Security & compliance

Forms keeps security settings in two places.

• Each form's settings: Access & Sharing sets who can respond, spam protection, anonymous responses and how long responses are kept, and Security & Compliance shows the form's sensitive fields and access log. See Form settings.
• Project-wide screens: Security & Compliance in the Forms sidebar holds Spam & Abuse, Data Protection & GDPR, Access Control and HIPAA Readiness. Responses → Retention & GDPR opens the same screen as Data Protection & GDPR.

The project-wide screens show every form's settings side by side, and their Configure buttons open the matching section of a form's settings.

Security & Compliance → Spam & Abuse lists every form with its protections: whether the honeypot and captcha are on, its rate limit, whether it flags or blocks duplicates (and over how many days), and how many of its responses are marked Spam. The figures across the top count the forms using each protection and the share of responses flagged as spam. Review responses opens the Response Inbox.

• Honeypot: a hidden field that bots fill in and people never see. Forms quietly drops those submissions. It's on for new forms.
• Captcha: a check respondents pass before submitting. It only works when captcha is set up for your deployment.
• Rate limit: the most submissions per hour from one network. Past it, respondents are asked to try again later.
• Duplicate detection: flags a repeat response as Needs review, or blocks it.

Forms doesn't mark responses as Spam on its own: you do, in the Response Inbox or with an automation. Analytics leaves Spam responses out. To change a form's protections, choose Configure in its row.

A retention period deletes a form's responses once they're older than a number of days. Set it for every form on Security & Compliance → Data Protection & GDPR, under Retention by form: type a whole number of days in a form's row, then press Enter or click away. It saves straight away. Leave it empty to keep responses until someone deletes them. Changing it needs a role that can edit forms.

Once a day, Forms permanently deletes responses and saved partials older than each form's period, along with their uploaded files. This needs scheduled jobs set up for your deployment.

The figures across the top count the forms with a retention period, the shortest one and the forms that are anonymous or have sensitive fields. Each row also shows the form's privacy settings, such as Anonymous, Sensitive fields or Policy ack. New forms can start with a retention period from Workspace settings.

To answer a request to see someone's data (GDPR right of access), go to Security & Compliance → Data Protection & GDPR and find Right of access. Type the Respondent email and choose Export data.

Forms downloads a JSON file with everything held about that email address, across every form you can export responses from, in any of your projects:

• Their responses, with sensitive answers readable
• Their saved partial responses and bookings
• Their payments
• Links to their uploaded files, which stop working after an hour
• Your team's comments on their responses

Forms finds data by the email address given with each response, so responses without an email can't be found. If nothing matches, it says "No data found". Exporting needs the Export responses permission, and each export is recorded in the activity log.

To answer a request to delete someone's data (GDPR right to erasure), go to Security & Compliance → Data Protection & GDPR and find Right to erasure.

1. Type the Respondent email.
2. Choose Erase data.
3. Read the warning, then choose Erase permanently.

Forms deletes every response, saved partial, booking and uploaded file submitted with that email address, across every form you can delete responses from. This can't be undone. Forms then says how many responses and partials it erased, and records the erasure in the activity log without the email address itself.

Erasing needs the Delete responses permission: Owner or Admin. The same tool is under Right to erasure (GDPR) in Workspace Settings.

An anonymous form doesn't store the respondent's IP hash, browser details or signed-in account with their response. Turn it on per form with Anonymous responses under Access & Sharing in the form's settings, or for every new form with Anonymous by default in Workspace Settings.

Anything respondents type into the form itself, such as an email address in an Email field, is still saved as an answer. To keep a form truly anonymous, don't ask for identifying details.

Security & Compliance → Access Control opens the project's roles and members, the same screen as Collaboration → Roles & Permissions. Use it to give each person the least access they need. The Collaboration guide covers roles and permissions.

Sign-in, single sign-on and passkeys aren't set in Forms: they come from your Geiger account and your organization's settings. Who can open and submit a form is set per form under Access & Sharing: anyone with the link, a password, signed-in accounts, one email domain or signed links only.

Security & Compliance → HIPAA Readiness helps you check the safeguards around forms that collect protected health information. It lists every form with fields marked sensitive, with how many it has, its access setting, its retention period (or Forever) and whether its email alerts send answers. The figures across the top count those forms, their sensitive fields, how many delete responses automatically and how many need sign-in. Configure opens a form's Security & Compliance settings, and Access log opens Activity & Audit.

The Safeguards checklist marks what's in place:

• Field-level encryption: whether encryption is set up for your deployment.
• Masking & reveal logging: sensitive answers are masked, and revealing, exporting or printing them is logged.
• Retention limits: whether every form with sensitive fields has a retention period.
• Least-privilege access: limit who can view, export or delete responses with roles.
• Keep PHI out of email: whether those forms send team alert emails.

Forms provides these controls but isn't a certified product. Compliance also depends on Business Associate Agreements with your hosting and email providers, and on your own processes.