Fast Processes, Safe Data: How Builders and Data Leaders Can Create Compliant Processes

  • FormAssembly
Fast Processes, Safe Data: How Builders and Data Leaders Can Create Compliant Processes

Webinar

Teams across your organization are launching forms, data intake processes, and workflows faster than ever. The challenge data leaders face is two-fold:

They need to enable teams to build data collection forms and automate processes that drive the business.

They also need to ensure those teams are using the right tools that enable secure data collection and handle sensitive customer data correctly.

In this session, we'll look at why the gap between process builders and data leaders keeps widening, what a shared model of policy-driven governance looks like, and how organizations are moving from catching noncompliant processes to proactively enabling compliance. You'll also get a first look at FormAssembly's rebuilt platform, showing how builders and data leaders work side by side to move fast without sacrificing compliance.

Learning outcomes:

  1. Understand where ungoverned data collection is creating hidden risk (shadow forms, email and spreadsheet intake, disconnected tools)
  2. Frame a "policy by default" approach where every new process inherits the right controls
  3. Understand the roles builders and data leaders each need to play
  4. See a live demo in FormAssembly's platform - as we do a hands on walk through of key secure data collection and process automation use cases that are secure by design, auditable, and compliant

Speakers

  1. Mackenzie Putici Webinar Moderator Future B2B
  2. Josh Strehle Director of Product Marketing FormAssembly
  3. David Scovetta Senior Director of Security and Compliance FormAssembly
Full Transcript Mackenzie Putici Hello, everyone, and welcome to today's webinar, Fast Processes, How Builders and Data Leaders Can Create Compliant Processes. Today's session is brought to you by FormAssembly and produced by SmartBrief. And my name is Mackenzie Pudice with SmartBrief, a future b to b company, and I'm excited to be your moderator for today's webinar. Now in this session, we will look at why the gap between process builders and data leaders keeps widening, what a shared model of policy driven governance looks like, and how organizations are moving from catching noncompliant processes to proactively enabling compliance. We're also gonna be privy to a first look at FormAssembly's rebuild platform, showing how builders and data leaders work side by side to move fast without sacrificing compliance. Obviously, exciting session ahead of us, and we have a lot to cover today. So I'm just gonna cover a little bit of housekeeping to make sure you all get the most out of this webinar, and then we'll get our speakers up here on stage. Alrighty. So first things first, introductions are always fantastic. I've noticed a lot of you introducing yourselves already in the chat. But if you're just joining us, just getting settled in here, feel free to look to the right hand side of your audience console, and you're gonna see a chat interface there. Feel free to give us a quick hi, hello, hola, bonjour, aloha, whatever greeting you like. Maybe let us know where you're tuning in from or something interesting you wanna see here today. We'd love to see what you're thinking, what you're feeling. So throughout the session today, feel free to pipe in in the chat here. Let us know, your thoughts, your feedback, hot takes, anything, as we go through this information. Stewart from Santa Barbara. Welcome. Welcome. We've got Greg in from Columbus, Ohio. We've got Colorado Springs. Recife, Brazil. We've got Illinois. We've got Oregon, California, Texas. Awesome. So keep those highs and lows coming in. The chat tab is also the perfect place to let us know if you have any technical issues during today's session. Hopefully, that is not the case. Touch wood. But if any video slides, audio, anything's not loading, not syncing up for you, first line of defense is a quick browser refresh. But if you're having persistent issues, just reach out there. Myself and Deanna, our webinar coordinator, running things here smoothly from the background, we'll be here to help. A couple other things you can consider to enhance your viewing experience. If you hover over your viewport, you will see a closed captions icon. You can toggle that on. If you're on a mobile device, there is a light mode that you can also enable, to pair down the console a little bit for smaller screen. Excuse me there. And there is a new button, a new feature called catch up. So if you're joining us late, if you get interrupted, you have to take a call or anything like that, you can hit that, and it'll just catch you up on the last ten minutes of what's going on, give you a quick summary. Alright. Aside from that, we are gonna be holding some time today for q and a. So feel free to put any and all questions in the q and a tab, and we'll do our best to answer those here in real time on the webinar. And then if you hop to the docs tab there in the middle, you've got the Salesforce flow blog. You've also got, link there to the FormAssembly enterprise grade data security at point of intake overview. There's a link to a video demo or booking a demo there. So definitely check those out, save them, bookmark them, book your demo, whatever you wanna do with that. But don't wait till the end and forget because no one will be happy about that. And then last bit of fun, we have a $250 Amazon gift card up for grabs. We're gonna draw that at the end of today's session. You do need to be live and present here on today's webinar to qualify for the prize as well as meet those price terms and conditions, which you can find linked in the docs tab there. Alright. I think we've covered it all. So please help me in welcoming to the stage our two fantastic presenters today, and those two are, David Scovetta, senior director of security and compliance for FormAssembly, as well as Josh Straley, who's the director of product marketing at FormAssembly. So, gentlemen, welcome up. Excited to have you here today. David Scovetta Thanks so much. I'm David Scobeda. I've been in the security and compliance space for about two decades now. I've been with FormAssembly for about four years, and I'm looking forward to chatting with everyone a bit more. Josh Strehle Yeah. My name is Josh Straley, director of product marketing here at FormAssembly. David and I started around the same time, actually. So I've been with FormAssembly for around four years, and I've been been working in the data collection space specifically around Salesforce for about six to eight years. I'm really excited to talk about some, some changes and updates to our platform today that I think solve some major problems that I'm seeing in the data collection space, and I can't wait to show it to you all. Happy that you're here. Happy to see the interest in the session. I guess I'm gonna go ahead and get things started. Forgive me while I share my screen. You know, I I mentioned, we've got some updates. What brings me here to talk to the… This audience today, and