Calendar invites: Technical overview

Calendar invites let a host create a visit straight from their calendar, such as Outlook or Google Calendar. When the Systam invite address is added to a meeting, Systam Visit turns the other attendees into visitors and keeps the visit up to date when the meeting is changed or cancelled.

In short:

• Systam Visit receives the same meeting invitation your invited guests receive. The feature needs no permissions in your organization's environment. It doesn't matter where the invitation comes from: calendar invites work with Microsoft 365 and Google Workspace, for example.
• Only the subject, time and attendees are stored as a visit. The message body, location, online meeting link and attachments are removed right away and never stored.

Adding the invite address to a meeting

There are three ways to add the invite address to a meeting. All three lead to the same processing.

Invite addresses

• The general address invite@systam.io creates the visit in the organizer's primary workspace.
• Your organization's custom invite addresses can be tied to a specific workspace and visit type.
• A workspace or visit type specific address is accepted only if the organizer is a member of that workspace.
• All invite addresses end up in one invite mailbox managed by Systam. The organization and workspace are determined from the organizer and the invite address used.

How processing works

1. The organizer sends a meeting invitation with the invite address as an attendee.
2. Microsoft notifies Systam Visit of a new or changed meeting. The notification contains only the meeting's identifier, not its details.
3. Systam Visit fetches the meeting details from the invite mailbox and matches the organizer to a Systam Visit user by email address.
4. The other attendees become visitors and the visit is saved. Right after that, the meeting is cleared from the invite mailbox.

Systam Visit also checks the mailbox once an hour, so meetings whose notification never arrived still get processed.

Create, update and cancel

• A new meeting creates a visit. The visit name is the meeting subject, the time is the meeting's start and end time, the host is the organizer and the visitors are the other attendees.
• An updated meeting updates the same visit. An older version of the invitation never overwrites a newer one.
• A cancelled meeting cancels the visit. The visit status changes to removed, visitors and hosts are marked as removed and any access rights are revoked. Personal data is deleted according to your organization's retention period.
• A recurring meeting is handled as a series, so the series creates one visit.
• The same meeting never creates two visits, even if the invitation arrives several times.

Visitors

• Every attendee except the organizer becomes a visitor, including optional attendees.
• Duplicate and invalid addresses are skipped.
• The name comes from the attendee's display name. If there is none, it's derived from the email address and the host is asked to complete the details.

Excluding attendees

Exclusions are set in Systam Studio under Settings → Calendar invites → Calendar invitation recipient settings.

• Excluded domains: no visitors are created from these domains.
• Excluded email addresses: individual addresses, for example meeting rooms.
• Include hosts as visitors: off by default, so Systam Visit hosts aren't added as visitors. See Adding hosts as visitors in calendar invites.

The settings are applied in order. If a rule higher up excludes a person, the rules below it don't apply.

Exclude meeting rooms by email address. Rooms usually share the same domain as your employees, so excluding the domain would exclude them too. A domain works if your rooms have their own subdomain, such as rooms.company.com.

Notifications

• The organizer gets a confirmation for every visit created. This way they also notice a visit they didn't create themselves.
• If a visit can't be created, the organizer usually gets an error message (see below).
• Visitors get a pre-arrival message according to your organization's settings.
• Access control integrations such as ASSA ABLOY receive the visit details if they're in use.

When a visit isn't created

Data processed

Systam Visit reads only the meeting fields needed to create a visit.

Security

• Calendar invites need no application permissions or admin consent in your Microsoft 365 or Google Workspace environment. Systam Visit uses only Systam's own invite mailbox.
• Systam Visit uses only the calendar of the invite mailbox. It doesn't read email messages.
• The connection to Microsoft's API is secured, and notifications from Microsoft are verified before processing. All traffic is encrypted over HTTPS.
• The organizer's email address must exactly match an existing user's address, and the visit is created only in the organizer's own workspace.
• Names, email addresses, meeting subjects and message bodies are never written to logs.

Data minimization in the invite mailbox

• Right after the visit is saved, the meeting is cleared. The subject and body are replaced with fixed text, and attendees, location, online meeting details and attachments are removed.
• The meeting is cleared even when no visit is created.
• A cleared meeting keeps only the organizer, time and identifier until about an hour after the meeting ends. Then it's deleted completely. Cancelled and already ended meetings are deleted right away.

Data location and retention

Google Cloud encrypts stored data, and the database is reachable only over a private network.

Retention

What your IT needs to do

• Make sure users can send meeting invitations to addresses outside your organization.
• Make sure users' email addresses in Systam Visit match the addresses they send meeting invitations from (for example Outlook or Google Calendar). You can keep them in sync with Entra ID provisioning (SCIM) or maintain them in Systam Studio.
• If you use a custom invite address or meeting rooms, set up email forwarding.
• If needed, set excluded domains and addresses, and whether hosts are added as visitors.

Scope

This overview doesn't cover the calendar integration for Systam Rooms room bookings. The Rooms integration uses your organization's own Microsoft 365 credentials and needs separate permissions in your environment.

See also

• Invites by Systam add-in: Technical overview
• Create a custom calendar invitation address
• Adding hosts as visitors in calendar invites

That covers the technical core of calendar invites. Reach out if any part needs more detail for your environment.