Who on Your Team Should See Form Submissions

Short answer: build-and-configure access should be one or two people, and everyone else should get a scoped view of only the submissions they need. As of September 2026 BotForms includes 1 user on Starter at $29/month, 3 on Pro at $79 and 10 on Business at $199, with team collectors from Pro for staff who only submit and view.

Almost every business starts the same way. One person sets up the forms. Then a colleague needs to see an enquiry, and the fastest thing in the world is to send them the login.

Six months later that login is in four phones, one former employee's password manager, and a WhatsApp message. Nobody can say who changed the notification email, and the person who cannot get a job address is texting the owner at seven in the morning to ask.

None of this is a discipline problem. It is what happens when the only available access level is "everything".

Three genuinely different needs

The mistake is treating access as a single dial. It is three distinct roles that happen to touch the same data.

Build and configure. Creates forms, changes fields, sets where notifications go, manages billing. This should be one or two people, permanently. Every additional person here is another way the notification address quietly changes.

Work the submissions. Reads enquiries, replies, marks things done, exports for reporting. Office staff, sales, dispatch. They need to see submissions and do not need to touch the form itself — and letting them is how a required field disappears the week before a busy period.

See only my own. A technician needs the address and photos for their jobs today. A contractor needs the two assignments they are on. A bookkeeper needs completed jobs for the month. These people need a small slice, and giving them a full account is both a risk and, on most pricing models, an unnecessary cost.

Almost everyone in a business is in the third group. Almost every business gives them the first.

Matching people to access

Person	What they actually need	What they usually get	Better fit
Owner or manager	Everything	Everything	Full user seat
Marketing lead	Build and edit forms	Shared admin login	Full user seat
Front desk	Read and respond to all submissions	Shared admin login	User seat, or a broad view role
Field technician	Their assigned jobs, with photos	Forwarded emails or a shared login	Restricted collector or viewer
Subcontractor	Two current jobs	A shared login, never removed	Restricted, removed on completion
Bookkeeper	Monthly completed records	A CSV emailed by someone	Scoped view or a scheduled export

The right-hand column is mostly not "buy more seats". It is "use the smaller thing", which is what collectors and viewer accounts exist for. On BotForms the collector mechanism covers staff who submit and view assigned work — the field-side workflow is covered in letting a field team collect form data without account access.

What a shared login actually costs

Four concrete problems, all of which happen.

Attribution disappears. Something changes, submissions stop arriving, and the activity log says the shared account did it. That is the same as no log. A configuration incident becomes an afternoon of reconstruction instead of a lookup.

Departures are unmanaged. Rotating a shared password means distributing the new one to everyone still there — a job with enough friction that it does not get done. Individual accounts turn an off-boarding step into one click.

Nothing is scoped. A technician who needs one address can see every customer you have ever had, and can export the lot. That is not a statement about the technician; it is unnecessary exposure with no upside.

Configuration drifts. With everyone holding the keys, the form gets edited by whoever is annoyed by it this week. Fields appear, required flags come off, notification addresses change to whoever asked last. Nobody is at fault and the form stops working as designed.

Notifications are a permission decision too

An overlooked one. Who receives the alert when a submission arrives is functionally an access grant, and it is usually set once and never revisited.

The pattern worth adopting: notifications go to a role, not to a person. A shared inbox or a distribution address survives someone leaving; a personal address means a fortnight of lost enquiries when they do, and nobody notices because nothing errors. Alerts continue arriving to a mailbox nobody reads.

If time-to-response is what you care about, this is also the point where the channel choice gets made — the trade-offs are in SMS versus email form notifications for speed to lead. The permission angle is simply that adding a phone number to an alert list is granting someone customer data, and it should be reviewed like any other grant.

Access for people outside the business

Two cases deserve their own handling.

Clients. An agency running intake forms for a client will eventually be asked to let the client see submissions. Doing that with an admin login is how a client accidentally edits a form you maintain for them. A restricted view showing their forms and nothing else is both safer and a better product — and where the submissions become a document you hand over, generating a branded PDF from every submission covers the white-label route so the deliverable carries their branding, not the platform's.

Contractors. Scope narrowly, and remove on completion as a scheduled step rather than an intention. The useful discipline is deciding the removal date at the same time you grant the access.

Onboarding a new client cleanly is largely this same question of who sees what and when — the wider sequence is in client onboarding forms.

Getting the seat count right

Seats are the line item people over-buy and under-use in the same organisation — too many full accounts for people who only read, and not enough scoped access for the people doing the work.

A workable sizing exercise: list everyone who touches form data, mark each one build, work or view-only, and count only the first two categories against seats. That count is almost always smaller than the number of people who currently know the password.

Then check what the view-only group costs on your plan. On BotForms that means team collectors — five on Pro, unlimited on Business, with an extra collector available as an add-on at $10 a month. Current figures for seats, collectors and add-ons are on pricing.

For larger organisations, the requirement usually shifts from counting seats to central identity — single sign-on so access follows the employee directory rather than a list somebody maintains by hand. That sits on the Enterprise tier along with the custom limits.

A review worth doing twice a year

Twenty minutes, and it consistently finds something:

Open the user list and name every account out loud. Anyone you hesitate over should not have access. Check where each form's notifications go and whether that address is still monitored. Confirm that anyone who left is gone. And look at whether any full seat is being used by someone who only ever reads submissions — that is a downgrade and a cost saving in the same move.

Getting started

If you are on a shared login today, the migration is smaller than it looks. Create individual accounts for the one or two people who genuinely build, move everyone else to scoped access, point notifications at a role address, and change the admin password last.

BotForms includes 1 user on Starter at $29/month, 3 on Pro at $79 and 10 on Business at $199, with team collectors from Pro and role-based access, form assignments and activity logs in the collaboration feature set. See features, pricing, or start a 30-day trial.