Projects / Formbricks

Formbricks + minidauth survey answers only a granted role can read

Formbricks collects survey answers, and those answers are often the most sensitive thing a company holds about its customers. In this fork, answers are sealed before they reach Postgres, and reading them takes a role that a quorum of admins granted.

Open the fork Upstream Formbricks

Run end to end

What gets sealed

Formbricks is the open source survey platform. These fields are stored as ciphertext, and nothing on the server can decrypt them.

Survey answers
The response data itself, which is every answer a respondent gave.
Contact attributes
The per-contact details Formbricks keeps alongside responses.

How it's wired

  1. Sealed on write

    A Prisma client extension seals on create, update, upsert and createMany, so every path that stores a response goes through one place.

  2. Opened for a granted reader

    Reveals run in the browser with the reader's own session key. The server-side open endpoint is off by default, so the server never needs to see plaintext.

  3. Gated by a quorum role

    Reading needs a response-reader role the quorum granted. Revoke it in minidauth and reads stop, with no change to Formbricks or its login.

The key that seals these fields exists only as shares across the Tide network, and 14 of 20 nodes have to cooperate to use it. It is never on the Formbricks server.

Details that matter

  • A sealing sidecar does the work. It holds no key and no reading identity of its own, and only relays.
  • The sidecar proves itself to minidauth with a private-key assertion rather than a shared bearer token, so a copy of the operators file is worthless.
  • Every inbound value is sealed, including one that merely looks sealed already, so a forged envelope can't slip plaintext into the database.
  • Sealing is idempotent, and batched into a single network fan-out.
  • Signing out revokes the minidauth session too, and only the server can trigger that.

Status and running it

A proof of concept, off unless MINIDAUTH_SEAL_URL is set, so an unconfigured checkout behaves exactly like upstream Formbricks. The fork's README covers setup against a running minidauth.

Want to do the same for another app, or stuck running this one? Join the Discord and I'll help you out.

Other projects: Twenty · Cal.diy · Integrations