Skip to content
Security

Your customers' data lives on your site. Nowhere else.

Booked runs on your own website, in your own database. There's no big shared Booked database with thousands of businesses' customers in it. So a problem at somebody else's salon can't reach your patients - there's nothing connecting the two.

See what that meansReport a concern
Card numbers stored50
Customer passwords that could leak3None
Uploaded documents kept encrypted4All of them
Staff-only screens locked to staff1Every one
Your WordPress site hardened by us10From £8/mo
The single most important fact

If another business using the same software gets hacked, do your customers get stolen too?

It sounds like a strange question. It's the one that matters most. Most booking apps keep every business's customer list together in one giant list on the software company's computers. Booked keeps yours on your own website.

Most booking software

One list. Everyone's customers in it.

Every business on the platform shares the same customer list on the software company's computers.

all-customers.db61,204 rows
Priya ShahGlow Salon
Tom ReillyRiverside Dental
Aisha KhanYour businessYou
Marcus BellFade District
Daniel OseiYour businessYou
Emma ClarkeMaison Lune
Sam PatelNorthgate Physio
Leah MorganYour businessYou
Jonah ReidFade District
+ 61,195 more, all in the same place
Attacker gets in through Glow Salon. They get the whole list.
Your customers: taken.It wasn't your business that got hacked. Didn't matter.
vs
Booked

Your list. On your website. Only there.

Each business keeps its own customers on its own website, locked down with Booked WP Security. Nothing is shared and nothing connects them.

glowsalon.co.uk
Their customers
Protected
yourbusiness.co.uk
Your customers
Protected
riversidedental.com
Their customers
Protected
Your customers: safe.There is no big list to get into. Each site is its own locked box.

Think of it like money. Most apps put every shop's takings in one shared safe. Booked gives each shop its own safe, in its own building.

So what does Booked itself keep? Your licence, your invoices and your support chats. Not your appointments, your customers, their documents or their answers. Those live on your website and never leave it.
How we protect the things that matter

Six things people worry about, and what actually happens.

Documents4

ID scans, referrals, images. Nothing in an upload can ever run, and nothing can be reached by guessing a link.

  • Encrypted before it's saved
  • Kept outside the public web folder
  • Only opened after a permission check
  • Every view is logged

Payments5

Your site never sees a card number. With Booked Payments the card goes straight into our secure card fields and never touches your database.

  • No card numbers, no security codes, ever
  • Only the brand and last four digits kept
  • A record of what the customer agreed to
  • 3-D Secure built in

Customer sign-in3

No passwords, so there are none to leak, reuse or phish. A link is emailed, works once, and expires.

  • Link dies after 15 minutes
  • Only a hash is stored - a stolen table can't sign anyone in
  • Same reply whether or not an email is on file
  • Rate-limited on its own

The booking form6

It has to work for strangers, so it's treated as hostile. Every public endpoint is throttled and every query is checked.

  • Per-visitor rate limits, separately per action
  • Every database query prepared6
  • Blocklist by email, phone or IP before a booking exists
  • Screening answers validated on the server

AI7

AI is part of the plugin - it comes with Booked, so there's nothing for you to sign up for, set up or look after. It's only used for the specific jobs we've built.

  • Nothing to set up or store on your site
  • Only does the jobs we built it for - writing a follow-up, matching a spreadsheet, drafting questions
  • Doesn't keep what it read or wrote, only that it ran

Health answers8

Answers to screening questions are treated as the sensitive data they are, from the moment they're typed.

  • Kept with full history, deleted with the customer
  • Never in a text preview or an email subject line
  • One button stops every message to a person
  • Only a country code stored, never an IP
Booked WP Security

Your customers live on your website. So we lock the website too.

Booked WP Security is a separate, additional plugin from us. It bulletproofs the WordPress site your customers live on - logins, firewall, updates, files, backups, monitoring - with every protection on its own switch. Turn on what you want.

