File uploads

What an upload question is for

Some answers cannot be typed. A grant applicant has accounts to submit. A tenant reporting damp has a photograph. A supplier questionnaire needs a certificate. A recruitment form needs a CV. In each case the alternative to an upload field is an email thread running alongside the survey, which is how attachments end up detached from the response they belong to.

An upload sits in the survey like any other question. It can be made required, it can be shown or hidden by conditional logic, and it can be given a question image and an inline heading like the rest of the palette. Put it behind a logic rule wherever it is only relevant to some respondents — asking everybody for a document that most of them do not have is a reliable way to lose them.

How storage and access actually work

The security model here is worth reading in detail, because "we store your files securely" is a claim every survey tool makes and few explain.

Why a 300-second signed URL rather than a permanent link

A permanent link to a file is a permanent credential. Once it exists it can be pasted into a ticket, forwarded, indexed, or left in a browser history on a shared machine, and it keeps working for as long as the file does. A signed URL inverts that: it is minted at the moment somebody with the right to see the file asks for it, and it expires on a five-minute clock whether or not it was used.

The trade-off is honest — a signed URL that you copy and come back to in an hour will not open. That is the intended behaviour. Reopen the response and a new link is issued.

Organisation isolation

Access is decided by which organisation owns the survey, and that decision is pinned server-side rather than taken from anything the browser sends. Roles inside the organisation are owner, admin and member, with the last owner protected from removal or demotion at database level so an account cannot be orphaned. Row-level security applies throughout the data model; the same defence-in-depth approach is described on the save and continue page, where partial responses live in a table with no policies at all.

Uploads in your results

Attachments show up where the rest of the answer does. Browsing individual responses one at a time gives you the upload in context with everything else that person said, which is usually how you want to read a case: photograph next to the description, certificate next to the claim it supports.

Two limits to plan around. First, an uploaded file is not something a chart can summarise — uploads are read, not aggregated. Second, a CSV export is a table of text, so build your survey to capture the facts you intend to count in countable questions and use the upload for evidence, not for data you will later need to total.

Asking for files without collecting too much

An upload field is the fastest way to acquire personal data you did not intend to hold. A photograph carries metadata. A bank statement carries a great deal more than the one figure you wanted. Under UK GDPR, data minimisation is not optional, so:

• Say in the question what you need and what you will do with it.
• Ask for the narrowest thing that answers the question — one page, not a whole file.
• Use conditional logic so only the respondents who need to upload are asked to.
• Clear test responses before publishing, so real files never sit alongside rubbish from a dry run.
• Decide a retention period and act on it. Nothing deletes itself on a schedule.

The UK GDPR page covers roles and the lawful-basis questions that come up in a DPIA, and the security page lists our sub-processors.

What it does not do

• No virus scanning of uploaded files.
• No CAPTCHA on the submission route — spam protection is a honeypot, a dwell-time floor and a per-minute rate limit, enforced by a database trigger.
• No automatic retention or expiry policy — deletion is a decision you make.
• The upload question does not capture a signature — there is a separate simple electronic signature question for that (see e-signatures), which is not a qualified signature (QES) — and there is no payment collection.
• No direct-to-cloud connector for Drive, Dropbox or SharePoint.

Related

See the full list of 16 question types for what else can sit alongside an upload, per-survey partner branding if you are collecting documents on behalf of another organisation, and the product overview for how the pieces connect.