I have a request to add a restricted field to a form that is only visible to select group of individuals. The forms are public documents and everyone who has access to the database is able to view the documents created by others. I added the field and restricted it’s visibility using a role in the ACL. As it may be used to record sensitive information, I am concerned that this may not be an adequate saeguard.
Will someone who replicates or makes a local copy of the database be able to modify the database and see the contents of the field? Will the field replicate to a local copy if you don’t have access to view it on the server copy?
Even without making a replica or local copy, anyone with reader access to the document can see the value of the field by looking at the document properties (right-click the document, choose Document Properties and go to the fields tab). Hiding a field isn’t a security measure.
Encryption of the field might be an option, but the need for keys and such might make it too cumbersome. Look into storing the field on a separate document that’s somehow linked to the main document.
Thanks for the responses. I will start out by making the field in question an encrypted field. As for storing the field on a separate document, can you provide more info on how I would go about that, or maybe an example in the sandbox that I could look at?