thank you Smart Brief for hosting today's session, is a problem that, I've seen developing, with organizations that are involved in secure and compliant data collection. Every organization, especially with the kind of great digitization… Oh, man. I I messed up that word. The great digitization that came after COVID, right, where we move so many processes online. Every organization is collecting data, digitally. And, you know, think about your web forms, think about your surveys, think about your, contact us forms. But also think about the long forms like student applications, those kind of things. Organizations in every industry are doing data collection. For those that are collecting sensitive information, personally identifiable information, personal health information, even all the way up to controlled and classified information at the federal government level, when they're doing data collection, it looks the same as other data collection. It is a simple form, right, often as the front end, and then there's a process behind it. But there is a lot of thought that needs to go into handling that data compliantly as it enters the organization and enters the tech stack. And businesses that run on data need to get that data fast. The problem is making sure their compliant processes are in that… Or in place for those processes to make sure that that data is being handled well, and compliantly. So that's the speed versus control problem that we're seeing develop. I'm really excited with the tools that we're going to talk about today, how we can bring some speed and control to organizations. And I brought David with me today as our, senior director of security compliance at FormAssembly to give his perspective of what it looks like to own partnership… Pardon me, to own policy as a compliance leader with the, people at an organization that actually own the processes. So we're gonna talk about the date… That today. It's a very interesting interplay, and then I'm gonna show you how FormAssembly is addressing that. So, to get started, everyone at your organization is building processes, but who is watching those processes come online? That's my my hook question as the, as the Instagram people would say or the TikTok people would say. Right? When it feels like so many new forms, new processes, when there's a new marketing campaign going out every week with an update to the website, how are you ensuring that the data they're collecting is being collected compliantly? Because as I mentioned earlier, that data collection doesn't just come through web forms. It comes through an email threads with customers or volunteers. It comes through in spreadsheets handed over from events, right, or from a field team. And it's all being managed through disconnected tools that at best are at least syncing one direction, but are at worst syncing in multiple directions with very little security compliance oversight or even an understanding of what the organization's strategy for data collection should be. So Mackenzie just launched a poll. Thank you, Mackenzie. I'd love to hear from the audience, you know, what's your data collection strategy or data collection situation looking like? I'd love to understand just, what the audience is feeling when it comes to, you know, like, how this is going for you. So where does it live in your organization? Is it a CRM connected platform? Is it a mix of tools and spreadsheets and emails? Or are you not sure? That is a valid question as well. So I think you probably saw that poll go up. I'd love to just get a sense before I move on of where your situation is for data collection. I'll give a couple moments before we close out that poll. And I've… If I had to guess, I would say that you're probably like most of the people that come to FormAssembly for some of our solutions, seeing a mix of of tools kind of like, that I represent on this slide. I think that's where most organizations are kind of stuck currently, but I do like to think that some consolidation, some some systematic processes are are coming out in the market place as well. I'm gonna go ahead and stop sharing. I believe, we can throw the poll results onto the screen. Okay. Alright. So, you know, for our next poll, I'll ask the audience to get your poll clicking fingers a little bit more warmed up. But across the board, if we do just percentages, you know, it looks like, yeah, we're seeing a mix of tools, spreadsheet, and email. And again, you know, this isn't to shame anyone. This is definitely the status quo at a lot of organizations. It is rare that, organizations feel like they have, you know, a really consistent data collection strategy that, spans their whole tech stack. So I still see some, some votes coming in. Would love to, just make sure we we get a representative sample as we say in data collection. But I'll go back into my my presentation now. Thank you, Mackenzie. So, you know, as I mentioned, we see this a lot at FormAssembly. So we see this problem start to form where when data collection is so messy. Right? When your processes live everywhere, when they're disconnected, when it feels like no one has oversight over the complete picture, that starts to paint a picture of risk especially when you're handling sensitive data. And A lot of organizations are collecting sensitive data without knowing it because they just don't have a clear strategy around minimizing the data they collect. So they might be accidentally collecting personally identifiable information more than they need for the processes they're supporting. And so they need to start paying attention to the information they're collecting because every intake process when it touches sensitive data is a chance to introduce risk to your organization. So you have to start asking things like the four questions on screen today. What is getting collected? Is it sensitive information? Is it necessary to power the process that it is being collected for? Right? What or pardon me, where is it being stored? Now this is definitely a question for the compliance leaders of the organization. It's important that they understand when you are collecting information from your audiences, where that data goes. Is it stuck in a system of record? Is it only being sent to a system of record and being deleted elsewhere? That's a good situation. Or is it being, like so many solutions, kind of stuck on the way? Is it being stored elsewhere? Is it being stored in several places, spreadsheets, another platform, and a CRM? That's when things start to get really hairy. Another question when it comes to sensitive information, who has access to it or who can see it? It's important for some compliance standards that you're able to prove who accessed information and when they access that information. That's something that we support here at FormAssembly, making sure that organizations have audit logs so that you… They understand who is touching sensitive information if they're collecting sensitive information. Think hospitals. Think patient intake. You need to understand who at your organization is touching information, and they need to have a justifiable