Fetch short-lived Vault secrets on every new Cal.com booking without storing plaintext keys.
Rotate Vault secrets after booking completion so credentials cannot be reused.
Use Vault's transit engine to encrypt Cal.com attendee data at rest for compliance.