Security

Last updated 4 November 2026. How to report a problem, and what this site already does to protect you.

Report a security problem

Email support@offerdeskcrm.com with "Security" in the subject. Tell us what you found, the page or address involved, and the steps to see it. A screenshot helps. We read every report and reply as soon as we can, and we will tell you when it is fixed.

While you look, please do not open or change data that is not yours, do not send spam or flood our forms, and give us a reasonable chance to fix a problem before you share it publicly. If you report in good faith and follow these rules, we will not treat your research as an attack.

There is no paid bounty. We will gladly credit you by name, if you want, once the fix is live.

What this site does today

• HTTPS everywhere. Every page is served over HTTPS, and browsers are told to refuse plain HTTP for this domain and its subdomains.
• A strict content policy. Pages may only load scripts and connect to this site and the few services named in our Privacy Policy, and no other site can frame them.
• Bot checks on forms. Every public form is checked with Cloudflare Turnstile on our server, along with a hidden field, a minimum fill time and rate limits.
• Keys stay on the server. The keys that reach our database are used only by our server and never sent to your browser.
• Ad tracking only with your yes. Meta tracking stays off until you choose to allow it.
• Call recordings are not kept. Audio you send for a call review is deleted as soon as it has been transcribed.

The CRM

The OfferDesk CRM at app.offerdeskcrm.com is covered by the same reporting address. How your data is handled there is set out in the CRM terms and the Privacy Policy.