For a more detailed technical description please check out this documentation post -> Intake Architecture
Imagine a Mailbox Outside Your House
Think of Public Forms like a special mailbox:
- Anyone can drop a letter (a form submission) into it, even people who don’t live in your house (the Microsoft 365 tenant).
- But only you (your organization) can open the mailbox and read or process the letters.
Step-by-Step: What Happens When Someone Fills Out a Public Form?
1. Getting the Right Form
- When someone visits your public form, our system (running on Microsoft Azure) checks the instructions for that form.
- It also checks the latest information about what questions to ask—directly from your SharePoint, so it’s always up to date.
2. Filling Out the Form
- The user types in their answers.
- Before they can submit, we check they’re a real person (not a robot) using CAPTCHA.
3. Saving the Answers
- As soon as the form is submitted, the answers are sent straight into your SharePoint list—inside your Microsoft 365 tenant.
- The KWIZ system does not keep a copy of the answers. It’s like delivering the mail directly into your house, not storing it at the post office.
4. After Submission
- Your SharePoint can automatically send emails, trigger workflows, or update other systems—just like it does with any internal SharePoint form.
Security & Compliance Highlights
- Data Residency: All answers are stored directly in your SharePoint—inside your Microsoft 365 tenant and data region.
- No Vendor Storage: Public Forms acts as a secure “delivery service”—it does not store, process, or keep copies of submitted data outside your tenant.
- Up-to-Date Questions: Every time the form loads, it checks your SharePoint for the latest questions and options, keeping everything in sync and compliant.
- Privacy by Design: Only the minimum technical information (like form layout and column types) is temporarily processed by our secure Azure service; user data goes straight to your tenant.
- Secure by Default:
- All communication is over encrypted (HTTPS) channels.
- CAPTCHA defends against spam and bots.
- No persistent data outside your tenant, minimizing risk of data breach on our side.
- Regulatory Readiness:
- GDPR: Data never leaves your designated Microsoft 365 region; no personal data is stored outside your control.
- HIPAA: No health information is stored by us; all PHI remains in your tenant, supporting HIPAA compliance (you manage your own tenant’s compliance configuration).
Simple Data Flow
- User requests form →
- KWIZ fetches up-to-date form design from your SharePoint →
- User fills and submits →
- Data goes directly into your SharePoint list—never stored by us
- Your SharePoint can trigger notifications or workflows
Why Is This Safe?
- The KWIZ Public Forms service is like a secure mailman—it never opens, copies, or keeps your letters.
- Only your organization controls the mailbox (SharePoint list), and only you decide what happens to the data after it arrives.
If You Need More Details
We’re happy to provide a technical deep dive or compliance documentation—just reach out