Architecture and Security for Google Calendars

Overview

DayBack shows you your Google events using the Google Calendar API: it doesn't store your events in its own database, though some of the application settings also stored on DayBack's servers. This document describes the division of labor between DayBack and Google and which information is stored where.

Details

Security review

DayBack passed the thorough security review required of all AppExchange apps. In the case of Canvas Apps, this review also includes testing DayBack's servers, probing DayBack's configuration for injection vulnerabilities, and examining all traffic between dayback.com and Salesforce.

Where is my event data stored?

In everything that follows, we'll use the word "event" to mean any Google Calendar record showing on DayBack calendar: like an appointment. This could be a record from any of your Google Calendars or from any calendars shared with you that you can see when you log into Google.

Events are only stored in Google and don't pass through DayBack's servers on the way to being displayed on the calendar. DayBack uses the Google Calendar API to query Google. DayBack doesn't have an event database of its own or a shadow table of events on DayBack's servers. 

Does DayBack respect sharing rules from Google?

Yes. The API runs under the authentication of your Google credentials. So a DayBack user has no more and no less access to their Google calendars than when they're on Google's own calendar site. Users can see their own calendars and any calendars that have been shared with them. 

What is stored on DayBack's servers?

DayBack records your calendar settings on its own servers. This includes all the information in the "admin" side of DayBack:

This includes the "Calendar Sources" shown above as well as any settings changes in the "Admin Settings & Defaults" section: things like the default view, time increment, the start time of your view, etc.

DayBack also stores the names of your statuses and resources, your resource folder names, and your status colors

If you've created custom actions as part of customizing DayBack, the code for those actions is stored on DayBack's servers.

Finally, DayBack records the email address of each user who is authorized to use DayBack and actually uses the app. You may also have designated some users as  DayBack admins, and those email addresses are recorded as well. Note that only identifying aspects of the user are their name and email address. No passwords or other identification about the user is stored. Here is an example of the actual data recorded:

{
  "group" : {
    "id" : "sf-org-00D36000000ojIYEAY17381-23517tk"
  },
  "members" : {
    "1459229742595-1900723854" : {
      "account" : "[email protected]",
      "admin" : true,
      "id" : "1459229742595-1900723854",
      "userID" : "sf-005360000015SOJAA221107-29573tk"
    },
    "1459305409187-0976614575" : {
      "account" : "[email protected]",
      "admin" : false,
      "id" : "1459305409187-0976614575",
      "userID" : "sf-005360000015SOUAA2-1931-93222tk"
    },
    "1468520557325-2375843162" : {
      "account" : "[email protected]",
      "admin" : false,
      "id" : "1468520557325-2375843162",
      "userID" : "sf-005360000015SQZAA261098-2231tk"
    }
  },

Where are DayBack's servers?

The storage for dayback.com is on a  Firebase Cloud Firestore server in the United States. During DayBack's security review with Salesforce, the review team looked closely at all traffic between DayBack and the server to ensure all traffic was over wss (secured web sockets).

What about sharing?

The sharing feature in DayBack is explicitly designed to publish calendar data to folks outside Google Calendar. You can turn this capability off or restrict it to certain users. When you manually create a share is the only time event data can leave Google. Details on how this works and what data is actually published can be found here: sharing. Sharing is like exporting your event data: a share recipient has no access to your G Suite organization or calendars outside the events shared.

Still need help? Message Us Message Us