Uploaded Pictures in Notification Emails: Access Denied or Login Prompt After Recent Changes

Hello,

Recently, we saw a change with the pictures that are uploaded on all of our forms and the ability to access them from the emails that are sent out once forms are completed.

When anyone who gets the email tries to view or open any uploaded pictures, it either prompts them to login (they do not have an account) or gives them an error message like below:

This did not happen until the last 2-3 weeks. Was there an update or change in your system with pictures?

It seems to be occurring with all of our forms that have pictures uploaded and the emails we have programmed to be sent out when forms are submitted.

Thank you,

Seth

Hi Seth,

Yes, this behavior is related to an account privacy setting that controls access to uploaded files, which can cause recipients to see a Jotform login screen or an error when opening images from email notifications.

To allow anyone with the link to view uploaded pictures (without logging in), please do the following:

• Go to your Workspace page and click your Profile Picture/Avatar in the top-right corner.
• In the menu, click Settings to open your Account Settings page in a new tab.
• In the left menu, click the Security tab.
• In the Verification prompt, click Send Verification Code.
• Check the email associated with your Jotform account, copy the Verification Code, and enter it in the prompt (then click Verify if needed).
• Under the Privacy section, uncheck the option “Require Log-in to View Uploaded Files.”

Here’s the full guide for reference: https://www.jotform.com/help/673-how-to-unrequire-log-in-to-view-uploaded-files/

If that checkbox is grayed out and you can’t disable it, your account may be under required security settings (for example, HIPAA or KYC-verified accounts), and in that case the login requirement cannot be turned off. As a workaround, you can still share uploaded files by sharing access to your Tables/Inbox instead: https://www.jotform.com/help/1010-how-to-share-your-jotform-tables-and-collaborate/

If you’d like, you can share your account type (e.g., HIPAA or not) and a sample form URL, and I can help you confirm which case applies to you.

Thank you, I will try that setting options to fix the issue.

Seth

Hi Seth,

You're welcome. If you encounter any issues or need further assistance while adjusting the settings, feel free to reach out.

Give it a try and let us know how it goes.

Hello,

I noticed that the security settings for viewing uploaded files are grayed out. Can you tell me which form(s) we have that is causing this setting to be in place so we can adjust those security settings.

Thank you,

Seth

Hi Seth,

Thanks for reaching out to Jotform Support. I'm an AI assistant here to assist you.

Here’s how to do it:

1. Open your Workspace and go to Settings.
2. Check the Security section for the Require Log-in to View Uploaded Files option.
3. Review the forms that collect uploaded files and are connected to the submissions being shared, since that setting is controlled at the account level and can be affected by required security settings.

If the option is grayed out, it means your account has required security settings in place, such as HIPAA requirements or KYC User Verification. In that case, the setting cannot be turned off.

I do not have a way to identify a specific form from here that is causing the setting to be locked. If you want, you can share the form name or a screenshot of the form settings, and I can help you check it point by point.

Give it a try and let us know how it goes.

The option is grayed out. If a form is asking for the last 4 digits of a person's social security number, would that trigger those security setting to be in place?

Is there someone who could assist in finding out which form is causing this issue? We have over 80 forms, so it might take some time to find the one if you cannot help me identify the one or two that is causing the issue.

Thank you,

Seth

Hi Seth,

I checked your account and see that you've recently completed the KYC verification. This was required because one or more of your forms were found to be collecting sensitive data. Due to the completion of this verification, your account is now subject to a strict security framework. That's why the Require Login to View Uploaded Files can't be disabled.

This causes direct links to uploaded files to require login as the form owner before downloading them. This includes links in your email notifications and PDF templates. Even though links will not work without logging in, images uploaded will still show as images in your PDF document. As a workaround to receiving uploads through email, we can include file uploads as attachments in your email. Let me show you how to do that:

1. In Form Builder, click on the Settings tab in the navigation bar at the top.
2. Next, click on the Emails section on the left side panel, then click on the Edit button over your orange Notification Email.
3. Click on the Attachments tab and Enable the Send File Uploads as Attachments.
4. Then click on the green Save button and that's it.

That's it. To revert back to the previous behavior, you can remove the identity verification from your account in the Data Settings, but note that your form may be disabled should it be found to be collecting sensitive information in the future. If you need to identify which forms collect sensitive details that trigger this, let us know and we'll forward your request to the relevant team.

If you have any other use case, can you share a bit more about that so we can understand what you need and help you with the best workaround available?

Give it a try and let us know if you need any help.

Yes, please let me know which forms are collecting sensitive data that would trigger the issue.

I appreciate it!

Seth

Hi Seth,

I've forwarded your request to know which of your forms are collecting sensitive data to our relevant team. We'll circle back to this thread as soon as we hear from them.

Thank you!

Seth

Hi Seth,

The verification was required for your account because of your form titled TD Bank Depositor Authorization and to verify the legitimacy of your business.

Let us know if you have any other questions.

Thank you for providing that information about that specific form being the reason for the verification!

If we remove the sections of the form that has them enter their last 4 digits of their social, will that be enough to change our security settings, or will we also need to remove the section where they enter their home address too?

If we change the form to not ask for sensitive information (whether it be social AND address or just the social), what would we need to do to allow for peopl that receive the email to be able to view photos and files without having to login?

Appreciate your help with this!

Thank you,

Seth

Hi Seth,

To give general guidance, Personally Identifiable Information (PII) refers to any data that can be used to identify an individual. This includes, but is not limited to:

• National ID, passport numbers, or other government-issued identification
• Social Security Number (SSN)
• Financial information like bank account or bank statements

We suggest you review your forms based on this to see if there are any other sensitive information that you're collecting. Removing the verification before removing these can result in verification being required again. If you want to keep collecting PII, you can customize the Submission PDF to include the fields you want to share with your form fillers and attach it to the email. Let me show you how:

1. In Form Builder, in the orange navigation bar at the top of the page, click on Settings.

2. Then, in the menu on the left side of the page, click on Emails.

3. Now, hover your mouse over the Autoresponder Email and click on Edit.

4. Next, click on the Advanced tab, toggle on Attach PDF, and select the PDF file you created.

5. Now, scroll down, and then click on Save. 

Here's how it'll look like for your form fillers:

But if you don't want to collect Personal Identifiable Information (PII) anymore and want to disable log-in to view the files. Here's how:

1. In the top right corner of your Workspace page, click on your Avatar/Profile Image.

2. Then, in the Dropdown menu, click on Settings.

3. Go to the Data section in the Account Settings page.

4. Then, click on the Remove Verification button.

5. Next, in the Confirmation window that opens, click on Remove Verification.

That's it. Now you can change your privacy settings in Security:

Keep in mind that removing the verification would lead to additional security measures being applied to your account such as limiting the access to the forms including fields collecting PII and CAPTCHA being presented on forms during high activity.

Let us know if there's anything else we can help you with.