Keep HighLevel as the source of truth
Update Records with Forms is built to move data safely between a HighLevel record and the person reviewing it – without becoming a second, shadow copy of your CRM.
Temporary access, not a CRM login
A generated form link gives controlled access to one specific form context. The recipient does not receive a HighLevel user account – the workflow decides which record, which fields are visible, which are read-only, which are editable, and which are required.
- Link Expiry is entered as a number of days.
- Decimals are allowed (for example, 0.5 days).
- Blank defaults to 7 days.
- Maximum is 3,650 days.
- Links can be configured as single-submit or multiple-submit.
1. What the service stores
Operational credentials and metadata required to operate the service – the minimum needed to authenticate to your HighLevel account, generate and validate form links, and route submissions back to the correct record.
2. What it does not persist
The service does not persist CRM field values or submitted form contents as a duplicate CRM database. HighLevel remains the single place your record data lives.
3. Secure record-specific links
Opaque secure tokens identify authorised form context – the link itself carries no readable reference to the underlying record.
4. Record IDs stay behind the form
The Record ID never appears in the public form or its URL. Recipients interact with a normal form, not a CRM identifier.
5. Credentials stay server-side
Account credentials and API access are handled server-side and are never exposed to the person filling out a form.
6. Protect against stale updates
If HighLevel reports that the underlying record changed after the form was opened, the submission is blocked rather than silently overwritten – this is a deliberate block, not "last save wins," and different-field concurrent edits are not assumed to merge automatically. The recipient can reload the form to try again, but will lose anything they'd already entered, and will see the updated details from HighLevel instead.
7. Account and location separation
Form generation and submission handling are scoped to the specific HighLevel account and location the workflow ran in.
8. Rate limiting and file safety
Form access and submission are rate limited, and uploaded files are handled defensively before being attached back to the record.
9. Link lifecycle
See Temporary access, not a CRM login above for the full expiry and submission-mode rules.
Give people a safe way to touch your CRM data
US$15/month after trial · 14-day free trial
Start 14-day free trial