We are working with a third party vendor for SEO needs and they need access to HS forms but how do we provide them access without them being able to access and see all the form submission data.
@Vedant what kind of access? Are they needing to modify the forms? or just see the properties?
It is a little challenging to split a form out from the submission data, if they don’t have access to the CRM contacts, it should not allow them to see the individual submissions. I would create a test user to verify the permissions.
@Jnix284 thanks for your reply. They need access to setup forms on the pages they have created for us. They won’t be modifying the forms whatsoever.
@Vedant if they have access to the website tools, they can select a form from the list without editing it or viewing submissions. In fact I’m pretty sure that if they tried to edit it from the page editor, it would tell them access denied.
What it looks like will vary based on the template/theme they used, but it should just be a dropdown list.
@Jnix284 are you talking about allowing access to “Marketing Access” permission for them?
@Vedant I think this guide about user permissions for website tools will help, it goes through all of the available settings.
@Jnix284 thanks for sending that article. I did create a test user as per your instructions to see if we see any form submission data and I do see fields like names, emails and job title popping in the list even after viewing access to CRM contacts has been turned off. Refer to the screenshot below. Any suggestions would be greatly appreciated.
@Vedant it looks like the contact permission is not overwriting the website/forms permission, and I’m not sure that’s an easy fix.
I would add it to the ideas discussion here for the product team to review, because that does make it difficult to keep your data secure.
The bigger question is, do you trust the third party provider to build the pages without looking at your form submission data?
As a service provider, I have access to hundreds of portals, and the security of our customers data is very important, so whether I am a super admin or have restricted settings, if I am in the customer’s portal, I am doing the job that needs to be done and nothing else. I have no interest in our clients data and would never do something to break their trust.
Hopefully, you can have an open conversation with them about the work that needs to be done, and the access they’ve been given in a way that helps you find the same level of trust.
Thanks for the extended reply @Jnix284. This is the first time we are working with an agency so not quite sure how much we trust them. I’m going to add this to the ideas discussion in hopes of getting this fixed.
@Vedant happy to help, if you share the link back here I’ll upvote the idea and add additional feedback to help get the conversation going.
awesome, upvoted!