Zoho Forms - Form Encryption

Zoho Forms now offers Form Encryption, which protects a form's data with an Access Code that only you set, so the data is unreadable without it.

• Setup is two steps: your organisation's super admin enables Form Encryption at the org level, then form admins set a six-character alphanumeric Access Code on individual forms.
• Anyone trying to access entries, reports, approvals, or tasks on an encrypted form is prompted for the code, and a successful entry keeps the session open for 30 minutes before it locks again.
• Encryption is permanent: once a form is encrypted the data stays encrypted, even if org-level encryption is later disabled, and it cannot be turned off at the form level.
• You cannot encrypt a form that already has records, so encryption must be configured on a fresh form before you collect responses.
• Notifications by email, SMS, WhatsApp, and mobile app are still sent but exclude form field data by default, while exports, attachment downloads, and scheduled mailers can be restricted by org and form permissions.
• Integrations and webhooks need deliberate permission at both org and form level, and the Zoho Sign field cannot be added to an encrypted form if integrations and webhooks are restricted.
• Form admins can email the Access Code to collaborators, and approvers can be notified with the code using the Notify Approvers with Access Code option.
• Entering the wrong code five times locks a user out, and form admins can view locked users and unlock them individually or all at once.
• Encrypted forms and HIPAA-enabled forms are mutually exclusive, so only one can be active on a given form.