reason as well. And then last but not least, how long it stays? Again, some compliance policies have a requirement around how long information is kept. Certain signatures need to be kept for a certain amount of time. And, some organizations have policies where they need to purge all data that's collected on certain intervals. That understanding is usually where I start to see a lot of people get, in over their depth is understanding, oh goodness. I am retaining more data than I really should, and I have no strategy around purging that information from my systems or even a function. I don't even have the capability to purge that information because it's in so many places. So as you can tell, it gets really sticky really quickly when you're collecting information. Another complexity to add here is that different teams at the organization have different incentives. We kinda look through a lens of, two personas here at FormAssembly, where we have the process owners, who I'm calling kind of the builders on this slide. These are the people who own the form, who build the process, maybe integrate the form to Salesforce. They might be a Salesforce admin. They might be a CRM admin at HubSpot or any other system, but they own the data collection process. And it's usually for a business, critical, you know, like, process. Something like customer information, new customer sign up, lead generation, volunteer generation, donation collection for nonprofits, or, you know, student applications for higher ed. It is important to the organization that they get that data in. And so those builders have deadlines. They have marketing campaigns as I mentioned earlier. They have, student sign up times, you know, in the spring and fall. They have things that they have to support. And so they are often in a rush, to build processes and to get that data into the system of record to power, you know, again, a sales process, get it to a sales team, etcetera. On the other side, further up the organization, we've got people like my own David Scavetta, which is why I brought him on the call. We call them these gatekeepers. These people who are ultimately responsible for the compliance standing of the organization. They're the ones submitting the findings for audits. They're the ones, you know, getting the results of pen tests. Right? And then responding to them. They need visibility control over data collection at an organization because data is such a risk surface because of all those reasons we talked about earlier. And, so often, they are… And I hate to say it, David. This isn't your… You know, the case with you. They're getting in the way of some business processes. Right? Because they need to review. They need to slow things down so they can make sure that we are handling, you know, our forms are GDPR compliant. Right? PHI is being handled compliantly. There's an audit thing. They… They're involved in procurement processes for software, making sure that those platforms are meeting our standards. Right? They are at odds oftentimes with the speed that the business need, and that creates come… Some friction. Where we see that friction is really in that review process, and that's what I'm gonna focus on today, but, obviously, you can see it in other ways as well. If you have a system where a compliance leader is trying to stay ahead of, you know, like a a process, they're often, you know, they've got a review queue. Right? Because they've got other things that they're doing. That review queue, as the rest of the business teams start to throw more onto the pile, right, it starts to grow. And then those reviews come late, either too late for the business… You know, marketing's missing milestones, campaigns are delayed for a week, a day or two, or… And this is the the scarier thing. Those reviews come after those processes are live. Right? And they find out later that perhaps, an opt in checkbox wasn't added. You know, perhaps, this… There's a, a a platform is being used for data collection that hasn't been audited. It's shadow IT. You know, those are the scary things that, start to be introduced when these two teams can't really work together in a single platform. And all of that, again, kind of comes down to speed versus control. And for a lot of organizations… And and thank you for launching that poll, McKinsey. For a lot of organizations, they're stuck in this reactive mode where, hey, the business needs are never gonna slow down and the compliance review queue is never gonna go down because you've got new processes coming online all the time. So you've always got that review queue going. So you're just taking it as it comes and you're always playing catch up. What I'd love to talk to you about today and what will, David and I will talk about next next is how you can shift from that reactive to a proactive framework. And I'd love to know, just audience, I see, some votes coming in. I think we're kind of neck and neck here. I'll give you a moment just to to, to vote a bit more. I'd love to know how you feel your organization is is, you know, functioning in this space. Are you more reactive? Are you proactive? Do you have policies in place? Are you able to be compliant by default? Let's give it a moment more to let some votes come in, and then, Mackenzie, I'll stop sharing my screen, and we'll, we'll get some results for the audience. Alright. Still neck and neck as those votes come in. And, I'm a I'm a bit surprised, to be honest with you. I see a lot of organizations, struggling to keep up with, compliance and security. And not just because of interoffice, you know, inter team friction or even team bandwidth. You know, changes to compliance standards continue to roll out. The federal government is rolling out standards, European Union rolling out standards, different deadlines for different sizes of organizations. It can feel like there's no way to be anything other than reactive, but I'm glad to see our audience feeling like they have some of those processes in place. That means you're a great audience for today's session because what I'm gonna show you is another tool in that tool belt to make sure that your teams are working well together and your compliance frameworks are proactive. I'll go ahead and take the screen back again. Thank you. And so to talk about what it looks like to kind of co own, you know, like, compliance and security compliance at an organization, I'm gonna bring David up to handle this next section. David and I work obviously on the same team here at FormAssembly, and he is my gatekeeper. He's, he and his team, handle audits and penetration testing and, all of the David Scovetta Great. Josh Strehle the good details of security compliance here at FormAssembly. And, you know, he's got a great viewpoint of just what it takes as a data and compliance leader to stay proactive at an organization. David, I'm gonna hand it over to you. David Scovetta Thanks so much, Josh. You know, you you nailed it earlier when you mentioned that, security and policy sometimes do have to be kind of at a friction point for, security controls and compliance management for just about