topic Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data? in Lead Capture Tools

Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

MSchumacher — Fri, 19 Jan 2024 23:58:44 GMT

I have a form I use for new clients to submit information I need to prepare legal documents. The data I collect using this form is Personally Identifiable Information that is sensitive and should be private. I have the form set up so that when the form is submitted, I get an email notification, which I want.

However, the email I get contains the form data, including the sensitive and private information, which I don't want - obviously I don't want that information being displayed in an email that is sent to me. So how do I get notifications that a form has been submitted, without the email / notification including the sensitive data?

Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

Jnix284 — Sat, 20 Jan 2024 00:26:52 GMT

@MSchumacher I would highly recommend removing PII from your forms and request that information securely via other means, such as a secure form service.

It's not possible to omit fields from the form submission notification email.

This isn't legal advice as you're obviously more qualified than I am if you're preparing legal documents, but I wouldn't recommend that you store PII in their contact record within HubSpot.

There's another discussion in the community that offers a solution called Skyflow that integrates with HubSpot, I would start there to see if that might be a better option for you.

Hope this helps!

Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

MSchumacher — Sat, 20 Jan 2024 01:34:35 GMT

Thanks Jennifer. Just to clarify, I'm not an attorney, but I do collect sensitive information as part of the services I provide to clients and the documents I have to prepare in relation to those services. My workaround, which I'm going to test, is to turn off the automatic form submission notification and create a simple workflow automation that just sends an email with canned language in the body of the email. I'm hoping that doing it this way will still provide the alert, without the details.

Once I've tested it, I'll reply back to this thread with the results.

Thanks again for your advice.

Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

Jnix284 — Sat, 20 Jan 2024 01:37:41 GMT

@MSchumacher you're welcome!

If you're comfortable storing the data in HubSpot and you just don't want it in the email, turning off the default notifications and creating your own would be a good workaround.

You might also consider adding a few personalization tokens to your email in the workflow so you have some details about each submission without having the PII.

Looking forward to hearing how it goes once you've tested it out!

Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

Jnix284 — Thu, 16 Jan 2025 12:48:43 GMT

Since this was accepted as a solution new features have been added, so I want to share an update with @MSchumacher and anyone else who comes across this thread.

There is now an option to Store Sensitive Data in HubSpot with an Enterprise subscription for at least one tier.

Here is the updated recommendation related to forms if you are using the Sensitive Data feature:

Re: Form Submission Notification - Best Practice When the Form Contains Sensitive / Private Data?

MSchumacher — Fri, 21 Feb 2025 17:02:14 GMT

Hi Jennifer, thank you for the update on this functionality. I wanted to just come back to this to confirm that removing the automatic sending of the submission email notification, which was the problematic email containing the PII, and instead adding a simple automation workflow that sends an internal email notification without any details works as intended. I get notified when someone submits the form, but the automated email I created does not include any PII. I appreicate your help with this workflow.