking limits: yes · yes [S1]
- Booking notifications: yes · text · email · yes [S1]
- Branch protection code review: branch protection with peer review and automated security tests required before production [S8]
- Breach notification: yes [S7]
- Bug bounty platform: Bugcrowd · https://bugcrowd.com/4f0b96d4-2749-415e-b2d8-6aebde98f211/external/report [S8]
- Cal AI phone agent: yes [S4]
- Calendly import: yes [S4]
- Card data stripe: Stripe · no [S5]
- Collected account data: name, email, username, password hash or SSO identity, time zone, profile photo, availability [S5]
- Create event type atom: CreateEventType atom creates event types for individuals or teams [S10]
- Create event type props: teamId · customClassNames · onSuccess · onError · onCancel [S10]
- Custom booking link: yes [S1]
- Custom classnames keys: containerClassName · ctaClassName · editableHeadingClassName · formClassName · timezoneSelectClassName · subtitlesClassName · scheduleClassNames · dateOverrideClassNames [S12]
- Custom classnames tailwind: custom classnames must be valid Tailwind CSS classnames [S12]
- Custom domain email: waitlist · custom domains and emails · no [S16]
- Data subject request assistance: yes [S7]
- Database encryption: yes · yes [S8]
- Date overrides: set specific hours for a date or mark unavailable · yes · yes [S12]
- Default location: Default booking location is Cal Video [S17]
- Disclosure scope targets: https://app.cal.qa/ · Cal.com QA · Website testing · https://api.cal.qa/ · Cal.com QA API · API testing [S8]
- DPA update termination right: yes [S7]
- Dpia assistance: yes [S7]
- Dynamic group links: yes [S4]

**Subprocessors**
- Change notice: yes · yes [S7]
- Change notice: email to administrator or privacy/legal contact · in-product notification · documented electronic method · yes [S5]
- List location: trust.cal.com [S7]
- Objection right: reasonable and substantiated data-protection grounds · yes [S5]
- Objection termination refund: yes · yes [S7]
- Own service providers: Documenso · Fusial · United States · e-signing contracts and DPAs · no [S5]
- Phi AI training ban: yes [S7]
- Trust center listing: Trust Center · hosting · email · SMS · video · payments · AI · analytics · monitoring · support · back-office tools [S5]

**Support**
- Enterprise SLA: yes [S4]
- Enterprise slack priority: yes [S4]
- Privacy contact: privacy@cal.com [S5]

101 more facts on the canonical page: https://whats-best.ai/software/appointment-scheduling/cal-com

## Questions

### Is Cal.com European?

No. whats-best.ai classifies Cal.com as Rest of world. Its vendor, Cal.com, Inc., is incorporated in United States, per [the vendor’s page captured 28 Oct 2026](https://whats-best.ai/evidence/11457).

### Where does Cal.com store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Cal.com have a free plan?

Yes. Cal.com has a free plan, per [the vendor’s page captured 28 Oct 2026](https://whats-best.ai/evidence/11455).

### What are the best alternatives to Cal.com?

As of 3 Nov 2026, the panel rates [zeeg (3.5/5)](https://whats-best.ai/software/appointment-scheduling/zeeg), [YouCanBookMe (3.5/5)](https://whats-best.ai/software/appointment-scheduling/youcanbookme) and [SimplyBook.me (3.5/5)](https://whats-best.ai/software/appointment-scheduling/simplybook-me) highest among the other 18 Appointment Scheduling products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [zeeg](https://whats-best.ai/software/appointment-scheduling/zeeg) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Cal.com alternatives](https://whats-best.ai/software/appointment-scheduling/cal-com/alternatives).

## Head-to-head

- [Cal.com vs Calendly](https://whats-best.ai/compare/cal-com-vs-calendly.md)

## What this page leaves out

- 17 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://cal.com/ (checked 2026-10-28)
- [S2] Product features: reminders and workflows: https://cal.com/features/workflows (checked 2026-10-28)
- [S3] Product features: payments: https://cal.com/features/payments (checked 2026-10-28)
- [S4] Pricing page: https://cal.com/pricing (checked 2026-10-28)
- [S5] Privacy policy: https://cal.com/privacy (checked 2026-10-28)
- [S6] Terms of service: https://cal.com/terms (checked 2026-10-28)
- [S7] Data processing agreement: https://cal.com/dpa (checked 2026-10-28)
- [S8] Security / trust page: https://cal.com/security (checked 2026-10-28)
- [S9] Booking page & client experience — found from sitemap: https://cal.com/embed (checked 2026-10-28)
- [S10] Booking page & client experience — found from sitemap: https://cal.com/docs/atoms/event-type (checked 2026-10-28)
- [S11] Calendar sync & availability rules — found from sitemap: https://cal.com/docs/atoms/google-calendar-connect (checked 2026-10-28)
- [S12] Calendar sync & availability rules — found from sitemap: https://cal.com/docs/atoms/availability-settings (checked 2026-10-28)
- [S13] Team, staff & location scheduling — found from sitemap: https://cal.com/docs/api-reference/v2/orgs-teams-routing-forms/get-team-routing-form (checked 2026-10-28)
- [S14] Team, staff & location scheduling — found from sitemap: https://cal.com/docs/api-reference/v2/orgs-teams-routing-forms/create-team-routing-form (checked 2026-10-28)
- [S15] Reminders, payments & no-show protection — found from sitemap: https://cal.com/workflows (checked 2026-10-28)
- [S16] Reminders, payments & no-show protection — found from sitemap: https://cal.com/custom-domain-email-waitlist (checked 2026-10-28)
- [S17] Integrations, API & data export — found from sitemap: https://cal.com/docs/api-reference/v2/conferencing-apps (checked 2026-10-28)
- [S18] Integrations, API & data export — found from sitemap: https://cal.com/docs/api-reference/v2/webhooks/create-a-webhook (checked 2026-10-28)
- [S19] Self-hosting / on-premises installation docs — found from the homepage: https://cal.com/docs/introduction/quick-start/self-hosting/docker (checked 2026-11-01)
- [S20] Code repository (open-source licence) — found from the homepage: https://github.com/calcom/cal.com (checked 2026-11-01)

---

Cite as: whats-best.ai, "Cal.com — Appointment Scheduling", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/appointment-scheduling/cal-com

Corrections: https://whats-best.ai/correct/1096?target=page