any, organization. And it feels like the real goal there is to be prudent and practical and to focus on a few core things. So, where do you start? Well, I would say strong security governance really relies on two key pillars. These key pillars tend to be control and visibility. So you want the ability to decide who can access what, under what conditions, and then seeping down into more granular layers depending upon the tool or the platform you have. Visibility, the ability to see who actually can access what, under what conditions. So we're talking about things like user access logs, audit logs, and these all operate under the pillar of good security governance, strong policies. And, you know, one, one point that I would share as kind of just a rough example is Google Workspace. If you're a Microsoft three sixty five shop, very, similar principles. And I'm not here to sell either one. I'm just talking about more of the the principle side of things is that, the underlying framework is the policies, procedures, and standards that you have. But how do you actually set the guardrails for that, and how do you actually enforce what you have set in your policies? Well, in workspace, admins have control centrally. You have that degree of control and visibility where you can manage things through organizational units, you can manage DLP. Who can access what under what conditions, what can they see, what kind of information under, and where can they move it around to? They can allow list, different applications, different services. But regardless of the system you use, the principle is that these decisions really belong to the organization. They support the policy, and the… What's actually being enforced through guardrails is the control and the visibility that you have. And you… The key thing is that you really kind of want both, in any, in any tool or platform that you have. So when you're looking at the visibility, you're really looking at… To, I guess, to go a little more in-depth, you're looking at who can access, what files, and then that pairs back to your policies. So at the end of the day, you really wanna make it easy for your users to be compliant with your policies. You wanna make it easy for admins to have that layer of control and visibility over who can do what, who can see what, what types of data, what types of information they can manage and govern so that everything kind of lines up and orchestrates well so that, it's easy for you to enforce your policies, and you have insight and visibility into how your policies are enforced through the different tools and systems and applications that, your organization may be using on a day to day basis. Now I would say, what to expect, from any platform that's really kind of holding your data. Really, any any platform should be asking two questions. Do I have control over, the key functions that really support policy? So do I have control over who can access what data? Do I have control over what kind of data these people can access? And the second question is, do I have visibility into that? So, you know, is the tool governing the way I expect it to? Or are, the users able to access different files and systems and services, whatever the case may be? Kind of alluding back to the point that Josh had made earlier that security needs to be an enabler of business, not a friction point. Although, on the other hand, like it sometimes is, so you have to kind of find that sweet spot. And, you know, when you have controls without visibility, that leaves you guessing. When you have visibility without controls, that leaves you watching problems that you can't really do anything much about. And I would say these principles are really kind of the standards by which, a lot of our recent development has been guiding us, through some of our recent work, here at FormAssembly. Josh Strehle Yeah. You're you're teeing me up perfectly there, David. That is exactly, what we are hoping to provide now with this rebuild version of our platform. If you're familiar with FormAssembly, you probably know us from integrated data collection. Again, you know, a lot of our customers use us for collecting information from their audiences and passing that to a system of record, often Salesforce, but other CRMs like HubSpot as well. What we are layering on with our rebuild is compliance and policy governance, through a specific feature we call our policy library that allows people like David to set policies for their organization at the… In their form assembly account and then have those policies both respected while on a Gentec AI assistant builds form processes and workflows and a dashboard to let someone, again, like David or someone on his team, monitor the workflows that are active at their organizations and ensure that they are to policy, following all of the policy frameworks that they set up in the system. That's gonna be the the part of, my demo today. So I can't wait to show it to you. I've got a couple of screenshots here, but I'm gonna show you what that actually means to be able to have someone like David set policy inside of a platform and then have your builders build inside of those guardrails. It's really compelling, really exciting, and it's why I came, to talk to you today. You know, and the whole point of this is we want to grant confidence to both builders, gatekeepers, and the organization at large. Because as David mentioned, you have visibility without control, that's anxiety. Right? You're just seeing processes start to get out of comply… Out of policy, and then you've gotta go and track those down and make those changes. If you've got control, you can lock things down, but you don't necessarily know if you are slowing down business processes. Right? Are you, how many policy… Or how many processes are impacted by a policy change? All of that leads to people at the organization not communicating well, you know, having to rework policies. And so if we can get these teams, these builders and gatekeepers working in the same platform, we can see guidance while building, we see clear answers available to them, right from the start, and we see fewer reworks. And at the end of the day, a more efficient, more compliant organization. And for those of you that said that your organization is proactive, we help you be proactive not just, you know, when a policy goes live or or perhaps, you know, checking out data later in the the CRM or in the data lake, but from the very first time that data enters your system, from the very front end of your processes, you can be compliant, right from the start, right from the point of data collection. So I'm gonna stop, sharing slides, and I'm gonna get you inside of the rebuilt FormAssembly platform. For some of you, like my friend Greg on the call, this is not going to be, new. You've seen some glimpses of it. For those of you that haven't used FormAssembly or have used it in the past, what I'm gonna show you today is brand new. We are rolling this platform out for new customers starting this month. For existing customers like my friend Greg on the call, we'll be bringing this to your accounts, with