Confidential forms and reviewer fields

Form settings hold several separate controls. Set each one deliberately: who can fill in a form is a different question from who can read its answers.

Limit who can submit

In Form settings, Administrative capture only ("Only staff who manage this record or forms can submit.") keeps field workers from filling the form in. It suits an audit a manager must complete. On its own it doesn't make the answers confidential.

Protect confidential responses

Confidential responses ("Only administrators with View sensitive info can read responses and attachments.") restricts the answers and attachments to administrators who hold the sensitive-information permission. On the form it is called View sensitive info. In Users › Edit access the permission is called Read sensitive info.

• It is only offered when every kind of record the form attaches to is a Worker, a Job or a Vehicle, and the form's Purpose is Standard form.
• Switching it on turns a scored inspection into Record only, turns AI review off, and stops failed items raising issues. Private answers are never sent for AI review and never become issues.
• Photos from the stamp camera are never saved to the phone's own photos. See Stamped photos from Maliru's camera.
• Ordinary access to Forms, Users, a job or the Evidence vault doesn't open these answers. The protection covers opening files directly, exports and views from linked records.
• The "Form submitted" notification goes only to people who can read it, and says "A confidential submission is ready for review."

Use it for forms that really do collect private information. A form isn't sensitive just because it is about a person.

Corrections and downloads

• Allow submitters to correct their entries controls whether the person who submitted can use the 48-hour edit window. People who manage forms keep their own window either way: 7 days, unless the owner has chosen longer under Forms › Corrections.
• Allow users to export entries controls whether people other than forms managers can download the PDF.

Neither switch overrides confidentiality or a dedicated workflow such as expense approval. If Edit or Export is missing, check the form settings and your permissions before assuming the submission is missing. See Scheduling and filling in forms.

Reviewer fields and comments

Some forms carry reviewer fields: up to ten text or status fields that a manager fills in on the submission, separate from the worker's answers. They appear in a Review section on the submission, each with its current value, and Edit reviewer fields changes them. Each field can be visible to the submitter or kept for reviewers only, and can notify the submitter when it changes. A form can also allow Comments on its submissions ("Add a comment"), where the reviewers can be named with @.

The form builder can't add reviewer fields or switch on comments yet. You only see this section on a form that was set up with them.

A reviewer status such as Sent or Accepted isn't a payment record and doesn't change the job's status. Use the relevant workflow for those.

History stays with the form that was answered

Submissions and saved drafts keep the version of the form they were completed against. Later edits don't rewrite old answers or remove their confidentiality.

Records with confidential history are kept to protect them:

• A confidential submission can't be deleted.
• A form with confidential submissions can't be deleted: "This form has confidential records. Deactivate it to preserve their evidence protection." Switch Active off instead.

Sharing outside the workspace

Confidential forms and administrative-only forms can't go into a share pack. Nor can expense forms, or forms with People or record-picker fields. Use a form designed for the recipient's task. Don't remove confidentiality just to get a private form into a pack. See Sharing forms and documents outside your workspace.