By default, when you use the File Upload question type, unique links are generated for the uploaded files to make sharing and using integrations easier. For organizations with high privacy requirements (such as HIPAA compliance), you may want to disable the ability to generate these links entirely.
Note! If you’ve been redirected to this page, it’s probably because you clicked a link to a file that is protected by the login-only privacy setting described on this page. To view the file, please contact the owner of the typeform or access the file from your Typeform account through the Responses tab.
How file access works by default
When a respondent uploads a file to your form, it is stored securely. However, a shareable link is generated if you use any of the following:
- Downloading a responses export file (CSV or XLSX).
- Sending responses (or partial responses) in a follow-up message.
- Sending responses to an integration.
- Sending responses to a webhook.
Note: These links are long and difficult to guess, but they do not require a Typeform login to view. This means that anyone with the link can access these uploaded files.
How to switch to login-only file access
To switch to login-only file access, please contact our Support team with the following information:
- Please disable the generation of public URLs for file uploads on my account.
- Optional: Please expire all previously generated public URLs so they are no longer accessible.
Important Considerations
- New vs. old data: Turning off access only affects future uploads. If you want to secure files that were uploaded in the past, you must explicitly ask Support to expire existing URLs.
- Integration Impact: If you rely on sending file links to other apps (like Slack or CRM tools) for non-logged-in users to view, those links will stop working. Your team will need to log into Typeform to view files.
What happens when you disable public URLs?
If you request to have this feature turned off, Typeform will no longer generate public links for new file uploads. Instead, any attempt to access a file via a generated link will redirect to an information page (this article) that explains these privacy settings and how to access the file securely.
How to access your files without public URLs
Even with public URLs disabled, you and your team members can still access all uploaded files securely by logging into your Typeform account:
To do this, log into your Typeform account, and head over to the Results panel and then click Responses.
Click on the file link under the File Upload response you want to download.
Alternatively, if you want to download all file uploads you can click Export responses.
Choose the File uploads only (.zip) option and click Export.