Primary Menu ☰ Partners Sign In (888) 269-4246 Apply Now Security Policy Committed to protecting our customers and their data OnDeck is committed to resolving security vulnerabilities quickly and carefully. In order to protect our users and their data, we request that vulnerabilities be responsibly and confidentially reported to us so that we may investigate and respond accordingly. Vulnerabilities should not be announced until we have developed and rolled-out an update. Unpermitted Uses of OnDeck’s Website and Unpermitted Types of Security Research Intentionally harming the experience or usefulness of the service to others Causing, or attempting to cause, a Denial of Service (DoS) condition Accessing, or attempting to access, data or information that does not belong to you Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you If you are researching security issues, especially those which may compromise the privacy of others, please do so cautiously in order to respect our users’ privacy. When possible, you should conduct all vulnerability testing against non-production instances of our products to minimize the risk to data and services. Out of Scope Vulnerabilities We review security issues on a case-by-case basis. Here are some of the common low-risk issues that might not be considered serious security vulnerabilities by OnDeck: Flaws affecting the users due to out-of-date browsers and plugins Clickjacking on pages without sensitive content, authentication, or state changing actions Vulnerabilities dependent upon social engineering techniques Brute force protection on login page Logout cross-site request forgery Any physical attempts against OnDeck property or data centers Our Security Commitment For all security vulnerability reporters who follow this policy, OnDeck will attempt to do the following: Acknowledge the receipt of your report Investigate in a timely manner, confirming the potential vulnerability where possible Provide a plan and timeframe for addressing the vulnerability if appropriate Notify the vulnerability reporter when the vulnerability has been resolved Acknowledging Contribution OnDeck is pleased to recognize those who have helped make OnDeck services safer by finding and reporting security vulnerabilities according to this policy. Each name listed represents an individual or company who has privately disclosed one or more security vulnerabilities and worked with us to remediate the issue. With the agreement of the vulnerability reporter, OnDeck may acknowledge the reporter’s contribution during the public disclosure of the vulnerability so long as the reporter complies with this policy. OnDeck does not compensate for reporting security vulnerabilities. See OnDeck Security Researcher Acknowledgements Changes in Policy We may update or amend this policy at any time with or without notice to you. We encourage you to periodically review this page for the latest information on our privacy practices. Committed to resolving security vulnerabilities quickly and carefully. Careers Privacy Policy Security Policy Support Back to Top USA Canada Australia Facebook Twitter Linkedin Instagram Depending on the state where your business is located and other attributes of your business and the loan, your business loan may be issued by a member of the OnDeck family of companies or by Celtic Bank, a Utah-Chartered Industrial Bank, Member FDIC. Your loan agreement will identify the lender prior to your signing. Loans subject to lender approval. OnDeck® is a Registered Trademark. All rights reserved. 1400 Broadway, New York, New York.