To use this feature on individual forms, your organization's super admin must first enable Form Encryption at the organization level — similar to HIPAA compliance. This is a one-time setup that allows all forms in your organization to be encrypted.

Here are some key things to keep in mind:

• Access Code: Each encrypted form is protected by a unique access code you set. You and your collaborators must enter this code to view or manage the data.

• Org-level Control: Your organization's super admin must enable this feature for the organization first, before it can be used on individual forms.

• Data Access Control: To keep your form data secure, some features like notifications or data exports, that use form data, are restricted by default when a form is encrypted.

• Permanent Protection: Once a form's data is encrypted, it stays that way forever. It cannot be converted back to normal text within Zoho Forms.
  
  

Enabling Form Encryption at the Organization Level  

To enable Form Encryption for your organization:

1. On the forms listing page, under Setup, click Control Panel.

2. Click Form Encryption under Data Administration.

3. Click Enable Form Encryption to set it up for your organization.
   
   
   

4. In the pop-up, click Enable.
   
   

Form encryption is now enabled for your organization. You can view and edit the Data Access Permissions for your organization.

Enabling form encryption restricts data access for features like notifications, data export/download, integrations, and webhooks. You can modify these permissions later if needed. Learn more

With Org-level Form Encryption enabled, form admins can now configure encryption for individual forms. Learn more
You also have the option to disable Org-level Form Encryption later if needed. Learn more

Note: Form Encryption is available only in the Premium plan.

Enabling Form Encryption for Individual Forms 

To enable Form Encryption for your form:

1. In your form builder, navigate to Settings > Compliance  & Audit > Form Encryption.
   
   

   
   

2. Click Configure Form Encryption to proceed.

    

4. A configuration screen will appear. Read the instructions in the Encryption Details section and click Next.
   
   

5. Set a 6-character alphanumeric access code and confirm it to secure your form data in the Access Code Setup section. All users, including the form admin will need this code to view the encrypted data later. Learn more
   
   

Note:  Access code must be exactly 6 characters long and only alphanumeric characters are allowed.

5. In the Data Access Permissions section, you can choose to restrict or allow form data access for the listed features. Learn more
   
   

Note: If a feature is restricted at the organization level, you cannot enable it on your form. The checkbox for that feature will be disabled.

6. Click Enable Form Encryption to complete the encryption setup for your form.

Your form is now encrypted. This will secure your All Entries, Reports, Approvals and Tasks with an Access Code.

 Note:

1. You can add up to 100 fields in an encrypted form. Once the maximum field count of 100 is reached in an encrypted form, you cannot add/duplicate more fields or duplicate pages.
   
2. Form Encryption cannot be configured for HIPAA-enabled forms and vice-versa.
   
3. For encrypted forms, report permalinks are not available and cannot be shared publicly.
   
4. Form Encryption cannot be configured for a form that already has existing records. 
   

Disabling Org-Level Form Encryption    

If Org-level Form Encryption is enabled, the organization admin has the option to disable it anytime.

To disable Form Encryption for your organization:

1. On the forms listing page, navigate to Control Panel > Data Administration, then click Form Encryption. 

2. Click Disable.
   

   

3. In the pop-up, click Disable again to confirm.
   
   

Note:

1. When you disable organization-level encryption, you will no longer be able to encrypt new forms. However, any forms that were previously encrypted will remain encrypted.
   
2. A form once encrypted will remain permanently encrypted, even if you disable the organization-level encryption settings. It cannot be disabled from the form-level encryption settings either.

1. Click Enable.
   
   

2. In the pop-up, click Enable again to confirm.

            

Now, you can go ahead and configure form encryption for individual forms within the organization. 

• Notifications – Email, SMS, WhatsApp, Mobile App: Send notifications via email, SMS, Whatsapp or in Mobile app involving form data.

• Data Export/Download: Export the form data as PDF/CSV, use form data for scheduled reports and download the uploaded attachments.

• Integrations/Webhooks: Share form data via Integrations and Webhooks to other Zoho products or third parties.

If data access is allowed at org-level for a feature, it will continue to work normally for encrypted forms in the organization. If it's restricted, the feature will be either limited or disabled:

• Notifications will still be sent, but they will not contain any form data.

• Data Export/Download will be disabled. This means PDF/CSV export cannot be done, uploaded attachments can't be downloaded, and form data cannot be used for scheduled reports.

• Integrations/Webhooks cannot be configured for encrypted forms in the organization.
  
  

Organization admins can view and modify data access permissions. To modify these permissions for your organization:

1. Under Data Access Permissions, view the current permissions (either Allow or Restrict) for each feature.
   
   
   

2. Click Edit to modify the Data Access Permissions. 
   
   

3. In the pop-up, enable or disable the checkboxes to Allow or Restrict data access for each feature, then click Save.

4. A list of encrypted forms impacted by this change will appear. Click Yes, Proceed to finish editing the settings.

Restrictions on Active Integrations/Webhooks

You cannot restrict data access for Integrations/Webhooks at the organization level if they are already enabled on one or more forms. A list of these forms will be shown for your reference.

For a form with Integrations or Webhooks configured, you cannot configure form encryption if the data access for Integrations/Webhooks is restricted at the org-level. You must allow data access at org-level and then proceed for configuring encryption for the form. 