more information at the end of the year and then into 2027. I can't wait to give it to you. So what we're looking at here is just the home page of FormAssembly. This is where, your organization's workflows live. And when we say workflow, what we really mean is a data collection process. Right? We're talking about, the student application forms. We're talking about lead generation forms. We're talking about patient referrals, patient intake, postoperative surveys. You know, we're talking about data collection. And it's not just the act of collection that happens on a digital form. It's also the process that lives behind that. And with this new platform, you know, we've really leaned into the agentic use of the platform. So we have a really capable AI assistant, by the name of Faye that can build very quickly for us. First, I'm gonna give you an example of a builder operating without some of these guardrails that we've been talking to about and alluding to. And so I'm gonna ask Faye here just to, build a quick, we'll say just a a contact us form. So I'll I'll submit this prompt, to Faye. Faye will open up our workflow builder and build a relatively simple form. You know, I I gave very little information in that prompt. So Faye has provided me with, I guess, you know, really the the bare bones of a, of a contact us form. You're looking for name, email address, the subject of the message that the person is trying to get in contact with your organization with, and then obviously the body of that message. And it's a relatively simple workflow here. Right? You can see that it is the form itself as well as you know, a thank you message. And I can easily, create a, an account. Pardon me. Always always bad to have typos during my demos. Count and contact in Salesforce, from this form. So, as I mentioned, a lot of our customers use this in conjunction with their CRM, and Faye is incredibly capable not just at building forms, but also looking at the schema. Let's see. I'm going to ask it to use my, test connection. Faye is clarifying which connection it should use because it's going to look at my different orgs schema before bringing that connector into this workflow. So it's actually gonna look at how my Salesforce organization is configured, how… What the rules are for creating accounts and contacts. It's gonna go back. It's gonna edit the form, and then it's going to build my, my workflow. Let's go ahead. I'm gonna tell it to build without checking. It looks looks like I might have, actually disconnected one of my test accounts. Forgive me for a live demo mistake there, but I think we're going to see, the build regardless. So you'll see that Faye has updated this contact us form because now it's asking for company name, which we would obviously need for a, an account. It's included… It's split up first name and last name, and it has here a two step Salesforce integration where it creates an account first, it pulls a record ID out of Salesforce as a variable, and then it passes that variable down here to the contact record. And it's including everything in the contact record from that form including, the record ID and also the description of their message there. So again, you know, this is something that people would normally spend 5 to 10 minutes on at least, possibly more. All of this accomplished in thirty seconds even when I lost a connection to my dev org there. And, again, this is all without guardrails. Right? My, my builder here is able to build kind of very friction free. Now I wanna show you what it looks like for someone, like David, to log in to the platform and actually start setting some policies. So I'm gonna go over here. I'm gonna go to the settings and form assembly. I'm gonna go to our compliance, settings, page. And here is one of these new features that we're including in the rebuild of our platform. We have a policy library that includes some standard policies, including blocking the collection of GDPR special category data, blocking collection of health information, requiring a CCPA privacy notice, requiring a GDPR privacy notice. These are kind of standard and we'll continue to add to the standard policy library. What is very interesting to me though is a capability that we're giving organizations called custom policies. Custom policies allow you to bring any policy, whether that be plain language disclosure on a form, whether that be a GDPR opt in, double opt in. Right? You know, just form specific policies or as complex as, always including a CRM connector when a form is collecting lead information. Right? We're giving you the opportunity to set policies on processes, not just forms, not just intake. I'm gonna go ahead and show you what a custom policy looks like. I have one here drafted. It's called a plain language disclosure, and I have in plain language, natural language as the as the, the AI companies like us to say. I've included what that means. And what that means for this rule is I want to explain at any form what data we're collecting and why we're collecting it to our form responder. This is a common compliance requirement for some organizations where they want to make very clear to their end customer that the responded on the form why they are asking for data on a form. So I'm gonna go ahead, save changes here. I'm gonna go ahead and turn that on. There, it is going to have a very robust change to the form that we were creating earlier. I'm gonna prompt Faye without going back to my workflow, update my form to match my current policies. And you saw that, you know, I'm I'm an admin in this account, and this is a test account. But you saw that warning sign. Right? Because when I turn on this policy, it is going to be enforced for all users on my account. So Faye is jumping into my current form, then it's adding to disclosure and help text. So we're gonna go ahead and let it, move here. And I'm gonna go ahead and move back to my work flow, and we're gonna take a look at this. Let me go ahead and refresh here. It looks like maybe it did not add this to this policy. Update, my contact us form to match my plain language policy. And I may be moving a bit fast for, Faye here as it enforces it, but this is going to have, some pretty substantive changes to the form. Right? As you can see, without needing to bring the plain language disclosure to the form in a copy and paste format myself, this has been applied. We now have a how we use your information section at the top of the form. And with each of the form fields, we include why what… Why we ask for that specific field. We collect your first name so we can address you properly when we respond to your request. We collect your company names. We can route your request to the right people and respond to you. So this is without the builder needing to know the policy, to know the, you know, the specific field reasons for this disclosure, without even needing to understand the policy at all, I'm able to build forms that respect my organization's policy. And as I mentioned, this is not the only application for this policy enforcement. You can also make changes to processes. I could require that