Feedback Board Security Checklist for CRM and Help Desk

A feedback board looks harmless: ideas, votes, comments. But once it is connected to Salesforce, Intercom or your user list, it holds keys and copies of customer data that reach well beyond the board. That trade is often worth it, because synced data tells you who is asking for what. It also means the board deserves the same review as any other system with access to your CRM. This checklist covers what to look at: the integrations you have switched on, how API keys are scoped and rotated, which CRM fields get synced, least privilege for people and tools, webhooks, offboarding, and the questions to put to your vendor.

Before you connect a feedback board to a CRM, help desk or user list, list every integration and API key it holds, and give each key the narrowest scope and a rotation schedule. Sync only the fields you actually use to prioritize feedback (for example plan or account size, not contract documents or phone numbers). Limit admin roles, review webhooks and where they post, and have a written offboarding step that revokes keys and disconnects integrations when you stop using the tool. Then ask the vendor how keys are stored, what its logs show, and how fast it notifies customers after an incident.

Why a feedback board belongs in your security review

On its own, a feedback board collects a modest amount of identity data: the names, email addresses and account IDs of the people who post, vote and comment. Most teams treat it as a marketing or product tool and never put it on the list of systems that get a security review.

The picture changes once you connect it. A CRM sync copies account fields into the board so you can see which customers want what. A help desk integration lets the board read conversations and link them to requests. A user-list import pulls in your customer base. Each of these needs a key or an OAuth grant, and each key can usually read more than the board ever displays.

So the risk follows the connections, not the voting widget. If someone gets hold of a key the board stores, they reach whatever that key can reach in your CRM or help desk. That is why the checklist below spends most of its time on integrations, keys and synced fields, and less on the board itself.

What recent disclosures show

Several companies that used Canny, a feedback platform, have published notices about a security incident there. VRChat said Canny told it on 28 August 2026 that an unauthorized party had accessed one of Canny's internal systems; for affected feedback-site accounts, information likely accessed included usernames, public account images, email addresses, account IDs and activity dates, and VRChat disconnected its integrations and replaced the affected credentials. 21bitcoin said the access key for Canny's connection to its Intercom support system was stolen and used to read data from that system, and that it removed the connection and rotated related credentials. Anaconda said on 12 October that it rotated all credentials and integrations connected to Canny and discontinued its use.

The common thread for this checklist is the keys a board holds and what they can reach.

The checklist

1. Inventory integrations and keys

Start with a simple table of every integration the board has: CRM, help desk, chat, single sign-on for end users, Zapier-style automation tools and any user-list imports. For each one, record the API key or OAuth grant it uses, who owns it, and when it was created.

Check both sides. The board's settings show what it connects to, but your CRM and help desk admin panels show which apps hold grants into them. Anything on either list that nobody recognizes is the first thing to remove.

2. API key scope and rotation

Give every key the least it needs. Use read-only keys wherever the integration only reads, and issue one key per integration so you can revoke one without breaking the rest. Pick the narrowest scope the vendor offers, even if it takes a few extra minutes to set up.

Set a rotation schedule your team can actually keep, and add two triggers on top of it: rotate when someone who handled a key leaves, and rotate straight away when a vendor reports an incident. Keep keys out of shared docs, tickets and chat threads, where they tend to outlive everyone's memory of them.

3. Which CRM and help-desk fields get synced

Go through each Salesforce, HubSpot or Intercom sync and each user-list import field by field. Keep the fields that drive prioritization, such as plan, account tier or revenue band. Drop phone numbers, contract and notes fields, documents and any regulated data. If nobody filters or sorts by a field, it doesn't need to be on the board.

Re-check the mapping after any change to your CRM schema. Depending on the tool, new custom fields can get added to a sync automatically, and a field that was harmless last quarter may hold something sensitive now.

4. Least privilege for people and agents

Keep the number of board admins small, and give moderators a separate role that can tidy posts without touching integrations or keys. Review the list of admins and moderators every quarter.

