We are planning on a mail out with recipients returning completed paper forms, then we'll update Civi with the results. This is where we have no email address for users. On the returned form we are planning to print the 'Internal id' of the contact to allow easy update. Is this considered a security exposure? We don't give access to contacts in Civi - only admin staff have a signon so I can't see that there would be a security problem. But best to ask & check!