The Camera, Signature, Files, and Checklist form element types have a required Storage Type field.
When a user uploads a file using the Public Storage Type there will be a URL to that file which allows anyone with the URL to download the attachment. This URL is not exposed in the email or anywhere on the platform outside of the network tab when viewing a submission.
Uploading a file using the Private Storage Type, on the other hand, requires the user to have access to the URL in order to download it. This access can be provided in different ways:
Using a developer key from the account
By a Team Member with the submission data permission
By an Approver with access to the form
Accessible to the original submitter of the form if they were logged in
Storage Types in Submission Events
In Email submission events, the storage types behave the exact same. The links will last 7 days, after which the links in the email will not be accessible.
Tip: If only authenticated team members are allowed to view attachments and the submission data then an email notification needs to trigger when a submission occurs:
Choose the Email Event Type in the Submission Events Workflow
Create a Custom email template that only links to the submission in the submission history (not including the attachments in the email)
This will allow only authenticated team members to view both the submission and the private storage attachments when logged in.