£8per month · or £79 a year
Free on Business · add it at checkout or any time after
See Booked WP Security →Technical detail
Login lockdownTwo-step sign-in for staff, limited attempts, and a block on the usernames attackers try first.
Always up to dateWordPress, themes and plugins updated automatically, with a rollback if an update misbehaves.
Firewall at the front doorKnown attack patterns are stopped before they reach your site. Suspicious countries and networks can be blocked.
Daily scanEvery file checked against what it should be. Anything changed or added that shouldn't be is flagged the same day.
Off-site backupsA copy of your site and your customer list every day, kept somewhere separate, restorable in one click.
Watched around the clockUptime, certificate expiry and admin activity monitored. If something looks wrong, you and we hear about it.

By the numbers

Counted from the code that ships, not from a policy document. The small numbers take you to the detail.

100%of staff screens are locked to staff. Not most - all of them.1
20doors open to the public: the booking form, status page and checkout. Every other door needs a key.1
0ways to sneak instructions into the database through the form. Every request is checked first.6
1,000+checks on what comes in and goes out, so a dodgy name or note can't do anything.6
15 minis how long a sign-in link lasts. It works once, then it's dead.3
0card numbers stored, ever.5
0things to set up for AI. It's built in, and it doesn't keep what it reads.7
2letters is all we keep about where a visitor is - "GB", never their address.8
For your customers

If a patient asks "is my information safe?"

Here's what's true, in words you can repeat over the counter.

Download the one-page summary
"Where is my information kept?"On this business's own website, in its own database. Not in a big shared system with other businesses.
"Do you keep my card details?"No. The card goes straight into Booked Payments' secure fields. The business only ever sees the last four digits.
"What about the photo of my passport?"It's encrypted the moment it's saved, kept somewhere the internet can't reach, and only opened by staff who are allowed to. Every time it's opened is recorded.
"Will my health answers end up in a text?"Not in the part a stranger could see on a locked phone. And you can ask us to stop every message with one click.
"Can I see or delete what you hold?"Yes. Everything - appointments, answers, documents - can be exported for you, or deleted entirely.

What we're honest about

Security pages that only list wins aren't worth much. These are the limits, and what we're doing about them.

CoveredYour website itself needs looking after

Booked keeps your customers on your own site - so your site has to be kept solid too. That's what Booked WP Security is for: it locks the doors, keeps everything up to date and watches the site for you. £8 a month, free on Business, and we'll tell you plainly if a site isn't running it.

In progressPer-question consent records

Saved cards already record exactly what was agreed, when and from where. We're applying the same record to sensitive screening questions, so consent for health data is captured on its own terms.

PlannedNo badge on the wall yet

No ISO 27001, no SOC 2, no independent penetration test - yet. We've built carefully and we can show you how, but "designed well" isn't the same as "independently verified". A third-party test is next.

For the nerds

The same claims, with the detail.

Every small number above lands here. Open a section for what's actually in the code as of v1.40.0, written for whoever has to sign it off.

plugin v1.40.0 · db 55 · 224 REST routes
1

Permission checks on every route

All 224 REST routes under get-booked/v1 declare an explicit permission_callback. Exactly 20 are deliberately public: 14 in PublicController (the booking form), plus the status page, changelog, docs feed and checkout. Every other route resolves to a capability.

Managergb_manage_bookings · gb_manage_locations · gb_manage_employees · gb_manage_services · gb_manage_settings
Employeegb_access_staff_area · gb_manage_own_schedule · gb_view_own_bookings - scoped to their own diary
CSRFAdmin requests carry WordPress's X-WP-Nonce, so a logged-in admin can't be made to act by a third-party page
↑ back to the plain-English version
2

Isolation is architectural, not a policy

Booked is not multi-tenant. Each customer runs the plugin on their own WordPress install, their own hosting, their own MySQL database. There is no join between two customers' data because it's physically in different databases on different infrastructure. The platform (trybooked.co) stores licences, billing and support - never appointments, customers, documents or intake answers.

