Security
We build and run every GK Tools product ourselves, from the code to the servers. This page says plainly what protects you today, with the independent test results to back it up. If something here stops being true, we change the page.
Mozilla Observatory grades how well a website defends the people using it. SSL Labs grades the encrypted connection between your browser and our servers. A+ is the top grade on both.
Both tests are free and public: tap a grade to run the test again yourself. Observatory scores can go above 100 when a site does more than the test requires.
Most account break-ins start with a stolen or guessed password, so that is where we put the most locks.
Teams on Appoint Me can turn on an authenticator app, with recovery codes in case a phone is lost. Our own staff need an authenticator app every time they sign in to our support desk and to Appoint Me’s admin.
Appoint Me, GK Tools support desk
Invoicer has no passwords at all. You sign in with a code sent to your email, or with a passkey on your phone or computer.
Invoicer
After a few wrong tries, sign-in pauses for that account. Repeat attempts from one place are limited too.
Appoint Me, Invoicer, Gravity Host
Where there are passwords, we store only a scrambled form made by a slow, one-way method built to resist cracking. Nobody here can see what you typed.
Appoint Me, Gravity Host, GK Tools accounts
Everything travels encrypted, and the most sensitive details are encrypted again where they are stored.
Every product works over HTTPS only, and tells your browser never to connect without it. Each site also lists exactly which scripts may run on it, which blocks a common kind of attack.
Every product
Sensitive details are encrypted in the database itself: client intake forms and signatures on Appoint Me, bank details on Invoicer, and messages and contact details in our support desk.
Appoint Me, Invoicer, GK Tools support
Payments go through Stripe and other regulated payment companies. Your full card number never touches our servers; at most we keep the card type and last four digits so you can tell your cards apart.
Appoint Me, Invoicer, Gravity Host
A backup only counts if it can be put back.
Appoint Me’s databases and uploaded files are copied off its server every night. Each copy is restored as a test before it is kept, so we know it works before we ever need it.
Appoint Me
Those copies go into an encrypted archive that keeps a copy for each of the last 7 days, 4 weeks and 6 months.
Appoint Me
New security holes are found in software all the time. What matters is how quickly they are closed.
Every night, we check the software on our servers and in our products against public lists of known security holes, including the list of holes attackers are using right now.
Every product and server
Our rule: a critical hole, or one attackers are already using, is patched the night we find it, with a backup taken first so it can be undone.
Every product and server
If you think you have found a security problem in anything we make, email support@gk.tools with what you saw and where. We read every message.
When we need to send you a password, key or code, we send a one-time link instead.
The secret is encrypted on our side before it is saved, and the key to open it lives only in the link. The link works once and expires within a day unless we set an hour or a week.
share.gk.tools
For anything important we add a passcode and send it to you by a different route, so one intercepted message is not enough.
A real, registered UK company you can look up.
Last checked Wednesday 28 October 2026.
Machine translation by Google. The English version is the original.