any form that has a certain type of information also send a response, PDF, like a a document of their form submission back to, the respondent. We can enforce process or policy on process, not just forms. And so that's really exciting, especially for organizations that are looking to scale data collection processes while also support their compliance frameworks. This is a way for people like David, you know, your your security and compliance leaders to set policy in one place and have your builders be building against it. Now, that policy obviously was, used by and built with, the agentic AI assistant. But, of course, I could, build a form that doesn't… Manually, I could build a form that doesn't meet these requirements. Right? I could delete this field itself. Right? And not include the plain language disclosure as the builder. Maybe I found that a little grotesque. Right? It was a lot of text. Maybe I didn't want it on my form. I'm gonna go ahead and try to publish my form and, you'll see that it's been submitted for review. I'm gonna show you the other side. So we just saw how you can enforce policy through, custom policy and standard policies here at FormAssembly. We also have the capability to turn on, review requirements. So this is called a review gate here. And I've turned that on. And now anytime someone tries to publish a form or workflow in my FormAssembly account, there's a review process. I can turn on AI assisted review and ask for Faye to review, these workflows. And if there are no policy infringements, those policy… Or pardon me, those processes can go live. I can also add several stages of review. So perhaps every form needs to go through a marketing review and then a security and compliance review. Right? Perhaps that those reviews need to be, different depending on the organization or the the department. I can configure that here. So that review gate and this control allows me to put that, you know, a heavy guardrail. Right? A little bit more friction to the process, making sure that these processes are reviewed before they go out. Let me show you what the visibility component of this is. So here we now have a workflow status dashboard on a compliance tab. This is for the compliance leaders or the compliance teams in an organization. This is where they would review the workflows at their org. So I'm gonna show you what that looks like. So, contact request for email notification. You know, I I have these, a lot of processes, for review here inside of my test org. When a process comes up and it is, you know, like, needs review, I, as a reviewer, can go in. I can see if there are issues detected. This form, it looks like, has no issues. So I can go ahead and approve that here or block it if it's not meeting my policies. So this is allowing the security compliance persona to come into and use the form assembly policy to enforce the policies that they need to support. It also gives them that visibility. Hey. Here's the 192 active workflows I have. I've got 34 in review. We're seeing that review queue start to back up. Obviously, I need to work through this a little bit. And then I've got no workflows out of compliance. One thing that I wanna call your attention to, and it's a really cool feature. When you make changes to your policies in that policy dashboard that we saw on the back part… Pardon me, the, where you set your policies. When you make new policies or you change policies, any workflows that, may be out of compliance will be thrown into the needs attention category. So if you have just recently rolled out a new policy at your organization that we always ask for first name in addition to last name, not a combined first name last name field. Right? Just name. This will trigger review for all workflows that are collecting information in a way that violates policy. So it allows you to, go back and make changes to, to your processes based on changes to your compliance policy. So if any of you are supporting some of those policies like GDPR, like CCPA, like, ADA compliant forms, you'll know that those policy deadlines keep changing. The policy requirements change year after year. It can be a project and a half to go through, review your workflows that are out in, you know, published, and then make sure that they're meeting your compliance. This is a way for your team to move through that project much faster. And, of course, I mentioned earlier, you know, when your security compliance team needs to prove your compliance, They're going to run through audits. Right? They're going to need access to information that proves that you are enforcing compliance when policies went live. We have a audit trail specific to the compliance policies on your platform that show you these events that actually are around workflows being, you know, like, approved or blocked and when policy changes are made as well. All of this downloadable from a simple CSV, really empowering the teams that are in charge of these processes. So, that's the end of my demo today. I'm happy to take some questions from the team. I hope I'm making clear, how we are enabling the security and compliance teams and the builders, the people who own processes to now work in one platform more seamlessly. Ideally, we're preventing that growth in the, review queue. We are preventing some of the friction that we talked about earlier. I've got a great relationship with David, obviously, but I don't want his team slowing my team down. I hope that I'm showing you and and what we really hope there… For the market to see is it's possible to have your builders and your gatekeepers working together now on the same platform and really, firming up that compliance, standing. So with some questions, I'm, Mackenzie, thank you. I'm I'm seeing some, in the q and a. I'd love to take this one from Scott if it's okay to get started. Mackenzie Putici Sure. Josh Strehle Yeah. Does this… Scott asked, does this have the capability of detecting and intercepting types of forbidden data that come inbound, via an unimproved method? So, Scott, you know, what we looked at, here was, this this review reviews the forms and the workflows, and those processes, not necessarily the data that's coming through. How you can control that is, form assembly supports what we call a field level validation of data. So, you know, depending on, the type of data that you're… It almost sounds like nefarious data. You're you're saying forbidden, but, you know, PHI. The way that this would work is it wouldn't allow, a builder to have a field on a form that said, you know, medical history. Right? BMI or or or something, a specific PHI. It would detect that. It would obviously throw that for review, and Faye would make clear to the builder, hey. This looks like it violates policy. That's why you're not able to publish. Now the data that actually moves through the form is not subject to review. That's where you would need to validate those fields, making sure that the fields are, you know, collecting email addresses that look like email addresses. The data itself would flow through, but the goal here is that the form itself or the or the process, is