Identity and route boundary
Clerk provides identity and organisation membership. Authenticated product routes are protected at the route boundary, while sensitive services also enforce their own scope.
Trust and safeguards
Security controls you can assess
Team Calendar handles payroll-connected leave and availability data. This page describes the controls implemented today, the systems that process data, and the private path for reporting a vulnerability.
Evidence last reviewed
Implemented control summary
- Clerk-authenticated product routes
- Tenant and organisation-scoped services
- Encrypted Xero OAuth credentials
- Signed, revocable calendar feed tokens
Access
Who can access data?
Tenant and organisation scope
A Clerk Organisation is the top-level tenant boundary. Data access applies both the Clerk organisation ID and the selected payroll organisation where required.
Role boundaries
Owners and admins administer configuration. Managers are limited to permitted teams and reports. The baseline employee membership is read-only outside that employee’s own leave and availability.
Protection
How is data protected?
Xero credentials
Xero OAuth tokens use application-level AES-256-GCM encryption. Token operations stay server-side and credentials are not sent to client code.
Calendar subscriptions
Feed URLs use signed, revocable tokens. Plaintext tokens are not persisted, while authorised viewers intentionally receive the complete active subscribe URL.
Effective event privacy
Published events use the stricter of the feed and record privacy modes. A record can be excluded from feeds with include_in_feed. Team Calendar does not expose category or type selectors.
Transport and diagnostics
Supported network transport uses HTTPS/TLS. Observability events, breadcrumbs and logs are scrubbed before delivery, and server stack-frame local variables are disabled.
Data flow
Where does data move and live?
This is the implemented path from payroll source to a subscribed calendar.
- Xero Payroll
Payroll people, approved leave and balances enter through the authenticated Xero integration.
- Team Calendar tenant boundary
Canonical records are processed within Clerk organisation and payroll organisation scope.
- Encrypted token and primary data storage
Primary records are stored in Neon PostgreSQL. Xero OAuth tokens receive additional application-level encryption.
- Privacy projection
Eligibility and effective privacy are applied before publication. Published ICS bodies can be cached in configured Redis/KV.
- Subscribed calendars
Authorised calendar clients retrieve the resulting ICS feed through its signed, revocable URL.
Processing locations depend on configuration
Vercel, Neon, Clerk, Redis/KV and configured analytics or observability providers participate in processing. Region and replication depend on deployed account configuration. Ask us about a residency requirement.
Response
What happens when something goes wrong?
Procurement and privacy
Assess Team Calendar
Discuss your security, privacy or residency requirements with us, or review how the public site handles personal information.
Good-faith research
Report a vulnerability
Use the repository’s private GitHub Security Advisory form. Do not create a public issue. We target acknowledgement within two business days and triage within five business days.
Open private reporting form