Treat AI assistants and agents the same way. Agents connected over MCP or an API should get only the permissions a person grants them, and they belong on your integration inventory with an owner and a review date, like any other connected tool.

5. Webhooks

For each webhook, write down where it posts and what payload it carries. Make sure receivers verify the signature or shared secret, and that every endpoint uses HTTPS. Remove webhooks nobody uses. An old endpoint that still receives customer data is easy to forget.

6. Logging and monitoring

Find out whether you can see who or what used each key, and when. Check whether you get an alert when someone adds a new integration or changes an admin role. If the board can't show you this, your CRM or help desk logs may cover part of it, so know where to look before you need to.

7. Offboarding (people and the tool)

When a person leaves, remove their board admin access and rotate any keys they handled. When you retire the tool itself, revoke its keys and OAuth grants on your side (in the CRM and help desk), delete its webhooks, export what you need, and ask the vendor in writing to delete the rest. Disconnecting inside the board alone leaves the grants in place on the systems it connected to.

8. Incident plan

Decide now who rotates which keys within hours of a vendor notice, and in what order. Keep a short template ready for warning your users about targeted phishing, since email addresses and account details are what a board usually holds.

Questions to ask your feedback board vendor

Whether you are choosing a board or auditing the one you have, these questions show how a vendor thinks about the keys and data it holds. Ask them in writing and keep the answers with your integration inventory.

• How are API keys and integration tokens stored, and can they be scoped read-only?
• Can we see an access log per key/integration?
• Which fields does each integration sync, and can we limit them?
• How do offboarding and data deletion work, and is deletion confirmed in writing?
• How and how fast do you notify customers of an incident?
• Which subprocessors touch our data?

If a vendor can't tell you which fields an integration syncs, plan as if it syncs everything the key can read.

Where Feedjolt fits

Feedjolt is a feedback board with voting, a public roadmap and a changelog. Trade-off: fewer native integrations than Canny. There's no Jira, Salesforce or HubSpot connection today; it connects to Slack, Linear and ClickUp. Feedjolt's AI flags likely duplicates for a person to review, and agents work the board over MCP with the permissions a person grants.

FAQ

What data does a feedback board usually hold?

Usually names, email addresses, account IDs and activity dates for people who post, vote or comment. If it is connected to a CRM or help desk, it may also hold synced fields such as job title, company or plan, plus keys that can read from those systems. That second part is where most of the risk sits.

Which CRM fields should I sync to a feedback board?

Only the ones you use to weigh feedback, such as account tier or revenue band. Leave out contact details beyond email, contract data, notes and anything regulated. If nobody filters by a field, stop syncing it.

How often should I rotate feedback board API keys?

Rotate on a fixed schedule your team can keep, whenever someone with access leaves, and immediately if the vendor reports an incident. Keep a list of where each key is used so rotation does not break anything you forgot about.

What should I do when I stop using a feedback tool?

Revoke its API keys and OAuth grants in the connected systems (CRM, help desk, Slack), remove its webhooks, export what you need and ask the vendor to delete the rest in writing. Disconnecting on the vendor's side isn't enough. Revoke access on your side too.

What happened in the Canny security incident?

Several companies that used Canny have published their own notices. VRChat said Canny told it on 28 August 2026 that an unauthorized party had accessed one of Canny's internal systems, and that usernames, email addresses and account IDs for affected feedback-site accounts were likely accessed. 21bitcoin said a stolen key for its Intercom connection was used to read support-system data. Anaconda said it rotated credentials and stopped using Canny. Read each company's notice for its own scope.

What should I ask a feedback board vendor about security?

Ask how API keys and integration tokens are stored and scoped, whether you can see an access log for them, which fields each integration syncs and whether you can limit them, how offboarding and data deletion work, and how quickly they notify customers after an incident.

Want a feedback board with voting, a public roadmap and a changelog? See Feedjolt.