not built to collect that forbidden data. Mackenzie Putici Perfect. Thanks for answering that. Okay. We got more and more rolling in here. So let's, let's dive into it. So one… David, this might be for you. How does training play a role in keeping employees in compliance with policies, and any advice on policy training? David Scovetta Great question. So, there was a medical study done a number of years ago. This study, apologies, I don't remember the name of it off the top of my head, but, basically, in in the medical professional, they found that, repeated but short training was really best to keep the muscle memory and the brain memory, familiar with the key points that people needed to have, and that's been my guiding light. Keep training, intermittent, so have it more frequently, have it light, and have it repeat kind of the same core principles that are really important to you. I would say that's one thing, and the other thing too is where you can, have it tailored to how your organization operates. And this one might be a bit of a heavy lift, but it's worth thinking about. So what I mean by that is if you are asking people to be cautious when they handle sensitive data, that's very good as a general best practice, but it's even better if you can walk them through some of the tools that you use. So, you know, whether it's FormAssembly or it's Google Workspace or something else, it's… This is how you manage and handle, sensitive data with care using these tools and applications and services. So if you add a good combination of the two where you can have some simple training repeated throughout the year and it's at least slightly specific to how your organization operates, I would say you've got a pretty good training program. Mackenzie Putici Perfect. Thanks for that, David. I have another question here in the queue around policy. So let's let's keep the trend going. This question is, what policies are included in the standard policy library, and is HIPAA support included there? Josh Strehle A great question. You know, this is early days for this feature, so we haven't built out, I think, the most robust, standard policy library. We do have a blanket standard policy right now that blocks the collection of health information, kind of like that example I, I used with, Scott earlier. Nothing that specifically says, you know, how to collect health information, through your forms, but you are capable of, configuring that as a custom policy. And I I think we've just scratched the surface when it comes to the opportunity that these custom policies have. I think a lot of organizations are going to find a lot of power here, especially when they are, you know, frequently, collecting sensitive information. This is going to allow you to feel confident that, hey, when someone is operating on this platform, they are building compliant pop, processes by default. Mackenzie Putici Excellent. It sounds like there's, more more coming on the pipeline soon as well. Josh Strehle Absolutely. Mackenzie Putici Okay. Brandon says, I'm a current, FormAssembly user. Is this a future product that is coming or existing functionality as I don't see any of this in our account? If future, Josh Strehle Yes. Mackenzie Putici will this be available? Josh Strehle Yes. And thank you, Brendan. Glad you're here. I'm doing an official debut of this new platform to our customers in December. Look for some invites to that session, and we'll have some, information around timeline, to that as well. So pay attention to our next customer newsletter. That's when we're gonna start sending out those invites. You know, our goal is to get this into your hands as quickly as possible, but right now it is future state. So you'll start to see more of that information as we close out the year, and I should be getting you, access to these features as we move into 2027. Mackenzie Putici Perfect. Betty has asked, does any policy violation prevent a published form from working? Our external published forms are on our agency's websites. Josh Strehle Oh, a great question, Betty. Because, you know, the the goal with this, you know, form assembly, twenty years in data collection. We understand what it means to have a broken process or a critical process suddenly break and integration go down. Right? That's never a good thing. No. In this case, if you launch a new policy or make changes to a policy, all it does is make your security and compliance, persona, whoever's, you know, in charge of reviewing those policies, aware that there are now processes that need review. So it throws anything that is live and published into that needs review state, but it does not unpublish them. It does not impact data flow. Data continues to flow through those policies. A really great question. You know, our goal is always, of course, to help you collect the data that you have compliantly. Our goal with this feature is no interruptions, less friction, and really just being able to work together with your security and compliance teams. Mackenzie Putici Perfect. Josh, thanks for answering that. Another question here. What about consent management? Do you offer tools to track that on the platform? We struggle to track that, they say. Josh Strehle Yes. And, you know, I think this is going to become a bigger issue. You know, this is mostly, something I see with our our customers, in EMEA or that, are operating internationally and need, you know, GDPR compliance. We do offer, what we call, you know, the ability to keep as primary evidence any, form field information. And so what that does is it creates an immutable record. So this is for your opt out fields or your opt in fields, privacy notice questions. It saves that information directly at… It it saves the question along with the form response so that you can prove that someone did indeed opt in or did indeed opt out when they say they did. I'm thinking that this is going to become a much much bigger need, in North America and and other regions as well. So we are trying to get ahead of that as well. You can also, you know, like… And we've supported this for PHI collection. You can mark the type of sensitive information that's being collected at the field level. So whether that's PII, PHI, PCI, credentials, you can, mark that as well for tracking and auditing on the platform. Appreciate Mackenzie Putici Perfect. Josh, you mentioned probably you… There'll be more of that in North America. Are you seeing some compliance shifts and changes. right now? Josh Strehle Well, you know, I I don't see anything… You know, speaking of of, reactive, you know, so often I'm finding out, about compliance changes myself, as those deadlines come up. And I think a lot of organizations are in that boat. And, you know, as not a a security compliance focused persona at my org myself, I find out about those a bit late. That being said, I think the general trend is, we understand why our information is, so important now. I think, especially for anyone in North America, we just through… Went through an election cycle, and you had a lot of people texting your phone that you did not recognize the number. Right? Your