If Integrations/Webhooks are already configured in a form, their data access cannot be restricted later within both the org-level and form-level encryption settings. 

Note: If data access for a feature is restricted at the org-level, it will be restricted across all encrypted forms, even if allowed at the form-level. 

Data Access Permissions for Individual Forms  

Form admins can modify the data access permissions for their specific forms. To manage these permissions:

1. Under Data Access Permissions, view the current permissions (either Allow or Restrict) for the listed features.
   
   

Note:

1. If data access is restricted: Data Export/Download will be disabled in the form. Integrations/Webhooks cannot be configured later in the form. Notifications for the form will continue to work, but without form data.
   
2. If any listed feature is already restricted at org-level, it will be highlighted as Restricted at Org-level next to the feature.
   

2. Click Edit to modify the data access permissions.
   
   

Note: If a feature is already restricted at the organization level, its checkbox will be disabled, and you cannot enable it on your form. To proceed, first enable the respective org-level setting.

3. In the pop-up, enable or disable the checkboxes to Allow or Restrict form data access for each feature, then click Save.
   

Note:

1. While configuring or editing notifications, you cannot add more form fields if the form is encrypted and data access for Notifications is restricted.
   
2. If a form is encrypted and its data access is restricted for Data Export/Download, then Report Scheduler cannot be configured, enabled, or updated.

Let's quickly summarize the data access permissions for the features in the table below:

Note:

1. Data access permissions only affect the encrypted forms in the organization. For non-encrypted forms, these settings won't apply.
2. If data access for a feature is restricted at the form-level, it will be restricted for that form, even if allowed at the org-level.
   
3. Prefill, Edit Response, and PDF downloads of submitted and edited responses from the Thank You Page are always allowed to access form data, regardless of data access permissions.
4. Payment fields are exempt from data access restrictions. Form data mapped in payment fields will always be available for payment processing.
   
5. Zoho Sign field cannot be added to an encrypted form if data access for Integrations/Webhooks is restricted at the org-level or form-level.
   
6. Restricting data access for Integrations/Webhooks will prevent PostMessage Tracking from pushing form data to external sources. Allow data access at both the org-level and form-level to enable data push.

 Access Code 

Once a form is encrypted, its data (All Entries, Reports, Approvals and Tasks) is secured and requires an Access Code for viewing. This code is unique to each form, so even if you have multiple encrypted forms, each is independently protected. You should keep the code secure to protect your data from unauthorized access.  

 Using Access Code to View Encrypted Data 

1. When you attempt to view an encrypted form's entries, reports, or approval sections, a popup will appear and you'll be prompted to enter the Access Code.
   

   

2. Enter the correct access code and click Access Form Data to view.

Note: The Access Code unlocks the form data in your current browser session for a limited time (30 minutes). You won't need to re-enter it unless the browser session expires or you log out.

Forgot Access Code 

If you're the form owner or a collaborator and forget the access code, you can have it sent to your registered email address.

To receive the access code:

1. In your form builder, navigate to Settings > Compliance  & Audit > Form Encryption.

2. Click on the horizontal ellipsis.
   
   

3. Click Forgot Access Code.
   
   

4. In the pop-up, click Send Access Code.

5. You can now retreive the access code from your mailbox and use it to view your encrypted form data. 

Sharing Access Code 

Form admins can securely share the access code with collaborators, such as approvers or form users, via email.

• For Shared Users: For users with access to the form, you can send them the access code via a notification mail from Form Settings > Share. 
  

• For users with Modify Form or higher permissions, hover over their name and click Send Access Code.

• For users with the Submit Form role, the access code cannot be sent.
  

  
  

• For Approvers: When adding an approver in an encrypted form, you have an additional option named Notify Approvers with Access Code. This includes the code in the email notification they receive, allowing them to access the approvals section.

Managing Locked Users

When a user enters the access code incorrectly for 5 times, their access to the form data will be locked to prevent unauthorized attempts. The locked user must contact the form owner or collaborator to regain access. 

You can access the Locked Users list from the Form Encryption Settings. This shows all users whose access to form data is locked due to failed attempts, and you can unlock them individually or in bulk. 

To unlock users, a form owner or collaborator can follow these steps:

1. In your form builder, navigate to Settings > Compliance  & Audit > Form Encryption.

2. Click Locked users.

In the pop-up, locked users will be listed under the Users section.
            

• To unlock a single user: Hover over the user's name, click Unlock, click Yes in the confirmation pop-up.

• To unlock all users: Click Unlock All and click Yes in the pop-up.

Note:

1. If a form owner or collaborator gets locked out, they can follow the same steps listed above to unlock themselves.
2. An access code cannot be sent to an unconfirmed account. The form admin's account must also be confirmed to send the access code to other users.

Form Encryption in Zoho Forms provides top-notch security for your submissions, ensuring the stored data is readable only by authorized parties with the secret Access Code. It is specifically designed to help you meet strict data privacy standards when dealing with information like confidential records or personal identifiers.

By understanding and following the steps above, you can confidently use Form Encryption to secure your forms. Always remember to keep the Access Code safe and limited to the right people and make use of one of the strongest security features Zoho Forms has to offer in the right way.