Digital products & delivery
Upload a file once, then let a form hand it to whoever qualifies — on submission, on a workflow move, or only once payment has settled. The submitter needs no account: their claim link is the whole of their authority.
Objects
An object is a file in your library — a guide, a template pack, a licence key file, a recorded session. They live under Deliverable files, have their own read and write privileges, and are deliberately separate from files submitters upload: an object's lifetime is yours, not a submission's.
Delivering one
A rule on the form or an action on a workflow transition delivers named objects to the submission. Delivery is by object, not by URL, and a form cannot be published naming an object that does not exist in your organisation.
Delivering the same object twice does not duplicate it, and re-running the rules on an edit does not mint a second claim: the submitter's link is created once and stays stable for the life of the record — the same discipline as a reference number.
Previews, drafts and read-only evaluations deliver nothing. A claim exists only when a submission is really saved.
The claim link
Delivery produces one link per submission, carrying an unguessable token. Anyone holding it can download the delivered files — there is no account, no password and no session involved, which is what makes it work for an anonymous submitter.
Put it in a notification with the
download_link merge value, and send that notification to the submitter — a
recipient can be a field on the form itself, which is how an anonymous filler receives their
own files.
Downloads are rate-limited per link rather than per visitor, which bounds what a link that spread too far can extract. Files are served as attachments with a checked content type, so nothing delivered can execute in a browser.
Gating on payment
If the submission's rules priced a payment, its delivery is held until that payment succeeds; the link works, the files are simply not released yet. Once Stripe confirms settlement, the same link starts working — nothing has to be re-sent.
The gate is decided per submission from what its own rules actually priced, not from the form in the abstract. So a conditional charge that priced nothing for this submitter — a free tier, a waived fee — does not gate their delivery forever.
Sharing and revocation
Delivery works on forms shared with a partner organisation: their submitters receive your objects, and a claim already handed out keeps working even if the share is later withdrawn. Possession of the claim is the grant — revoking a share must not break a promise already made to somebody's customer.
Deleting an object does revoke past deliveries, deliberately: the alternative is a claim page promising a file whose bytes are gone. An object still delivered by a live form cannot be deleted until you remove it from those forms.
To change what an object contains — a corrected edition, or a file whose bytes were lost from a server's own disk — use Replace on the Deliverable files page rather than uploading again. The object keeps its id, so every rule that delivers it, every claim link already sent and every past delivery serves the new file; nothing has to be re-pointed. A download whose bytes are missing says so on the record, with Replace as the fix.
What is not delivered
Only library objects an author chose to deliver. Files submitters uploaded and documents generated for internal use are never reachable through a claim, and nothing uploaded through a public form can be read back out of it.