Scheduling and Booking
Scheduling tools are among the cheapest software an organisation buys and among the most widely connected. A booking link is a public endpoint into your calendar, and the calendar is a detailed record of who you meet.
Reviewed August 9, 2026.
Two different products
Meeting scheduling. A link that shows your availability and books a slot. Individual, cheap, adopted person by person. For a related operational perspective, Monitask also publishes a reference on remote employee monitoring software.
Resource and appointment booking. Rooms, equipment, staff, clients — a system with capacity rules, and usually a business purchase.
They are sold in the same category and only the second is normally evaluated. The first spreads through an organisation without anybody reviewing anything, which is the more common risk.
For broader context, see Trello.
What calendar access means
The permission a scheduling tool asks for is broad.
Reading availability requires reading the calendar, and a calendar contains meeting titles, attendees, locations and frequently the agenda in the description.
Check what the tool actually stores against what it merely reads. Some read free-busy only; others ingest full event details, and the difference is substantial and is in the documentation rather than the marketing.
And check the connection method. An authorisation grant persists until revoked, which makes it the item most often left live after somebody leaves.
The outward-facing side
A booking page is public.
It can reveal your working hours, your time zone, your typical availability, and by inference your workload. For most people this is fine and it is a disclosure that should be deliberate.
What appears on the confirmation matters too — invitee names visible to others in a group booking, or a shared page listing who booked when.
And the data it collects. A booking form asking for a phone number and a reason for the meeting is collecting personal data from people outside your organisation, with the retention and lawful basis questions that follow.
What to check in this category specifically
Whether the tool reads free-busy or full event details.
Where booking data is stored and for how long, since it accumulates contact details of external people.
Whether individual staff can connect it themselves, which determines whether this is a decision or a discovery.
Export, which here means bookings, attendee details and history — modest in volume and easy to overlook.
And what happens on departure, since a booking link belonging to a former employee that still works is a live public endpoint.
The governance point
This is the category where shadow adoption is most likely.
A free personal tool, connected to a work calendar, by an individual, with no review. Multiply by twenty people and the organisation has twenty authorisation grants to systems nobody has assessed.
The practical response is not prohibition. It is choosing one, providing it, and auditing the grants — which requires knowing they exist, and most organisations have never looked.
The short version
- Two products in one category: individual meeting scheduling that spreads without review, and resource booking that gets evaluated
- Reading availability requires calendar access, and calendars contain titles, attendees, locations and agendas
- Check whether the tool reads free-busy only or ingests full event details — the difference is in the documentation, not the marketing
- A booking page is public and discloses working hours, time zone and by inference workload; booking forms collect personal data from outsiders
- Check storage and retention of booking data, whether staff can self-connect, export scope, and what happens to links when somebody leaves
- Shadow adoption is likeliest here; the response is providing one tool and auditing the authorisation grants, which requires knowing they exist