Security

Keep HighLevel as the source of truth

Update Records with Forms is built to move data safely between a HighLevel record and the person reviewing it – without becoming a second, shadow copy of your CRM.

Access lifecycle

Temporary access, not a CRM login

A generated form link gives controlled access to one specific form context. The recipient does not receive a HighLevel user account – the workflow decides which record, which fields are visible, which are read-only, which are editable, and which are required.

Every newly generated form link has an expiry. Once a link expires, it cannot be reactivated – generate a new link if access is needed again. There is no "no expiry" option and no manual per-link revoke feature.
  • Link Expiry is entered as a number of days.
  • Decimals are allowed (for example, 0.5 days).
  • Blank defaults to 7 days.
  • Maximum is 3,650 days.
  • Links can be configured as single-submit or multiple-submit.

1. What the service stores

Operational credentials and metadata required to operate the service – the minimum needed to authenticate to your HighLevel account, generate and validate form links, and route submissions back to the correct record.

2. What it does not persist

The service does not persist CRM field values or submitted form contents as a duplicate CRM database. HighLevel remains the single place your record data lives.

3. Secure record-specific links

Opaque secure tokens identify authorised form context – the link itself carries no readable reference to the underlying record.

4. Record IDs stay behind the form

The Record ID never appears in the public form or its URL. Recipients interact with a normal form, not a CRM identifier.

5. Credentials stay server-side

Account credentials and API access are handled server-side and are never exposed to the person filling out a form.

6. Protect against stale updates

If HighLevel reports that the underlying record changed after the form was opened, the submission is blocked rather than silently overwritten – this is a deliberate block, not "last save wins," and different-field concurrent edits are not assumed to merge automatically. The recipient can reload the form to try again, but will lose anything they'd already entered, and will see the updated details from HighLevel instead.

7. Account and location separation

Form generation and submission handling are scoped to the specific HighLevel account and location the workflow ran in.

8. Rate limiting and file safety

Form access and submission are rate limited, and uploaded files are handled defensively before being attached back to the record.

9. Link lifecycle

See Temporary access, not a CRM login above for the full expiry and submission-mode rules.

Give people a safe way to touch your CRM data

US$15/month after trial · 14-day free trial

Start 14-day free trial