Google, Microsoft Outlook (M365 + Exchange Online), Apple iCloud, GMX, WEB.DE, Posteo, mailbox.org, STRATO, Disroot and Infomaniak KSuite — all bidirectional — plus any iCal feed (read-only), all GDPR-compliant, all hosted in a German data centre. 4 more providers already on the roadmap.
Per provider: which auth method, which scopes, which sub-services, common combinations. So you know what you're getting before you click.
Google Calendar
Google Calendar is the most common source calendar for our users. We connect Workspace accounts (Google Workspace / G Suite) as well as personal Gmail accounts — both via OAuth 2.0, no admin rights needed on your end. Connection takes ~30 seconds; from then on, sync runs over Google's push-notifications webhook — typical latency seconds to a few minutes, backed by a 4-hour reconciliation job as safety net.
Setup flow
1On sign-in with Google you see the familiar Google consent screen — no detours.
2We receive an OAuth token, never your password. Tokens are encrypted at rest with ChaCha20-Poly1305.
3Want to connect two or more Google accounts? Works — each gets its own auth session.
Worth knowing: No contact, mail or Drive permissions — we don't request them. That's also Google's own guidance: scope minimisation is a precondition for verified-publisher status.
Microsoft Outlook
"Microsoft Outlook" is shorthand for: Microsoft 365 Business, Outlook.com (personal) and Exchange Online — hybrid tenants work through the same multi-tenant endpoint. All via the Microsoft Graph API — one endpoint, OAuth 2.0, no Outlook add-ins, no COM wrappers. Tenants with strict consent policy get a tenant-admin-consent link (see /en/it-admin/).
Setup flow
1Microsoft sign-in opens the standard consent screen for your tenant.
2You choose which of the connected calendars (default + sub-calendars) serves as source.
3Tenants with strict publisher policy: one click on the admin-consent link at /en/it-admin/, your Global Admin grants once.
Worth knowing: On-premises Exchange (self-hosted, without Microsoft 365): not directly supported — but via an iCal feed export you can wire up a read-only connection. Microsoft Publisher Verification is in progress (see roadmap).
Apple iCloud
Apple iCloud runs on CalDAV — there is no official OAuth API. Connection works via an app-specific password that you create at your Apple ID under "Sign-In & Security → App-Specific Passwords". iCloud requires 2FA for app-specific passwords, so you need to enable two-factor on your Apple ID once.
Setup flow
1At appleid.apple.com → create an app password (label "Kalender Sync").
2In our app: enter your Apple ID email + the generated password — we check CalDAV endpoint reachability immediately.
3Apple occasionally redirects to shard servers (caldav.icloud.com → p[NN]-caldav.icloud.com). We follow automatically.
Worth knowing: If you later revoke the app password, we detect it at the next sync cycle, pause affected sharings, and email you. Re-activation: create a new app password, enter it in the app — existing sharings pick up where they left off.
Infomaniak KSuite
Infomaniak KSuite is the Swiss suite alternative to Workspace/M365 — CH-hosted, privacy-focused. Calendar connection runs over the same CalDAV mechanism as Apple, with an app-specific password from your KSuite account.
Setup flow
1In KSuite → Security → create an application-specific password.
2In the Kalender Sync app: enter KSuite email + password.
3We use Infomaniak's official CalDAV endpoint — no unofficial workarounds.
Worth knowing: KSuite data stays in Switzerland (Infomaniak data centre). Our own server logs for the connection are kept on our servers in Germany (Hetzner). Relevant for compliance reviews — details at /en/it-admin/.
GMX
GMX is one of Germany's most-used personal email providers — and millions keep their calendar there. The connection runs over CalDAV with an app-specific password, just like Apple iCloud. Your private GMX calendar shows up next to your work calendar in a controlled way: busy-only by default, title + time or full details if you opt in.
Setup flow
1On account.gmx.net under "Login & Security", create an app-specific password (your regular GMX password will not work).
2In the Kalender Sync app: choose GMX, enter your GMX address + the app-specific password, hit "Test & connect".
3Changes are fetched every 5 minutes. GMX is included from the Basic plan.
Worth knowing: German provider meets German sync tool: GMX calendar data and our processing stay fully under GDPR — no US intermediary. The app-specific password can be revoked at GMX at any time, which ends access immediately.
