Open Feedback Platform

Approved public snapshot

Open Feedback Platform

Summary

A proposed self-hostable, community-governed platform for accessible survey creation, controlled response collection, basic analysis and portable exports. Phase 1 focuses on organization isolation, explicit anonymous or identified modes, auditable administration and organization-controlled retention. The project is at proposal stage; no survey application or operational service is available.

Problem statement

Organizations need understandable survey tools with control over hosting, access, retention and export of their feedback data. Common tasks should not require a proprietary cloud dependency or an undocumented data format. The project will test whether independently designed, open interfaces and a focused self-hostable implementation can meet these needs. It makes no competitor feature-parity or compatibility claim.

Public-interest rationale
Feedback collection is reusable infrastructure across community organizations, research teams, associations, public-interest groups and businesses. The proposal aims to reduce repeated development of one-off forms, inaccessible surveys and undocumented spreadsheets. Public-interest intent does not establish incorporation, nonprofit or tax-exempt status, legal clearance, endorsement or ownership by CSR.

Knowledge-capital rationale
The intended reusable knowledge includes an open question schema, accessible authoring patterns, documented respondent semantics, reproducible reporting rules, portable export formats, threat models, operational playbooks and reviewed design decisions. Open software and documentation need not expose response data or identity mappings. Self-hosting and replaceable adapters should keep this knowledge useful beyond one hosting provider. Value will be evaluated through bounded pilot evidence, not claimed adoption or savings.

Known risks
Tenant leakage; implicit answer access through administrative roles; misleading anonymity or linkage through timing/small groups; inference from related reports; unauthorized identity/free-text access; bearer-token leakage or replay; webhook exfiltration/SSRF; unsafe or stale exports; incomplete deletion/backups; sensitive audit metadata or overstated immutability; inaccessible matrices/logic/charts; unclear license/contribution rights; copied design or implied affiliation; excessive scope before isolation; unsupported community-ownership claims; and privileged operator or restore bypass. Each requires its affected milestone gate and documented mitigation; none is declared resolved by this draft.

Unresolved product decisions
Contribution terms; governance, maintainers, appeals/security authority and trademark custody; working-title clearance; product stack and tenant-isolation enforcement; account lifecycle, recovery, MFA and initial owner provisioning; exact grant and response-access authority; retention defaults/maxima, override authority and deletion timing; reporting/filter/differencing limits; participant linkage and anonymous-mode notices; survey/version limits, quotas, API contracts and webhook envelope; pilot workload/hardware, recovery targets and success thresholds; initial languages, jurisdictional notices and browser/assistive-technology evaluation scope. Proposed defaults must be ratified by recorded decisions. AGPL-3.0-or-later is the planned license for the server application, pending final legal, dependency, and contributor-rights review before code or outside contributions are accepted.

Proposed solution

Proposal status and Phase 1
All capabilities below are proposed future requirements, not completed features. Develop organization-isolated workspaces; survey creation, editing, validation and preview; eight question types (single choice, multiple choice, short text, long text, numeric, date, rating scale and bounded matrix); page/section breaks; required-field validation and bounded forward display/skip logic; immutable published survey versions with Draft, Active, Paused, Closed and Archived lifecycle states; anonymous public links and revocable single-use participant links; server-enforced UTC opening/closing dates; response capture with started/submitted times, completion status and explicit anonymous/identified mode; private save/resume; accessible summaries/charts; controlled filtering/cross-tabulation; CSV/JSON exports; five roles (organization owner, survey owner, editor, analyst, viewer); immutable administrative audit events; documented survey/response REST interfaces; signed outbound webhooks; organization-controlled retention/deletion; accessible author/respondent interfaces; and self-host/upgrade documentation.

Survey rules will distinguish unanswered, skipped, incomplete and answered values. No arbitrary executable survey code is included. Published versions and version-bound responses will not be silently rewritten. Links are provided for authorized manual distribution; link generation is not an email or SMS delivery service, and anonymous public links cannot guarantee one-person-one-response.

Deferred and excluded scope
Generative AI, automated sentiment analysis, AI recommendations, built-in bulk email, SMS, contact-center analytics, web/mobile intercepts, offline mobile apps, purchased research panels, social-media monitoring, reputation management, video-feedback analysis, conjoint, MaxDiff, full employee-lifecycle suites and full customer-journey orchestration are deferred. Proprietary-format compatibility, competitor account access, custom survey scripting, file/media uploads, advertising, tracking, respondent-data sales, payments, marketplace integrations and automated decisions about people are excluded. Phase 1 has no sector-specific foundational integration. Expansion requires a separate scope decision.

Independent clean-room approach and nonaffiliation
Design from independently written stakeholder goals, general survey practice, open standards and original synthetic scenarios. Maintain a dated source register recording limited facts and their use; public availability alone does not permit copying. Do not use competitor code, accounts, private APIs, network traces, databases, proprietary formats or reverse-engineered behavior, and do not copy text, branding, layouts, icons, documentation or trade dress. Independently review AI-assisted material, sources and future dependency licenses; preserve provenance records and stop using questionable input pending review. No software dependency is adopted by this proposal.
Independently designed; no affiliation, endorsement or compatibility with a proprietary survey product is claimed. Use an original name, design and documentation. Community governance is an intended direction, not existing legal ownership. The working title's naming/trademark clearance is unresolved, and no clearance search is claimed.

