Intake Forms, Fields and Breach Types

A breach intake form is the public page where an employee, partner, or member of the public reports a suspected personal data breach. You build it once, publish it, and place it on your website or intranet. Every submission creates an incident and starts the workflows that the form's rules select.

Three pages under Breach Management work together: Breach Form Fields, Breach Types, and Breach Intake Forms.

Breach Form Fields

Breach Form Fields is a shared library of questions. You define a field once, with its type, options, and translations, and place it on any number of intake forms.

Open Breach Form Fields. The table lists Identifier, Display Name, Description, Field Type, and Source, with a search box. Source is System for fields that ship with Neostra, such as Title, Detection Timestamp, Data Categories, Estimated Individuals Affected, Geography, Encryption Status, and Containment Status, and Custom for fields you create. System fields cannot be edited.

Click Add New and fill in the Add a New Field drawer:

The pencil action opens Update Field with Details and Translations tabs. Translations has one box per language for the display name and, for Select and Multi Select fields, Options Translations per option. Every selected language needs a value before you can update. Whether a field is mandatory is decided per form in the builder.

Breach Types

A breach type classifies the nature of an incident. Every intake form carries a Breach Type field, the reporter picks from the types you offer on that form, and workflow rules can route on the selection.

Open Breach Types. The table lists Identifier, Display Name, and Source. Neostra ships twelve System types: Unauthorized Access, Data Theft, Ransomware Attack, Phishing Attack, Accidental Disclosure, Insider Threat, Lost or Stolen Device, System Misconfiguration, Third-party Breach, Malware Infection, Social Engineering, and Denial of Service (DoS). System types cannot be edited.

Click Add New to create a Custom type:

As with fields, a breach type cannot be deleted and its identifier cannot be changed once created. The Update Translation action on a custom type opens Display Name Translations, with one box per language.

Create an intake form

Open Breach Intake Forms. The table lists Title, Brand, Tags, Form Description, and Last Updated, with Preview, Customize, and Export actions.

Click Add New and fill in the dialog:

Click Add. The form is created with a default description, thank you text, footer, and Default Rule, and the builder opens. Your plan sets how many breach intake forms you can create.

The builder

The left menu has Details and Form Configuration, then Workflow Rules and Scoring Rules under Automation, Published Versions under Verification, and Embed Script under Integration. The top bar shows Save Changes and Publish.

Details repeats Web Form Title, Brand, Tags, and Form Description.

Form Configuration shows the form as the reporter sees it, with these settings:

Form Color and Header

Primary Color and Secondary Color set the palette. Under Header, switch between Heading Text and Logo, enter a Heading or Select logo and Upload, and set Heading Color, Background Color, and Height (in px). Enter 0 to hide the header.

Language Settings

Turn on Enable Language Settings to show a language picker on the public form. Tick each language to offer and use the radio button to mark the default.

Description

The rich text above the fields, one tab per language. New forms start with a ready-made explanation of what a personal data breach is and what to include in a report.

Form Translation

Pick a language to see the English text of every label and option beside its translation.

Form Fields

Every form starts with a Breach Type field that cannot be deleted and is always required. Its Breach Type Options setting picks which breach types this form offers.

Click Add Field to open Select a Form Field, which lists every library field not yet on the form with its type and a System or Custom badge. Click a field to add it, use the arrows to reorder, and the pencil to edit:

• Label: the text the reporter sees. For library fields the label and options are read-only here.
• Required: system fields are always required.
• Type: shown only for fields not drawn from the library: Text, Number, Multi Select, Single Select, First Name, Last Name, Email, Phone, Country, State, or Date. State is offered only after a Country field exists.
• Option Type for fields with options: Solid Button or Checkbox.

A Boolean library field appears as a single select with Yes and No. A Geography field lets the reporter pick the countries and states where affected individuals are located. Deleting a field mapped in Scoring Rules asks you to confirm.

Under Display Settings, Add Display Setting hides a field until another field Is or Is Not a chosen option, with the action Show field or Show field with options.

Footer and Form Page Texts

Footer is the rich text under the form. Thank You is the text shown after a successful submission. Both have one tab per language.

Attachments

Turn on Enable Attachment to add a file drop zone. Under Select Files you can upload reference documents that appear on the public form with a download link. Description is the text above the drop zone, per language. Accepted formats include office documents, PDF, images, text, CSV, ZIP, and email files.

Captcha Settings

A switch. When on, the reporter must complete a captcha challenge before Submit.

Workflow Rules

Workflow Rules decides which breach workflows start for each incident. Neostra evaluates every rule against the answers and starts one workflow instance per matching rule. Default Rule cannot be deleted and has no conditions.

Click Add Rule and expand it:

• Rule Name, up to 50 characters.
• If All or Any of the below condition(s) will match: each condition is a field with options (Breach Type, Single Select, Multi Select, Country, State), Is or Is Not, and a value.
• Workflow (required), Brand, Process and Sub Process, Owner (required, with Assign to me), Due in Days, and calendar days or business days.

See Workflows for how a workflow runs.

Scoring Rules

Scoring Rules maps the form's field options to the risk dimensions scored at submission: Data Sensitivity, Exposure Severity, Harm Probability, Mitigation, Encryption Key Compromised, and Individuals Affected (count). Score Values sets points per option and Escalation Rules raises the classification when conditions match.

Save Changes and Publish

Save Changes stores the draft. Reporters keep seeing the last published version.

Publish first checks that every enabled language has translations for the description, labels and options, page texts, footer, and attachment description, and highlights anything missing. Then it asks: "All changes to the form will be saved and published. Do you want to continue?" Click Continue. Publishing saves the draft, snapshots the form and its scoring rules as a timestamped version, and makes it live.

Published Versions and Preview

Published Versions lists each publish with its Published Date and a Preview button that opens that version exactly as it was published. Preview on the Breach Intake Forms list renders the current published form.

Embed Script

Available after the first publish. Use Copy to clipboard and place the iframe snippet in your site:

<iframe src="https://<your-neostra-host>/public/breach-management/<tenant-id>/<form-id>"></iframe>

The same URL works as a direct link. Add ?hideHeader=true to drop the header, hideLanguagesDropdown=true to hide the language picker, or preSelectedLanguage=<code> to open the form in a given language.

What the reporter sees

The public page shows your header, description, and fields, with a red asterisk on required fields. Files upload as soon as they are selected, and Submit stays disabled until every required field is answered and uploads finish. After Submit, the reporter sees your Thank You text, a Reference such as BI-2026-0001, and, when scoring is configured, the Risk classification. Submit another incident resets the form.

From submission to Incidents

Each submission creates an incident with status Open and a unique reference. Neostra stores the answers and attachments, computes the risk score, resolves the applicable regulations and their notification deadlines from the Geography answer, and starts a workflow instance for every matching rule with its owner and due date.

Reporter identity is optional. If the form includes Email, First Name, Last Name, or Phone fields, the answers become the reporter's details shown in the Reporter column. Otherwise the incident is anonymous.

See Incidents for how to review and manage what arrives.