WEB.DE
WEB.DE is, alongside GMX, one of Germany's biggest personal mail providers — for many households, the family calendar lives here. It connects via CalDAV with an app-specific password; after that, syncing with Google, Outlook or iCloud runs automatically, with the visibility level selectable per sync.
Setup flow
1In your WEB.DE settings under "Login & Security", create an app-specific password (your regular password will not work).
2In the Kalender Sync app: choose WEB.DE, enter your WEB.DE address + the app-specific password, hit "Test & connect".
3Changes are fetched every 5 minutes. WEB.DE is included from the Basic plan.
Worth knowing: As with GMX: data and processing stay fully under GDPR. The app-specific password can be deleted in your WEB.DE settings at any time — access ends immediately.
mailbox.org
mailbox.org is the Berlin-based business mail provider for people who want their communication to stay entirely in Germany. Its calendar connects via CalDAV and then runs like any other calendar: two-way sync with Google, Outlook, iCloud and more, visibility level selectable per sync.
Setup flow
1Create an app password in your mailbox.org settings (your regular password will not work), then choose mailbox.org in the Kalender Sync app and connect with address + app password.
2Pick the calendars and set sync direction + visibility level.
3mailbox.org is included from the Basic plan.
Worth knowing: German provider meets German sync tool: mailbox.org hosts in Berlin, Kalender Sync at Hetzner in Nuremberg — both sides are hosted in Germany. The simplest combination on the market for compliance reviews.
Posteo
Posteo is the ad-free, sustainable mail provider from Berlin, popular with privacy-conscious users. The Posteo calendar connects via CalDAV and then works like any other calendar: two-way sync with Google, Outlook, iCloud and more, with the visibility level chosen per sync.
Setup flow
1In the Kalender Sync app, choose Posteo and connect with your full Posteo address and password.
2If two-factor authentication is on, use the password Posteo provides for that.
3Pick the calendars, sync direction and visibility level. Posteo is included from the Basic plan.
Worth knowing: Posteo hosts in Germany, Kalender Sync at Hetzner in Nuremberg, so both sides stay in Germany. We store the password encrypted (ChaCha20-Poly1305) and use it only for calendar sync.
STRATO
Many freelancers and small businesses in Germany run their mailbox at STRATO, often on their own domain. The STRATO calendar (Webmail Premium or Business) connects via CalDAV and can then be synced with Google, Outlook or iCloud, one-way or both ways.
Setup flow
1In the Kalender Sync app, choose STRATO and connect with your mailbox address. At STRATO it's often on your own domain, not @strato.de.
2Use your normal mailbox password, not your STRATO customer password. No app password needed.
3Pick the calendars, sync direction and visibility level. STRATO is included from the Basic plan.
Worth knowing: STRATO only enables CalDAV in Webmail Premium and Business. If sign-in works but no calendars appear, it's almost always the plan; the app tells you so directly.
Disroot
Disroot runs a Nextcloud, Disroot Cloud. Its calendar connects via CalDAV and can then be synced with Google, Outlook or iCloud, in one or both directions.
Setup flow
1In Disroot Cloud, create an app password under Settings → Security. It's required with two-factor sign-in; without it your normal password works too.
2In the Kalender Sync app, choose Disroot and connect with your username without @disroot.org. The app already knows the server address.
3Pick the calendars, sync direction and visibility level. Disroot is included from the Basic plan.
Worth knowing: This connection works for Disroot only. Your own Nextcloud, or Nextcloud at another provider, can't be connected at the moment.
iCal feeds
For anything that doesn't speak OAuth or CalDAV: iCal feeds. Any calendar with a public or private ICS URL can serve as source — Calendly, Outlook Published Calendar, Notion, TickTick, university portals, membership systems. Read-only into Kalender Sync, but universal.
Setup flow
1In the source system, copy the iCal subscription URL (usually under "Share calendar → private link").
2Paste it into our app — we validate that the URL is a valid ICS feed.
3Refresh interval: every 5 minutes. Recurring events are expanded correctly.
Worth knowing: Security note: treat private iCal URLs like passwords — anyone with the URL has read access. The feed URL itself is stored in our database; only higher-risk secrets (OAuth tokens, CalDAV passwords) are encrypted at rest with ChaCha20-Poly1305.
