Field masking

Good morning,

I am hoping this post will help those of us with the problems associated with field masking.

We masked fields so that the data wouldn't show up when you looked at a document in notification emails.  I developed a web form and can see the data when I download the csv (although really ugly and cumbersome). My collegue who has to process these forms can't download the csv or see the data. This collegue is set up in the pathing

Is there something I am missing or have set up incorrectly? As someone asked 6 years ago, is there a better way to do this?

Melani