3

Passwordless portal

  • A sign-in link is emailed. The raw token exists only in that email.
  • The database stores a SHA-256 hash of it, so a copied table can't be used to sign in as anyone.
  • The link is single-use and lives 15 minutes. The session it becomes lives 30 days.
  • Sign-in has its own rate-limit bucket, separate from the booking limiter.
  • request_link() returns the same response whether or not the address is on file - otherwise it becomes a way to check which of your neighbours uses the pharmacy.
4

SecureStore for documents

Uploads never enter the WordPress media library, where anything under /wp-content/uploads/ is world-readable by URL forever. They go through SecureStore:

  • AES-256-GCM - authenticated encryption, so tampering is detectable, not just unreadable.
  • Stored outside the web root under a random on-disk name, with a deny-all .htaccess / web.config. The database holds only metadata and that name.
  • Refuses to store in plaintext if OpenSSL is unavailable. A failure is visible, not silent.
  • The key is read from a wp-config.php constant where set, so it can be kept out of the database; otherwise a 32-byte random key is generated per site.
  • On serve: capability check, MIME type sniffed from the file's actual bytes (not the uploader's claim), response type from an allowlist, X-Content-Type-Options: nosniff, and Content-Security-Policy: default-src 'none'; sandbox. Every view is logged.
5

Payments and PCI scope

No PAN and no CVV ever touch the plugin or its database. Card entry happens in Booked Payments' hosted fields, so the customer's site is almost entirely out of PCI scope. SCA / 3-D Secure is handled inside the payment flow.

payment_methods tablepayment-method id · brand · last 4 · expiry month / year
consent recordagreed_at · agreed_ip · agreed_text - what makes an off-session no-show charge defensible rather than a chargeback
settlementDirect charges to the merchant's own account. Refunds and disputes belong to the merchant, with the platform's ledger alongside.
6

The public form is treated as hostile

  • Per-IP rate limiting on all 14 public endpoints, in separate buckets - booking, availability, triage, progress, conversion, sign-in - so abuse of one can't lock out another.
  • 233 $wpdb->prepare() calls. Audited for unprepared queries containing user input: none. The handful of raw queries interpolate only table names or hardcoded literals such as status <> 'cancelled'.
  • 536 sanitisation calls on input, 502 escaping calls on output.
  • Blocklist by email, phone, IP or CIDR range, checked before a booking row is created.
  • Triage answers are validated server-side and issued a signed receipt token; they can't be altered between screening and booking.
7

How the built-in AI works

AI features are part of the plugin and run through the Booked platform - customers don't supply, store or configure any credentials. The customer site sends a structured request naming one of a fixed list of features ("draft these routing questions", "summarise this month") and the platform runs that feature. There is no path that forwards a free-form prompt, model name or token budget from a site, so the features can only do the jobs they were built for.

ai_usage tablefeature · model · input tokens · output tokens · cost in pence. No prompt text, no response text.
8

Special-category health data

  • Intake answers are stored per-customer with full history in customer_answers. A corrected date supersedes the old one; it doesn't erase it.
  • Deleting a customer deletes their answers. Answers are included in the subject-access export, with sensitive sections marked.
  • A discreet flow may not place an answer token in an email subject or the first 40 characters of an SMS - the portion a locked phone previews. Refused at save time and matched by token shape, so renaming a question can't slip past.
  • The staff stop control cancels queued runs, blocks re-enrolment, and is re-checked at the moment of sending.
  • Country detection stores only the ISO two-letter code, resolved locally against a shipped table. No IP address leaves the server or is stored.
9

Tamper resistance

Licences are Ed25519-signed grants verified against a public key baked into the plugin, so a hand-edited "active" row in the database is worthless. A signed manifest covers the enforcement files: patched code drops the site to unlicensed. Beyond protecting revenue, it means a site can't be quietly modified to bypass the security gates above.

↑ back to the top
10

Booked WP Security - what the companion plugin does

  • Two-factor authentication for all Booked roles; login attempts rate-limited per IP and per account; common attack usernames rejected outright; XML-RPC disabled.
  • Managed updates for core, themes and plugins with a pre-update snapshot and automatic rollback on a fatal error.
  • Request-level firewall blocking known injection and traversal patterns before WordPress loads, with optional country and ASN blocking.
  • Daily integrity scan of core and plugin files against known-good checksums; unexpected or modified files are quarantined and reported.
  • Daily encrypted off-site backup of files and database, retained 30 days, one-click restore.
  • Uptime, TLS expiry and admin-activity monitoring with alerts to the site owner and to Booked support.
↑ back to the top

A security concern? Tell us in the chat.

Open live chat and say "security". Our assistant answers straight away, logs it as a security report and alerts the team - who reply within 30 minutes, day or night, and stay with you until it's resolved.

Open live chat nowOr email security@trybooked.co