🔄 Compatibility matrix
Every provider with every other
Bidirectional for the OAuth providers (Google, Outlook). Read-only when the source is an iCal feed.
Source ↓ / Target →
Google
Outlook
iCloud
KSuite
iCal
Google
—
✓
✓
✓
✕
Outlook
✓
—
✓
✓
✕
iCloud
✓
✓
—
✓
✕
KSuite
✓
✓
✓
—
✕
iCal
↪
↪
↪
↪
—
✓ bidirectional ·
↪ read-only (iCal feed as source) ·
✕ not possible (iCal feed is not writable)
⚖️ In comparison
What the non-EU alternatives don't ship
OneCal and CalendarBridge are technically solid, but based outside the EU and awkward for EU compliance reviews. The rows that come up in every sales conversation:
OAuth scopes per provider, sub-processors with location, DPA under GDPR Art. 28, Microsoft tenant-admin-consent link for strict tenants — all on one page, downloadable as PDF.
Can I also connect my calendars to an AI assistant?
Yes. Via our MCP server you connect Claude or ChatGPT to all granted calendars – detail level selectable per calendar, revocable any time. All details at kalender-sync.de/en/mcp.
Do I need admin access to connect calendars?
No. Google and Microsoft connect via OAuth — you only need your own account. For iCloud, KSuite, GMX, WEB.DE, mailbox.org, Posteo and Disroot, an app-specific password (with STRATO, the mailbox password) (which you create yourself in the provider settings) is enough. Exception: Microsoft tenants with strict consent policy need a one-time tenant-admin-consent — link at /en/it-admin/.
What permissions does Kalender Sync request?
Calendar and basic profile only. Google: calendar + calendar.events (read+write) plus OpenID Connect scopes (openid, email, profile). Microsoft: Calendars.ReadWrite + User.Read + offline_access plus the OpenID Connect scopes. No contacts, no email, no files. Scope minimisation is required for our Google verification.
Can I connect multiple accounts of the same provider?
Yes. You can connect e.g. two Google accounts and one Microsoft account at the same time. Each account is authenticated separately and has its own sharings. Common case: personal Gmail + Workspace + Outlook.com.
Does it work with personal Gmail the same way as Google Workspace?
Yes, both. Personal Gmail: individual OAuth consent. Google Workspace: if your admin has approved external OAuth apps in general, it works identically — otherwise a single Workspace admin consent is enough.
Do you support self-hosted Exchange (on-premises)?
Not directly — we use the Microsoft Graph API, which targets Microsoft 365 / Exchange Online. Workaround for on-prem Exchange: export your Outlook Published Calendar as an iCal feed and subscribe to it (read-only). True bidirectional support is on the roadmap, no fixed date.
How do I connect Apple iCloud if I have 2FA enabled?
Apple requires app-specific passwords exactly when 2FA is active — which is the default anyway. At your Apple ID → Sign-In & Security → App-Specific Passwords → create a new password with the label "Kalender Sync". Copy the password once, paste it into the app, done.
Are my credentials stored?
For Google and Microsoft: no — we use OAuth tokens, not your password. For iCloud, KSuite, GMX, WEB.DE and mailbox.org: app-specific passwords are stored authenticated-encrypted with ChaCha20-Poly1305 and are server-side readable only. All connections over TLS 1.3.
How fast is the sync?
Google and Microsoft: push-notification webhooks — typical latency seconds to a few minutes, backed by a 4-hour reconciliation job as safety net. Apple iCloud, KSuite, GMX, WEB.DE, mailbox.org (CalDAV) and iCal feeds: polled every 5 minutes. On provider throttling we fall back to longer intervals without pausing sharings.
What happens if a provider has a 1-hour outage?
We queue changes and retry with exponential backoff (3 attempts, 30s initial delay). Paused sharings reactivate automatically as soon as the provider responds again — no duplicated or lost events.
My provider isn't here. Can I suggest it?
Yes — at /en/roadmap/ you'll find the public voting board. Fastmail and more Nextcloud providers are in "Coming up"; for Proton Calendar we're looking at a read-only import, since Proton offers no third-party access. What you upvote there we see directly — voting is anonymous, but it weights the roadmap.
