Sensitive fields
Some answers should not sit in plain sight: Social Security numbers, tax IDs, passport and driver's licence numbers, bank account and routing numbers. Mark the question Sensitive in the builder and FormsUI keeps its answers out of view everywhere except where you deliberately ask to see them.
Marking a field sensitive
Tick Sensitive on the question in the form builder.
When you import a PDF, questions whose labels read as identity or financial numbers (SSN, social security, tax ID, ITIN, passport, driver's licence, account number, routing) are marked sensitive for you. Check the result: Check against the original PDF in the builder also flags a question that reads as sensitive but isn't marked.
What changes for the person filling it in
The answer is typed into a masked box, like a password, with an eye button to show it while they check what they typed. The field says it is stored encrypted and shown masked. Date questions keep their date picker even when sensitive, so a date of birth still gets a proper date.
The browser won't offer to autofill a sensitive field. And while FormsUI saves half-finished answers on the person's device so a closed tab doesn't lose their work, sensitive answers are never among them.
What changes for you
| Where | What you see |
|---|---|
| Submissions table, Preview column | Masked, showing the last four characters at most (•••6789) |
| Search | Only matches the masked preview, never the real value |
| View dialog | Masked, until you press Reveal sensitive values |
| New submission email | No answers at all, sensitive or otherwise |
| Downloaded PDF | The real value. See below |
Revealing a value
In a submission's View dialog, Reveal sensitive values reloads it with the real answers showing. The button only appears on forms that have a sensitive question.
Every reveal is logged with who revealed it, and which form and submission it was. Reveal when you need the value, not by habit.
Encryption
Every submission's full answers are stored encrypted. What the submissions list reads from is a separate preview, and a sensitive answer only ever reaches that preview in masked form, so listing, searching and paging through submissions never handles the real value.
PDFs
A submission's PDF is the complete document, sensitive answers included. That is what makes it useful as a record or to send for signature, and it means a downloaded PDF deserves the same care as the paper original. See PDFs of a submission.
Why sensitive fields can't be prefilled or preset
Two builder features put an answer into a form ahead of time, and neither is offered for a sensitive question.
| Feature | Why not |
|---|---|
| Prefilled links | A link gets forwarded and sits in inboxes. A value we encrypt at rest does not travel in one |
| Preset answers ("Same on every submission") | A preset is stored in the form itself and shown to everyone who opens it, which is exactly what an encrypted answer must never be |
Marking a question sensitive removes any preset it had. In the prefilled link dialog, sensitive questions are listed as ones that can't travel in a link.