Solo workers live inside their tools — and get pitched a new one every week. Some are gold, some are abandoned, and some are just a name with a landing page. This is the vetting routine we run before any app gets our data, our card, or a place in our workflow: four questions, a sensitivity ladder that tells you how hard to apply them, and a worked example. It’s also the standard behind every review in our Tool Checks series.
First: how much vetting does this tool deserve?
Not every app needs an interrogation. Scale the routine to what you’re handing over:
| Tier 1 — browser toy | Runs on public input, no account (a converter, a calculator) | 60-second check |
| Tier 2 — account tool | Email, files, work content goes in | Full four questions |
| Tier 3 — money/client data | Card details, client files, invoicing, anything under NDA | Four questions, zero tolerance for missing answers |
The four questions, in order
1. Does it verifiably exist as a product?
Not a landing page — a product. Evidence looks like: app-store listings with review history (not just a score), documentation, a changelog that shows maintenance, pricing visible without a sales call. A surprising number of heavily-searched tool names fail this first gate: big reported search volumes in SEO tools, no verifiable product behind the name. When the chart and the footprint disagree, believe the footprint — our AutoDraft AI, TheTechnoTrick and sitemap-generator checks are all live specimens of that gap.
2. Who is accountable?
A company name, a team page, a jurisdiction, a working support channel — someone findable if things go wrong. Anonymous tools can be fine at Tier 1; they are never fine at Tier 3. The contrast pair from our own checks: Gauth AI (major named operator) versus the coined names above (nobody home). Same test, opposite results, and the results decide what you hand over.
3. What happens to your data — and your money?
Read the two boring pages. Privacy: does pasted content train models or get shared? For client work this can breach an NDA all by itself. Billing: monthly vs annual, the cancellation flow (test it before the card goes in), refund terms, and what happens to your data at cancellation — export formats matter most on the tools you’ll depend on longest, as our solo-practice EHR review shows at the extreme end. Freelancer rule: never annual-plan a tool you haven’t used weekly for a month.
4. What do independent users say?
Independent is the key word. Five near-identical “review” articles on multi-topic blogs is not five sources — it’s one strategy (see the trwho specimen). Real signal lives where users complain: Reddit, support forums, app-store one-star reviews (read those first). A tool with real users always has real complaints; a tool with only praise usually has only marketing. Ten-second version: search the name + “reddit” — arguments mean real, silence means synthetic.
Worked example: a new invoicing app
Suppose “InvoiceZen” pitches you. Tier 3 instantly — it wants client names and your bank details. Q1: app stores show a listing from last month, 11 reviews, no changelog — thin. Q2: no company page, support is a contact form — fail. That’s the routine finished at question two: whatever the features video promised, an unaccountable operator doesn’t get your client ledger. Compare a boring incumbent that passes all four: less exciting, still standing next year. Boring is a feature at Tier 3.
The red flags that end the check early
- Login requests for things that need no login (the downloader-category classic — see fbdown / indown)
- Claims that break the platform’s rules (“download private accounts”, “guaranteed returns” — the money version is the worst version)
- Pressure mechanics: countdown timers, “only 3 spots”, lifetime deals from operators younger than the deal
- No way to find who runs it, combined with any request for money or data
The 60-second version
Quick vet
Verifiable product ✓ · Named operator ✓ · Readable privacy + billing ✓ · Independent complaints exist ✓ — four ticks and it’s safe to trial at its tier. Any zero on the first two at Tier 2+, and the honest answer is: not with your business, whatever the search volume says.
FAQ
How do I check if an app is legit? Four questions: verifiable product footprint, named accountable operator, readable privacy and billing terms, and independent user discussion. Missing answers on the first two are disqualifying for anything sensitive.
What’s the fastest credibility test? Search the tool’s name plus “reddit” or a trusted forum — real products generate independent discussion and complaints; synthetic footprints generate silence.
Are unknown tools ever okay to use? Yes — at the throwaway tier: public inputs, no account, no payment. The vetting bar rises with what you hand over.