Who Can See Your Form Submissions?

Ask a small team who can read their form submissions and the honest answer is usually "everyone, and also two people who left". The mechanism is nearly always the same. Enquiries go to info@, info@ is a shared mailbox, the password has been passed around for three years, and CVs from the last hiring round sit in the same thread list as invoice questions.

Nobody chose that. It accumulated. But it means you cannot answer the two questions that matter after an incident: who could see this, and who did.

Separate by form before you separate by person

Role permissions are the second step. The first is noticing that your submissions are not one pile.

Job applications, support tickets, sales enquiries and supplier invoices have different audiences and different retention. Putting them in one inbox forces one access level across all of them, and that level is always the loosest one any single stream needs.

Split them at the destination, not just at the form. Applications land somewhere only the hiring group can open. Support goes where the support group can. Sales enquiries can be widely visible, because they usually contain nothing worse than a company name and a budget range, which is why they belong in a CRM pipeline rather than a mailbox. This split alone removes most of the exposure and costs one afternoon.

Three levels cover most teams

Elaborate permission matrices do not survive contact with a ten-person company. Three levels do.

See what is assigned to me. The default for anyone doing the work. They open the records they are handling and nothing else. Most people should stay here.

See everything in this workspace. For whoever runs that stream: a support lead, a hiring manager. Bounded by stream rather than by seniority.

Manage the form and export. Change fields, change notification recipients, download the data. This is the dangerous one, and it belongs to two or three people rather than to everyone with a senior title.

The distinction that matters is the last one. Reading a record is bounded. Exporting it creates a copy you no longer control.

Exports are the hole in every model

The moment someone downloads a CSV your access model stops applying. The file is in a downloads folder, then attached to an email, then in a cloud sync that keeps deleted files for another thirty days.

Restrict who can export, log every export with who, when and which filter, and ask what each one was for. Most are for a report a filtered view would answer, or a mail merge that should be a proper integration. The ones left over are usually legitimate and few.

If exports are unrestricted, your retention policy is also fiction, because those copies age on their own schedule.

Notifications route around your permissions

You can build a careful access model and undo it with one notification rule. An email notification to a personal address delivers submission content to someone with no account and no permission, and it keeps delivering after they change teams.

Audit the recipient list on every form twice a year. Look for personal addresses, distribution lists nobody maintains, and forwarding rules on shared mailboxes. Each of those is an access grant your permissions screen does not show.

Offboarding is the test

Everything above is theory until somebody leaves. The checklist that actually catches things:

• Revoke the account, rather than changing the password on a shared one.
• Remove them from notification recipients on every form, not only the ones you remember.
• Check for mail forwarding rules they set on shared mailboxes.
• Rotate any API key, webhook secret or embed token they had.
• Ask whether they hold exports on a personal device, and get the answer in writing.

If revoking access requires you to remember which of five tools they were in, that is the finding. Fewer places holding submissions is itself an access control.

Contractors and agencies

External access should be time-bound and scoped to one workspace from the day you grant it, because nobody remembers to remove it afterwards. Put the end date in a calendar at the same moment you create the account.

Agencies handling your lead forms frequently accumulate export rights and a copy of every enquiry you have ever received. That copy is yours in law and theirs in practice. Scope them to the stream they work on, and make the contract say what happens to their copies when the engagement ends.

The version that holds

One place holding submissions. Streams separated by workspace. Most people seeing only their own work. Exports restricted and logged. Notification recipients audited. Offboarding that takes one revocation instead of five.

In Instaform each stream lives in its own cubby with its own membership, so a hiring cubby and a support cubby do not share an audience, and access is removed in one place when someone leaves. The recruiting setup is the clearest example, because applications are the stream that most often ends up in the wrong inbox. The support tickets side works the same way for customer data.