personal information is out there being sold, being bartered. And, you know, like, it's impacts to your day to day life like that that really shows why organizations need to be better stewards of your data. I think that as we, you know, as as as people, and not just North America, not just The US, But I think as people, we start to recognize that we can ask more of the organizations that we give our data to. We're going to see these compliance trends start to be more rigid, require more responsibility on the part of the collecting entity, the organization actually asking for that information. And I think, you know, those regulations are gonna follow suit. It may be slow, but just given how, evident the problem is and how the risk grows every year, I think that, regulations are gonna come, in support of it. Mackenzie Putici Perfect. Josh and David, we may wrap things up here for q and a, but I do wanna give you both a chance here to, leave the audience with any wisdom, any thoughts, anything, just to sum things up and put a bow on it. Josh Strehle Yeah. David, do you mind… I'll I'll have you go first, and then I've got some resources I I wanna shout out. David Scovetta Yeah. I would say, in a nutshell, good security governance makes it easy for users to, be compliant. It makes it easy for admins to exert the kind of policy, control layering that, they would need to have. And I would say, any good tool or service should have these kind of fundamentals, especially if it's connect… Collecting sensitive data. That's probably my thoughts in a nutshell. Josh Strehle Yeah. Mackenzie Putici Perfect. Josh Strehle And, you know, like, I I appreciate… I I just wanna thank David. Thank you for coming on. You know, obviously, this is not a part of your your typical purview. You're the gatekeeper. You're out there doing those on it. So I really appreciate you coming on and sharing this information, sharing your viewpoint. You know, I I think that, it's very common for organizations to struggle with the problems we discussed today. I was really actually happy to see most of the audience think or or, you know, frame their own organization as proactive when it comes to compliance, but it's tough. It's tough especially across some of the, as you go further and further out your tech stack. As you get closer and closer kind of to your website, you might have your cookie policy there, but that form has been on that site and on that page for a long time. You know, it becomes very difficult to know where all of the entry points into your tech stack are. My favorite part about working at FormAssembly is that our mission is to enable our customers to be better stewards of our data, and I think we are, really bringing important tools to the market with this upgrade or pardon me, this this platform rebuild. So, I just, I I see the need out there. I I thank this audience for, jumping on because I think that just in showing your attendance, you're aware of these issues as well and you're looking to solve them. I think we need people out there finding these tools, to solve these issues so that, again, I get fewer spam text messages, but but we all benefit from a more secure data ecosystem. I'd love to just quickly… And Mackenzie, thank you for showing this slide. We had a webinar recently if you're a Salesforce user of how you can use form assembly to actually set off processes further into your CRM, specifically Salesforce flows. If you'd like to see that, I encourage you to check out the resource center. If you'd like to browse some of the documentation that David's team puts together, jump over to security.formassembly.com. You can see where, those pin tests and some of the security documentation goes that can help your own procurement processes later on if you, are interested in FormAssembly. And speaking of being interested in FormAssembly, if you'd like to schedule a personalized demo, head over to formassembly.com. I think we have a poll and it may have already gone. If you'd like for my team to reach out to you and schedule a demonstration of any of the things that we, saw today or any other aspects of the platform, go ahead and submit that poll. You can jump in there, and, we'll reach out to you and grab some time with you. And to the customers that joined the call, really great to see you. Join me for our webinar in December. Again, look for an email about that, coming out, in the next couple of weeks, and I can't wait to be talking to you more about this platform and bringing it to your organization. Mackenzie Putici Perfect, Josh. Thank you for that. And David, thank you for your time for being here as well. It was great to learn from you both and, thanks for fielding all these questions as well. Josh Strehle Thank you, Mackenzie. David Scovetta Thank you. Mackenzie Putici A pleasure. Alrighty. You too take care. And with everyone out there in the audience, as mentioned by Josh, there is a poll, open there just in the chat box q and a neck of the woods where you've kind of been interacting so graciously and so actively throughout this session. So if you do want, a personalized demo, you can click there, kinda fast track and make sure you've got everything, going steadily. We are gonna be wrapping things up here in the next sort of two minutes. So I do wanna remind you all to hop into that docs tab there. And in the docs tab, you can get any and all of the, things that Josh mentioned in terms of the resources at hand. So definitely click bookmark, save those. You don't wanna miss out on that. And then last couple things, we're gonna launch a quick survey that's gonna pop up in the same neck of the woods. That's just for us here at Smartbrief to know what did you like, what did you not like, where can we perhaps improve, and, basically little bit of hot feedback from you guys about this webinar. And then, finally, we are also gonna be giving away our prize. So, everybody, as we give away this prize, a $250 Amazon gift card is up for grabs. Our lucky winner today is John Moravec from Tennessee. So, John, congratulations. We are gonna reach out after this by email, let you know how you can claim that prize, and we'll get it over to you right away. And with that, I just wanna give a final round of thanks. So, obviously, thanks to FormAssembly for putting this on, sending out all this awesome information, taking time out of your schedules. Thanks to David and Josh for being here as well. And, of course, to all of you in the audience for being here. I know there's a lot of thing vying for our time and attention these days. So, we do appreciate you having, this on your calendars, on your schedules for coming on in today, again, for being interactive and asking a bunch of great questions. Hopefully, you took a lot away from this as I did. And if you do wanna check out any other webinars, you can hop to events.smartbrief.com, or the QR code up on the screen. But until our next webinar here again together, I'm wishing you all an absolutely fantastic rest of the day. Take care all.

Please provide citations & attributions for any information you generate from this content, thank you.