How to Collect File Uploads Through a Form (Safely)

At some point, almost every process needs a file: a CV for a job application, a signed ID for verification, a logo file from a new client, a scanned invoice, a portfolio. The default way most teams collect these is email or a shared drive link — and both quietly create problems that only show up later.

Email attachments get buried in threads, renamed twice, or sent to the wrong inbox. Shared drive folders sprawl into a mess of duplicate uploads with no structure. And both routes tend to run through someone's personal account — a personal Gmail, a personal Drive — which means company data is sitting somewhere IT never approved and can't easily audit or remove.

Why a form beats email and shared drives

A form with a dedicated upload field solves the structural problem, not just the cosmetic one. Instead of files arriving through whatever channel a person happens to use, every submission lands in the same place, tied to the same record, with the rest of the answers that give it context — a name, a role, a project reference.

• One inbox for uploads instead of scattered attachments across email threads.
• No personal account exposure — files go straight to managed storage, not someone's Gmail or Drive.
• The file is attached to the submission it belongs to, so you never have to match a stray attachment back to a person.
• Respondents don't need to sign up for anything to send you a file.

This matters most for teams handling files at any volume. If you're an agency collecting brand assets, contracts, and revisions from multiple clients at once, the difference between "a folder per client, somewhere" and "a form that structures every intake" is the difference between a process and a mess — see forms for agencies for how that plays out across a client roster.

Common use cases

File-upload fields show up in almost every category of form once you start looking for them:

• Job applications — CVs, cover letters, portfolios, work samples.
• Client onboarding — logos, brand guidelines, reference documents, signed contracts.
• Identity or eligibility checks — a photo ID, a certification, a proof of address.
• Expense and invoice intake — a scanned receipt or PDF invoice attached to a request.
• Creative and portfolio submissions — images, PDFs, or design files sent for review.

In every case, the pattern is the same: a form asks a few structured questions, then requests the file that backs up the answer. The result is a submission you can act on immediately, rather than a document you have to go find and match up later.

Security and privacy: what to actually check

Uploaded files are often the most sensitive part of a submission — a photo ID or a signed contract is worth more to an attacker than a name and email address. Before you build a form that collects files, confirm three things about where they'll live.

• Encryption at rest. Files should be encrypted in storage, not just in transit during the upload. On Formiqa, uploaded files are stored on Cloudflare R2 and encrypted at rest, isolated from any personal account.
• Minimal collection. Only ask for the file you actually need. If you need proof of identity, ask for the specific document — don't leave an open "upload anything" field that invites people to send more than necessary.
• Access and deletion. You should be able to see who submitted a file and download it from a single dashboard, and you should have a plan for deleting files you no longer need.

Practical setup tips

A few small decisions make the difference between an upload field that works smoothly and one that generates support emails.

• Restrict accepted file types. If you need a PDF, say so and limit the field to PDFs. It prevents confused submissions and keeps your storage predictable.
• Set a sensible size limit. A CV or invoice is small; a raw design file or video is not. Match the limit to what you're actually expecting.
• Decide one file or many. A CV is one file. A portfolio might be five. Choose the field configuration that matches the real request instead of forcing people to zip files together.
• Label the field precisely. "Upload your ID (front and back, PDF or image)" removes guesswork that "Upload document" leaves behind.
• Confirm receipt. A simple confirmation message or screen after submission — "We've received your file" — reassures people the upload actually went through, which matters more for files than for text answers.

Planning around storage limits

Storage is finite, so it's worth thinking about volume before you launch a form that will collect a lot of files. A free plan includes 1 GB of storage, which comfortably covers a steady trickle of CVs or documents. If you're running something higher-volume — a hiring campaign, an ongoing client intake process, or portfolio submissions with larger files — the Pro plan's 10 GB gives you more headroom before you need to manage cleanup.

Either way, pricing stays flat. There's no per-response fee that punishes you for a form that happens to go viral or a hiring push that pulls in more applicants than usual — see how that adds up over time in our breakdown of per-response pricing.

Where Formiqa fits

File uploads are one of Formiqa's 15+ field types, built for exactly this problem: a place to collect files that isn't someone's inbox. Files go to Cloudflare R2, encrypted at rest and isolated from any personal account, and every submission — text answers and files together — lands in one dashboard you can review and download from directly.

If you're new to the product, what Formiqa is is a good starting point before you build your first upload form.