operate1 vs Cal.com
April 2026 has been bad for Cal.com. The production codebase is moving behind closed doors per implicator.ai, leaving only a stripped community fork (Cal.diy) under MIT, undermining the open-source pitch. NVD CVE-2026-23478 lists a critical authentication flaw in versions before 6.0.7, plus broken access controls reported by Gecko Security. operate1 is fully managed, on $19/mo Pro flat, with a security posture you don't have to patch yourself.
Try operate1 freePricing comparison
operate1
$19/month flat
All features included, whole account
Cal.com
Free self-hosted (community), $12-28/seat cloud
Varies by plan, as the vendor publishes it
operate1 is priced in US dollars, flat for the whole account. Cal.com publishes in the currency shown above, before any local tax. Where the currencies differ, convert at the rate on the day before you compare the totals.
Feature comparison
| Feature | operate1 | Cal.com |
|---|---|---|
| Hosting model | Fully managed, no devops | Self-host (community fork) or cloud |
| Open-source posture (April 2026) | Fully managed SaaS, transparent pricing | Production code moving closed-source per implicator.ai; only Cal.diy under MIT |
| Recent security event | No CVEs | CVE-2026-23478 critical auth flaw < 6.0.7; broken access controls per Gecko Security |
| 5-seat team annual cost | $190 (Pro annual, whole account) | $720 cloud Teams (5 × $12 × 12) |
| Built-in CRM | Profiles, notes, history, tags | Not included |
| Session packages | Auto-deduction on Pro | Not included |
| Customer-facing booking page polish | Polished for non-technical service teams | Developer-focused per Cal.com positioning |
| Pricing model | Flat per account | Per seat |
TL;DR: which should you choose?
Choose operate1 if you…
- Cal.com's April 2026 closed-source move (per implicator.ai/cal-com-goes-private-as-self-hosted-calendly-choices-narrow-in-2026) breaks the original open-source pitch. If that's why you chose Cal.com, the rationale just changed
- CVE-2026-23478 is a critical authentication flaw affecting Cal.com versions before 6.0.7. Managed SaaS means you don't run the patch yourself
- Your team is non-technical and the developer-first UX of Cal.com is friction, not a feature
- You sell packages, need a CRM, or want a branded micro-site, none of which Cal.com includes
- You want one flat $19/mo for the whole account instead of Cal.com Teams cloud at $12 per seat, which climbs with every hire
Choose Cal.com if you…
- You're a developer or developer-led team and you specifically want to embed scheduling primitives into another product
- You're committed to self-hosting and don't mind the post-April-2026 community fork (Cal.diy) trade-off
- Your security and ops team has the bandwidth to monitor CVEs and patch Cal.com installs themselves
- You don't need a CRM, packages, or a micro-site, just clean scheduling primitives
How to switch from Cal.com to operate1
Sign up for operate1
Set your working hours and buffers. Two minutes, and no devops. Calendar sync is not built, so availability lives in operate1 for now.
Recreate your event types
Copy meeting durations and availability windows across, and add each practitioner as a named staff member on the same flat account. Round-robin distribution is not built in operate1, so a round-robin event type has to become a per-staff choice at booking. Cal.com gates round-robin to Teams at $12 a seat.
Audit your security posture
If you were running a self-hosted Cal.com, verify your version against CVE-2026-23478 (NVD record) and the Gecko Security access-control disclosure before turning the instance off. Source: implicator.ai April 2026 reporting.
Switch the booking link
Replace cal.com/yourname with operate1.com/p/yourname on email signature, Linktree, and embed scripts. operate1 manages security patches, uptime, and updates, so you stop being on-call.
Frequently asked questions
What happened to Cal.com's open-source posture in April 2026?+
Per implicator.ai (https://www.implicator.ai/cal-com-goes-private-as-self-hosted-calendly-choices-narrow-in-2026/), Cal.com is moving production code behind closed doors, leaving only a stripped community edition (Cal.diy) under MIT with rewritten authentication, data-handling, and commercial systems kept private. If you chose Cal.com because of the open-source pitch, that pitch has materially changed. Worth a fresh evaluation.
What's CVE-2026-23478?+
NVD CVE-2026-23478 lists a critical authentication flaw affecting Cal.com versions before 6.0.7. Gecko Security separately reported broken access controls exposing bookings and enabling account takeover. Managed SaaS like operate1 means we patch on your behalf. You don't track CVEs and roll out updates to a self-hosted install. Source: nvd.nist.gov via the implicator.ai write-up.
I love Cal.com's API surface. Does operate1 have one?+
operate1 has API access on the Business tier at $49/mo. The current API surface is smaller than Cal.com's developer-first design. That's by intent, since operate1's ICP is non-technical service teams. If your reason for choosing Cal.com was the API depth and the embedded-scheduling-primitives use case, Cal.com is genuinely the better fit and we'll tell you that upfront.
How does the math compare for a 5-person team?+
Cal.com Teams cloud is $12/seat/mo, so a 5-person team is $60/mo or $720/year (and that's with the 25% annual discount applied, so gross is higher). operate1 Pro is $19/mo flat, $190/year for the whole account, and that number does not move as you add seats. The CRM, packages, and micro-site are included.
Can I export my Cal.com data and bring it to operate1?+
Cal.com self-host instances support a database export. Bring your event types and CSV-exported clients to operate1. Cloud-hosted Cal.com supports CSV exports of your client list. Historical bookings don't import cleanly across schemas; most teams archive read-only access for 30-60 days for lookup, then sunset.
What about the trial and cancellation terms?+
14-day free trial of Pro, then automatic conversion at $19/mo unless you cancel. Billing is monthly and cancellation is self-serve in the app, so the most you can ever be out of pocket while validating operate1 against your existing Cal.com workflow is one month.
Other tools people weigh against Cal.com
Each page below sets out the same feature grid, the price of both tools for a real team size, and the cases where the other tool is the better answer.