Overview
When a form is delivered with prefilled data — for example, a personalised link sent via CX Platform that pre-populates a user's name, account number, or address — that data can be a security risk if the wrong person opens the link. The Prefill Data Settings let you gate access to that data behind one or more verification steps.
Rather than showing prefilled data the moment the form opens, you can require the user to authenticate, complete MFA, or pass a KYC check first. Only once those steps are passed does the form supply the prefilled content to the relevant fields.
These settings are in the Details tab, in the Prefill Data Settings section — directly below the Access and Authentication settings. This placement is intentional: the verification methods you configure in Access and Authentication are what the Prefill Data Settings draw on. The two sections work as a pair.
How the two sections work together
Each Prefill Data Setting refers to the verification method already configured above it in the same Details tab:
- Require authentication for prefill data uses the Authentication mode setting you've configured — for example, Match to prefill data.
- Require MFA for prefill data uses the SMS MFA mode or Email MFA mode settings you've configured.
- Require KYC for prefill data uses the Chandler Verify KYC mode and policy you've configured.
This means the Prefill Data Settings only work if the corresponding verification method is actually configured above. Ticking Require MFA for prefill data without having set an MFA mode won't do anything — the MFA step needs to be in place first.
Configure Prefill Data Settings
- Open the form template and click the Details tab.
- In the Access and Authentication section, confirm that the relevant verification methods are configured — authentication mode, MFA mode, and/or KYC mode — depending on what you want to require.
- Scroll to the Prefill Data Settings section and tick the options that should gate access to prefilled data.
- Click Update to save.
These settings stack: You can tick more than one option. If all three are ticked, the user must pass authentication, then MFA, then KYC before prefilled data is supplied to the form. Each ticked option adds a gate — the user works through them in sequence.
What happens if a setting is ticked but not configured above?
If you tick a Prefill Data Setting but haven't configured the corresponding verification method in Access and Authentication, the setting will have no effect — there's no method for the form to enforce. Always set up the verification method first, then enable the prefill gate.
Example — correct setup
- Authentication mode: Match to prefill data (configured in Access and Authentication)
- SMS MFA mode: Prefilled mobile number (configured in Access and Authentication)
- Require authentication for prefill data: ticked
- Require MFA for prefill data: ticked
Result: the user must first pass the authentication check, then complete the SMS OTP step, before any prefilled data is supplied to the form.
Save and Resume interaction
If a user saves and resumes a form, the Save and Resume settings take precedence over the Prefill Data Settings. If you've required MFA for prefill data but haven't enabled Redo MFA on resume in the Save and Resume settings, MFA will be bypassed when the user returns via their saved link — and the prefilled data will be supplied automatically.
If the prefilled data is sensitive, make sure the Save and Resume authentication settings match the level of verification you've configured here. See the Configure Save and Resume guide for details.
Prefill Data Settings give you precise control over when sensitive data becomes visible — drawing on the verification methods already configured in Access and Authentication above. The right combination depends on how sensitive the data is and how the form is being delivered. When in doubt, require more verification rather than less.