Forma

Experience management — surveys, responses and workflows.

About

Forma is a survey and experience-management platform. Collect feedback with in-app, website, link and email surveys, read the results in each survey's own summary and response views, and act on them with Workflows.

Forma is a Go server and a TanStack single-page app. It replaced a Next.js monolith (yldm-tech/forma2, now archived, whose history continues here), which is retired: an installation of it cannot be upgraded in place, and its data is not read.

The tags v1.0.0 to v3.1.0 belong to a different, earlier project that used this repository name; they are unrelated to Forma.

Features

• Build surveys in a no-code editor with a range of question types, or start from a template after previewing it as respondents will see it: product and experience surveys, and forms such as contact forms, event registration, lead capture, job applications and course evaluations, in English, Japanese and Chinese. Owners and managers can save a survey as a template of their organization, which every workspace of it then offers in its template gallery.
• Target surveys at specific user groups without shipping application code.
• Share link surveys, or embed them in your website or app.
• Share a survey's results with people who have no account through a read-only link: it shows the summary under the filter it was created with, can expire and be revoked, and shows only the counts of cards with individual answers unless you choose to show them. It never shows who answered or the files they uploaded.
• Invite your organization to collaborate, with teams and per-workspace roles.
• Automate follow-ups with Workflows.
• Integrate with Slack, Notion, Zapier, n8n and others.
• Drive it programmatically over the v3 REST API or the built-in MCP server.

Built on

Go · Gin · GORM · PostgreSQL · SpiceDB · React · TanStack Router and Query · Tailwind CSS · Vite+ · Preact (survey runtime)

Development

You need Go (see apps/server/go.mod), Node.js (see .node-version), pnpm and Docker.

pnpm install
cp .env.example .env
make deps-up      # PostgreSQL, Valkey, SpiceDB, RustFS and Mailpit in Docker
make dev-server   # Go server on :3000
make dev-web      # Vite dev server, the app at http://localhost:5173/app/, proxying the API to :3000

Command	What it does
make build	Build the SPA and SDK bundles, embed them, compile bin/forma
make test	go test -race and the Vitest suites
make lint	golangci-lint and vp check (Oxfmt, Oxlint, type-check)
make check	The lint, test and generated-file checks CI runs

AGENTS.md is the working reference for this repository: layout, conventions, the API contracts that must not change, and testing policy. Read it before your first change.

Self-hosting

Run Forma with deploy/docker/docker-compose.yml or the Helm chart in deploy/helm/forma. Two things to set up deliberately:

• Audit events (sign-ins, changes to members, settings, surveys and other records) are written to the server's log stream as JSON lines with "level":"audit" (with LOG_FORMAT=json, the default). Forma keeps no audit table and has no page that shows them, so your log pipeline is where they are kept and searched. Set AUDIT_LOG_GET_USER_IP=1, with TRUSTED_PROXY_HOP_COUNT matching the proxies in front of the server (or CLIENT_IP_HEADER with TRUSTED_PROXY_CIDRS when the proxy passes the client address in a header such as CF-Connecting-IP; list that proxy's own addresses as the hop count sees them, never the ingress's or a whole pod network, or callers that reach the ingress directly can choose their address), to record client addresses; without it they read unknown.
• Data retention: organization owners choose how long finished workflow runs and survey impressions without a response are kept (impressions of identified users are always kept: they decide whether surveys are shown to that user again and which segments they are in). The daily sweep only counts what those windows would delete until you set RETENTION_SWEEP_DRY_RUN=0. Responses and contacts are never swept.

Security

Report vulnerabilities to security@yldm.ai rather than opening a public issue. See SECURITY.md.

License

Private. All rights reserved.