Storage

Responses live in a SQLite file in your project, written through Node's built-in node:sqlite — no database server, no native addon. Everything goes through one interface, StorageAdapter, so the handler doesn't care where the data lives.

Where the data lives

.open-form/
├── open-form.db      responses, form versions, rate limits, Studio overrides, signed-out sessions
├── open-form.db-wal
├── open-form.db-shm
└── secret            signs timing tokens, Studio sessions and visitor hashes

The database path is, in order: OPEN_FORM_DB, then storage.path in open-form.config.ts, then .open-form/open-form.db. Relative paths resolve from the project root. open-form dev and open-form start on the same machine share the file.

Protection on disk

• The .open-form/ folder is 0700; the database, its -wal and -shm files, and secret are 0600 — readable by the owner only. The database is created that way, and the database files and secret are re-tightened every time they're opened.
• PRAGMA secure_delete is on, and the write-ahead log is truncated after a delete, so a response deleted in Studio is overwritten rather than left in free pages.
• The dev server refuses to serve the database files, other *.db / *.sqlite files, .env*, keys and exported responses, so they can't be fetched around Studio's sign-in.
• Responses search skips a stored answer it can't read rather than failing.

Tables

Migrations run in order when the database opens. Every response records the schema version it was submitted under, so Responses and exports keep columns for fields you've since removed.

createSqliteStorage

import { createSqliteStorage } from '@open-form-build/core/sqlite';

const storage = await createSqliteStorage({ path: '.open-form/open-form.db' });

It takes { path } — a file, or ':memory:' — creates missing folders, applies migrations and resolves to a StorageAdapter. Pass it to createOpenFormHandler or createOpenFormRoute({ storage }).

createMemoryStorage

import { createMemoryStorage } from '@open-form-build/core/server';

const storage = createMemoryStorage();

An in-memory adapter for tests and throwaway previews. Data disappears with the process.

StorageAdapter

Every method is async, so remote databases can implement it; the SQLite adapter simply resolves right away. Import the type from @open-form-build/core/server, along with the ones its methods use: StoredSubmission, CreateSubmissionInput, CreateSubmissionResult, ListSubmissionsOptions, SubmissionPage, FormVersionRecord, FormOverrides, StoredOverrides, ResponseFilter and ResponseSort.

open-form start always uses SQLite. To store responses elsewhere, implement StorageAdapter and pass it where you build the handler yourself — with createOpenFormHandler, or createOpenFormRoute in Next.js.