Skip to main content
Was this helpful?

Security Best Practices

Most calendar security problems aren't technical exploits — they're avoidable habits. Here are the ones that matter most for PrimeCal users.

1. Use a Strong, Unique Password​

Your PrimeCal account protects your calendar data and anyone else's data on calendars you share. Use a password that:

  • Is at least 12 characters
  • Is unique to PrimeCal (not reused from another account)
  • Includes a mix of letters, numbers, and symbols

Change your password from your Profile page under Security.

2. Log Out On Shared Devices​

If you access PrimeCal on a shared computer, library terminal, or borrowed device:

  • Always log out before leaving
  • Don't save your credentials in the browser on shared hardware

3. Review Shared Calendar Access Regularly​

Who has access to your calendars? Check periodically:

  1. Open your calendar → Calendar Settings
  2. Review the member list for each shared calendar
  3. Remove anyone who no longer needs access

Former team members, old acquaintances, or expired project collaborators should be removed promptly. Even read-only access means someone can see when you're busy, at home, on vacation, or at an appointment.

4. Give Minimum Necessary Permissions​

When sharing, start with the lowest permission that meets the need:

  • Read — for people who just need to see events
  • Write — only if they actively need to add or edit events
  • Admin — only for a co-owner who needs to manage members

More permission = more exposure if that account is ever compromised. See Permission Levels.

5. Protect Your API Keys (Developers)​

If your plan includes API access, treat your API keys like passwords:

  • Never paste them into public chats, screenshots, or version control
  • Regenerate a key immediately if you suspect it was exposed
  • Use separate keys for separate integrations — one key per application makes it easy to revoke access for one integration without affecting others

6. Be Careful With Automation Webhook Tokens​

Each automation rule with a webhook trigger has a unique token in its URL. Anyone with that URL can trigger the rule. Treat webhook URLs like passwords:

  • Share them only with the specific external service that needs them
  • Regenerate the token from the rule detail view if it was exposed

7. Watch for Unusual Activity​

If your calendar shows events you didn't create, or someone has access you didn't grant:

  • Change your password immediately
  • Review and revoke all shared access across your calendars
  • Check if any API keys or webhook tokens should be regenerated
  • Contact your PrimeCal administrator if this is a team deployment

8. Keep Your Integrations Minimal​

Only connect external calendar accounts and OAuth providers that you actively use. Each active integration is an additional surface area. Revoke integrations you no longer need from the External Sync section of your account.

Continue Reading​