How Public Forms Keeps Data Secure

Title
How Public Forms Keeps Data Secure
URL Name
How-Public-Forms-Keeps-Data-Secure

Question

How Public Forms Keeps Data Secure?

Answer

For a more detailed technical description please check out this documentation post -> Intake Architecture

Imagine a Mailbox Outside Your House

Think of Public Forms like a special mailbox:

  • Anyone can drop a letter (a form submission) into it, even people who don’t live in your house (the Microsoft 365 tenant).
  • But only you (your organization) can open the mailbox and read or process the letters.

Step-by-Step: What Happens When Someone Fills Out a Public Form?

1. Getting the Right Form

  • When someone visits your public form, our system (running on Microsoft Azure) checks the instructions for that form.
  • It also checks the latest information about what questions to ask—directly from your SharePoint, so it’s always up to date.

2. Filling Out the Form

  • The user types in their answers.
  • Before they can submit, we check they’re a real person (not a robot) using CAPTCHA.

3. Saving the Answers

  • As soon as the form is submitted, the answers are sent straight into your SharePoint list—inside your Microsoft 365 tenant.
  • The KWIZ system does not keep a copy of the answers. It’s like delivering the mail directly into your house, not storing it at the post office.

4. After Submission

  • Your SharePoint can automatically send emails, trigger workflows, or update other systems—just like it does with any internal SharePoint form.

Security & Compliance Highlights

  • Data Residency: All answers are stored directly in your SharePoint—inside your Microsoft 365 tenant and data region.
  • No Vendor Storage: Public Forms acts as a secure “delivery service”—it does not store, process, or keep copies of submitted data outside your tenant.
  • Up-to-Date Questions: Every time the form loads, it checks your SharePoint for the latest questions and options, keeping everything in sync and compliant.
  • Privacy by Design: Only the minimum technical information (like form layout and column types) is temporarily processed by our secure Azure service; user data goes straight to your tenant.
  • Secure by Default:
    • All communication is over encrypted (HTTPS) channels.
    • CAPTCHA defends against spam and bots.
    • No persistent data outside your tenant, minimizing risk of data breach on our side.
  • Regulatory Readiness:
    • GDPR: Data never leaves your designated Microsoft 365 region; no personal data is stored outside your control.
    • HIPAA: No health information is stored by us; all PHI remains in your tenant, supporting HIPAA compliance (you manage your own tenant’s compliance configuration).

Simple Data Flow

  1. User requests form →
  2. KWIZ fetches up-to-date form design from your SharePoint →
  3. User fills and submits →
  4. Data goes directly into your SharePoint list—never stored by us
  5. Your SharePoint can trigger notifications or workflows

Why Is This Safe?

  • The KWIZ Public Forms service is like a secure mailman—it never opens, copies, or keeps your letters.
  • Only your organization controls the mailbox (SharePoint list), and only you decide what happens to the data after it arrives.

If You Need More Details

We’re happy to provide a technical deep dive or compliance documentation—just reach out

 

Security, Compliance & Governance