Compliant data intake means every form and workflow follows your organization’s data policies before it goes live. FormAssembly gives builders speed through Fai, its AI assistant, while a policy library, review gates, and an audit trail give compliance teams the visibility and control they need.
Our recent webinar, Speed for Builders, Security for Everyone: How to Build and Monitor Compliant Data Intake, showed both sides in one live demo.
Key Takeaways
- Compliance gets harder as organizations grow. More teams adopt more tools, and IT often cannot see them all.
- Builders move faster with Fai. Fai drafts forms and Salesforce connectors from plain-language requests, and the builder reviews and publishes the result.
- A policy library turns policies into guardrails. Administrators set standard and custom policies once, and Fai always builds against them.
- Review gates keep humans in control. A workflow can be held for compliance review before it is published.
- An audit trail proves compliance. Approvals, settings changes, and policy updates are logged and downloadable as a CSV.
Why is data collection compliance getting harder?
Data collection compliance gets harder as organizations grow because every new team brings new tools that IT may never see. Gartner’s 2023 cybersecurity predictions, as reported by CSO Online, found that 41% of employees acquired, modified, or created technology outside IT’s visibility in 2022 and projected that figure would reach 75% by 2027.
The result is a familiar set of problems:
- Each team collects data with a different tool, and those tools connect to the rest of the stack in different ways.
- Nobody sees the full picture, and leadership struggles to see what rolls up to them.
- Salesforce syncs and dashboard refreshes lag behind what is happening at intake.
- AI can add structure to unstructured data, but it does not remove the blind spots.
The cost of those blind spots is rising. IBM’s 2025 Cost of a Data Breach Report found that one in five organizations reported a breach tied to shadow AI, and it put the average US breach cost at $10.22 million.
How can builders create compliant workflows faster?
Builders can create compliant workflows faster in FormAssembly by describing what they need to Fai and then reviewing what Fai produces. In the session’s demo, the build from a blank screen to an active, Salesforce-connected form took roughly three to four minutes.
Here is the sequence the demo followed:
- Ask Fai for a contact form. Fai builds it and includes a privacy notice, even though the request never mentioned one.
- Ask Fai to connect the form to Salesforce and create an account and a related contact. Fai reads the schema from the connected Salesforce org, adds the required fields (such as company name), and writes the connector.
- Let the workflow handle the relationship. The account record ID returns to the workflow, and the contact is created against that account without any manual field mapping.
- Run the workflow in test mode. Test mode sends notifications to the tester’s email, offers a button to fill test data, and does not require reconfiguring the workflow.
- Review and publish. Fai keeps a human in the loop, so the builder approves the output before anything goes live.
The same assistant also works as a control surface. When the test run landed in the wrong Salesforce org, the builder asked Fai to switch the connector instead of editing the connector step by hand.
What is a policy library and how does it enforce standards?
A policy library is an administrator-managed set of data collection rules that FormAssembly applies when workflows are built. Only administrators can enable policies, and Fai references them whenever it creates or updates a workflow.
The library includes standard policies and supports custom ones:
| Policy type | Examples from the session |
|---|---|
| Standard | A privacy notice, a CCPA notice, and a policy that blocks collection of HIPAA-related information. |
| Custom | Never collect Social Security numbers, include a specific disclosure wherever data is collected, or follow brand language on every form. |
Custom policies are written in plain language and work like a prompt. Organizations can paste in a policy they have already drafted. More detailed instructions produce better results.
The demo made this concrete with two policies. A deliberately silly “thee and thou” help-text policy showed Fai rewriting every field’s help text from one short request. A plain-language disclosure policy then replaced it, so Fai explained why each field is collected, how the subject line is used, and how long data is kept.
How do review gates and the compliance dashboard work?
A review gate holds a workflow for compliance review before it can be published. With a gate enabled, a builder who clicks publish submits the workflow for review instead, and it appears in a compliance dashboard assigned to an administrator, a CISO, or anyone responsible for data collection policy.
In the demo, the dashboard showed:
- Filters and priorities to sort pending reviews and focus on newly requested ones.
- Flagged violations, including a privacy notice that still contained placeholder text and a missing right-to-rectification statement that GDPR requires.
- Reviewer actions, where the administrator can approve or block a workflow and add notes for the audit trail.
AI-assisted review is optional. With it turned off, the AI findings still flag issues, but a person makes the final decision. Review also works on workflows that were built manually, so teams that avoid AI can still use it.
What visibility and audit support do compliance teams get?
Compliance teams get visibility from a single overview of data collection activity and an audit trail of every platform action. The homepage shows submissions over the last 30 days, delivery success, and a breakdown of connected systems such as email, Google Sheets, Salesforce, Stripe, and document generation. Forms and workflows share one combined view, so analytics are available at both levels.
The audit trail records approvals, settings changes, and every time a policy is enabled or updated. It downloads as a CSV, which helps compliance teams show when a change was made and who made it.
Frequently Asked Questions
How does Fai follow our organization’s specific policies, not just generic standards?
Fai follows custom policies because administrators write them in plain language, and Fai treats them as instructions for that account. The more detail a policy includes, the better Fai performs, so writing a policy works much like prompt engineering for your account.
How should IT and business teams roll out the platform together?
IT and business teams should join onboarding together from the start, ideally during the first demos. Bring both the people who build forms and connect to Salesforce and the people who enforce policy, so each group sees how the other’s actions change its work. For example, builders can no longer publish directly once a review gate is on. Agree on service levels and points of contact up front so both teams use the platform in sync.
How does FormAssembly handle PII when AI is involved?
FormAssembly uses AI only to build forms, not to collect data, so the information submitted through a form is not passed to an AI provider. Organizations control AI usage on the platform, including which models power other features, and they can turn AI off entirely. Everything shown in the demo can also be configured manually.
Can teams migrate existing forms and processes to FormAssembly?
Yes, teams can bring existing requirements to Fai and ask it to rebuild the process. That can be a requirements document, logic from a Salesforce flow, or a screenshot or image of a paper or web form. Because these paths use AI tools, organizations that are cautious about AI may rebuild some processes manually.
Do FormAssembly forms embed in Salesforce Experience Sites?
Yes, forms embed in Salesforce Experience Sites once the FormAssembly AppExchange app is installed, and they can authenticate users based on Experience Site logins. For setup steps, see the articles at help.formassembly.com and the webinars in the FormAssembly resource center.
Watch the full webinar
The replay includes the full live demo of Fai building a Salesforce-connected workflow, an overview of the policy library and the compliance dashboard, plus an audience Q&A. Watch the on-demand replay here.
Want to see Fai in action?
Book a personalized demo or request a free trial of the platform today.