Security and privacy principles
Enforce organization scope and deny-by-default authorization across UI, APIs, caches, background jobs, exports and storage. Organization administration must not imply access to survey answers; survey grants are explicit, viewers receive approved suppressed aggregates, and identity access requires a separate scoped permission. Use supported authentication, CSRF protection, server validation, bounded rates/sizes, safe errors and least-privilege operations. Audit administrative changes atomically with minimal immutable metadata.
Use scoped, expiring, revocable bearer capabilities stored as digests, with atomic redemption and idempotent final submission. Bearer/resume modes are pseudonymous; free text and small groups may still identify a person. Do not promise anonymity from a host operator. Anonymous response metadata must exclude identity fields, IP addresses and user-agent strings. Keep identified-mode data separate and restrict it explicitly; unfinished answers remain respondent-only. Minimize logs and audit evidence; do not log answers, credentials, tokens or unnecessary identities.
Provide purpose/mode notices and finite retention covering responses, identities, tokens, exports, derived data and backups, with documented restore re-deletion. Use a minimum aggregate cell floor of five, complementary suppression and controls against differencing. Webhooks must use the strict identifier-only allowlist, bounded signed retries and replay/deduplication controls, without answers, identities, response identifiers or respondent timestamps; control destination egress against SSRF, redirects and DNS rebinding. Pilot technical fixtures will use synthetic data, with real participation requiring separate review.

Accessibility, portability and self-hosting
Target WCAG 2.2 AA through semantic forms, associated labels, accessible errors/focus, keyboard and screen-reader support, non-drag alternatives, zoom/reflow and equivalent data tables for charts. Essential author/respondent journeys must work with server-rendered forms without JavaScript; enhancements must not be necessary for validation, saving, resuming or submitting. Evaluate the adopted criteria with manual assistive-technology evidence as well as focused checks; no achieved conformance is claimed.
Document versioned UTF-8 CSV/JSON schemas, stable identifiers, types, denominators, missing-value semantics and version scope. Protect CSV exports from formula injection; recheck authorization at generation and download and expire artifacts. Document an independently installable self-hosted arrangement without a proprietary cloud dependency, using open interfaces and replaceable adapters, plus supported upgrades, backup/restore and operational runbooks.

Governance and stewardship
Propose published design decisions, reviewed changes, documented maintainer appointments, conflict-of-interest rules, community proposals and appeals, and accountable release/emergency responsibilities. Security-sensitive changes require another reviewer. No participants, maintainers or pilot organizations are appointed by this proposal. Proposed contribution practice is that contributors retain their rights and grant the permissions required by the chosen license. AGPL-3.0-or-later is the planned license for the server application, pending final legal, dependency, and contributor-rights review before code or outside contributions are accepted. Contribution terms, trademark custody and decision process remain undecided. CSR remains the submission/review system of record. Approval, publication, a repository and a software release are separate outcomes. CSR review or publication transfers no intellectual property and certifies neither security, legal clearance nor production readiness. Any repository is created manually only after CSR approval and linked by a separate staff action.

Initial milestones
M0: Establish independently authorized project foundations, provenance/governance records, standards, data inventory and threat model; resolve stack/identity choices before implementation.
M1: Tenant, identity and scoped-role foundation. Begin with sign-in, tenant resolution, organization list/detail and one owner-only settings change with atomic audit evidence, using two synthetic tenants and denial cases before a survey builder.
M2: Versioned survey schema, eight question types, authoring, validation and accessible preview.
M3: Survey lifecycle, controlled links, response capture, resume and anonymous/identified boundaries.
M4: Reproducible summaries, controlled filtering/charts and portable exports.
M5: REST interfaces, signed webhooks, audit, retention and operational tools.
M6: Bounded accessibility/security/workload checks, independent installation/upgrade/restore and a documented human pilot readiness decision. Milestones are plans, not completed work; stop at failed gates.

Pilot success measures
Ratify workloads, evaluation scope and targets before measurement. Proposed targets include 100% denial of approved cross-tenant/authorization negative cases; all eight question types and supported logic working as specified; exactly-once valid response outcomes and safe invalid/expired/closed cases; no prohibited identity metadata in anonymous flows; exact fixture agreement for reports and exports including suppression; at least 90% essential-task completion without facilitator intervention in an approved trial of at least five volunteers; and no unresolved blocking keyboard, screen-reader, focus/error-recovery or no-JavaScript barriers. Evaluate all adopted applicable AA criteria without equating task completion with full conformance.
Measure the specified reference workload and fixed performance budgets, finite retention/deletion and independent recovery, with proposed RPO at most 24 hours and RTO at most 4 hours. Require no unresolved critical/high security findings or tenant-isolation/unauthorized-disclosure failures of any severity. Record counts, case outcomes, coverage and limitations without participant identities or raw answers. No pilot has run; small samples do not establish broad usability, legal compliance or certification.

Intended users

Small to medium organizations with ordinary survey and feedback needs and an operator able to maintain a supported self-hosted service: associations, community groups, internal research teams, service organizations and businesses. Intended users are organization owners, survey owners, editors, explicitly authorized analysts and viewers, respondents, and self-host operators responsible for installation, recovery and updates. Organization ownership does not automatically confer response-data access; operators are a separately disclosed trust boundary. These are intended audiences, not participating organizations, contributors, sponsors, customers or endorsements. Initial validation uses original synthetic cross-industry scenarios; regulated or highly sensitive collection requires a separate suitability review.

License

GNU Affero General Public License v3.0 or later (SPDX: AGPL-3.0-or-later)

Approved submission revision

2

Publication date (UTC)

2026-09-12

Downstream infrastructure

Repository availability

Repository pending

No active repository link has been recorded. Repository creation is manual and downstream from CSR approval.