OpenSlot · Security & IT
Security & IT one-pager
Everything an IT or security reviewer usually asks, in one place: read-only permissions, nothing stored, one-click tenant-wide consent, and a standard Outlook add-in you can push to everyone from the Microsoft 365 admin center.
Permissions requested (all delegated, all read-only)
User.Read (the signed-in user's name/email), Calendars.Read and Calendars.Read.Shared (free/busy for the user and for colleagues whose availability your organization already lets them see), People.Read and User.ReadBasic.All (search colleagues by name — names and email addresses only), offline_access (stay signed in). None of these require admin consent by default, so individual employees can use OpenSlot on their own; admin consent is optional and removes the per-user prompt.
What is and isn't stored
Calendar data: nothing. Free/busy is requested from Microsoft Graph when the user clicks "Find free times", merged in memory, returned, and discarded. We never read event titles, bodies, attendees or attachments.
Stored: the user's email address, plan/billing status (Stripe customer id, status, renewal date), display preferences (timezone, hours, window), and for Team plans the email addresses the purchaser assigns seats to. Sign-in tokens live in an encrypted cookie (web) or an encrypted token in the add-in's own storage — never in a database.
Data flow and processors
Browser/Outlook → OpenSlot (hosted on Vercel, US) → Microsoft Graph. Billing by Stripe (we never see card numbers). Plan/preference records in Upstash Redis. No advertising trackers, no data sales. TLS everywhere.
Approve OpenSlot for your whole organization (one click)
A Global Administrator opens this link, signs in, and clicks Accept. From then on every employee can use OpenSlot with no consent prompt:
Link: https://login.microsoftonline.com/organizations/adminconsent?client_id=beeece1c-0b4d-4d25-b7dc-b6e3c261d275
If your tenant blocks user consent for third-party apps ("Need admin approval"), this is the fix. Consent can be revoked at any time in Entra → Enterprise applications → OpenSlot.
Deploy the Outlook add-in to everyone
Microsoft 365 admin center → Settings → Integrated apps → Upload custom apps → Office add-in → "Provide link to manifest file":
https://useopenslot.com/api/addin/manifest
Choose the users or groups, deploy. The "Insert free times" button appears in their Outlook compose toolbar (web, Windows, Mac, new Outlook) within a few hours.
Billing, seats and cancellation
Individuals: 14-day Pro trial, then Free or Pro ($7/user/month, or $72/year — $6/month). Teams: buy seats in checkout (volume pricing applied automatically: 5–24 seats $5, 25–99 $4, 100+ $3 per user/month; yearly $4/$3/$2), assign them by email on /team, change seat counts, switch monthly/yearly, download invoices, or cancel any time from Manage billing. Card, Apple/Google Pay and US bank debit accepted.
Self-hosting (regulated organizations)
OpenSlot can run entirely inside your own tenant (your Entra app, your Vercel or container platform, no external database) under a flat annual license. Email openslotadmin@gmail.com.
Contact
Security questions or a questionnaire to fill in: openslotadmin@gmail.com. See also Privacy and Terms. OpenSlot.