You could use ProForms event handler proforms_item_entry sitewide event and simply remove any data after it is submitted.

I should add this though: "security" so far as data goes related to C5's attribute system is all but built in already.

So, for example, ProForms is a custom object type with attributes as questions. Unlike most form addons, when a form is submitted, there is no "table" of any kind that has a one-for-one value pair of question and answers.

The response answers are connected via any number of table keys that link to other table keys that link to other table keys that have values.

The only efficient way to really get optimized data from C5's attribute system is through it's model architecture php files or direct access to your db.

Of which, if some hacker has access to either of these, then they would have even more access to redirect that data from any simple email form than they would with any addon code being forced to understand the full architecture of addons and core MVC design patters.

In other words - your clients concern is still a concern with or without using any addon.

What their ACTUAL concern is this: "what if someone gets access to my server php and sql data???"

To which if that happens...a hokey email php file is the easiest to rip off of all options in fact. Although they would not have access to past entries, they maliciously could get that data for any and all future responses without you even knowing about it.

I implore you to go grab a copy of ProForms...submit some entries and then go into your db and see how long it takes you to trace just one answer from one form....let alone all answers to all forms. It will be immediately clear what I am getting at here.

But again, you could just simply use the "example_proforms_extend" free package available and simply do a $form->delete(); within it.

That event handler fires after email goes out. So you should be good.

ChadStrat