DDM back end: what is stored and how researchers get it

Two synthetic participants went through the DDM participant flow of this project: P001 donated all 15 messages of the newer export; P002 removed one conversation from the older export and donated 11 messages. Both answered the questionnaire. This page shows what DDM kept and the three ways a researcher gets it. 1 further internal test participant, used to build the demo pages, is left out of every table and file below.

1. What the database holds

Participants are stored in plain form: the ID DDM assigns, the ID passed in the link (?pid=), the consent answer and the times.

Donations and questionnaire answers are stored encrypted. This is the data column as it sits in the database:

How DDM encrypts (from its source, ddm/encryption/models.py): each record gets a new random 16-byte AES key; the record is encrypted with it, and the AES key is encrypted with the project's RSA-2048 public key. The stored text is the base64 of both. The matching private key is computed from the server's secret key and a per-project salt, so the database file alone cannot be read, while the running server, or anyone holding the secret key, can decrypt. A project can instead use its own password that the server never stores; then the API below cannot be used and question texts cannot quote the donation.

2. Downloads in the researcher interface

In the Data Center of the project, a researcher downloads two CSV files (participation overview, questionnaire answers). The donated data are downloaded per participant, decrypted by the server, as a ZIP with one JSON file:

• ddm_8MpkNX34_donations_YOMtSfJlrAbtqzEdBMK4fFPa.zip - participant P001, 1,886 bytes
• ddm_8MpkNX34_donations_x0TFPEGacbYGJH2AJ63gJ7N7.zip - participant P002, 1,552 bytes

Inside ddm_8MpkNX34_donations_YOMtSfJlrAbtqzEdBMK4fFPa.json (first two of 15 rows):

[
  {
    "blueprint_id": 1,
    "blueprint_name": "ChatGPT conversations",
    "donation": {
      "participant": "YOMtSfJlrAbtqzEdBMK4fFPa",
      "data": [
        {
          "conversation_title": "SYNTHETIC - Weekend trip ideas",
          "conversation_id": "7eeec213-8031-59de-9b6c-0a5ca2208edb",
          "message_id": "5d7bac9d-f5af-56c4-9c6e-74e312c00166",
          "role": "user",
          "text": "SYNTHETIC TEST DATA. Suggest a two-day trip within three hours of Washington DC.",
          "create_time": 1755000045
        },
        {
          "conversation_title": "SYNTHETIC - Weekend trip ideas",
          "conversation_id": "7eeec213-8031-59de-9b6c-0a5ca2208edb",
          "message_id": "91d5c8a6-64de-5408-b789-bc5983c533aa",
          "role": "assistant",
          "text": "SYNTHETIC TEST DATA. Shenandoah National Park: drive Skyline Drive on day one, hike Old Rag on day two.",
          "model": "gpt-4o",
          "create_time": 1755000052
        }
      ],
      "time_submitted": "2026-09-26T18:13:32.417448-04:00",
      "data_extraction_state": "DATA_EXTRACTED",
      "consent": true,
      "n_data_entries": 15
    }
  }
]

3. Remote access through the API

Under "Remote Data Access" a researcher creates a token for the project (valid for at most 90 days). A program sends it with every request: Authorization: Token <your token>. The three read endpoints:

Example request and the start of its response:

curl -H "Authorization: Token <your token>" \
  "https://ddm.example.org/api/project/8MpkNX34/donations?participants=YOMtSfJlrAbtqzEdBMK4fFPa"

{
  "blueprints": {
    "1": {
      "blueprint_name": "ChatGPT conversations",
      "donations": [
        {
          "participant": "YOMtSfJlrAbtqzEdBMK4fFPa",
          "data": [
            {
              "conversation_title": "SYNTHETIC - Weekend trip ideas",
              "conversation_id": "7eeec213-8031-59de-9b6c-0a5ca2208edb",
              "message_id": "5d7bac9d-f5af-56c4-9c6e-74e312c00166",
              "role": "user",
              "text": "SYNTHETIC TEST DATA. Suggest a two-day trip within three hours of Washington DC.",
              "create_time": 1755000045
            },
            {
              "conversation_title": "SYNTHETIC - Weekend trip ideas",
              "conversation_id": "7eeec213-8031-59de-9b6c-0a5ca2208edb",
              "message_id": "91d5c8a6-64de-5408-b789-bc5983c533aa",
              "role": "assistant",
              "text": "SYNTHETIC TEST DATA. Shenandoah National Park: drive Skyline Drive on day one, hike Old Rag on day two.",
              "model": "gpt-4o",
              "create_time": 1755000052
            }
          ],
          "time_submitted": "2026-09-26T18:13:32.417448-04:00",
          "data_extraction_state": "DATA_EXTRACTED",
          "consent": true,
          "n_data_entries": 15
        }
      ]
    }
  },
  "metadata": {
    "n_blueprints": 1
  }
}

The API also has endpoints that delete one participant or all data of a project; they are not called here. A program that processes donations elsewhere would use the donations endpoint to fetch new ones.

4. Not part of DDM

Backups of the database and of the secret key, and anything that happens to the data after download (de-identification, feature extraction, access tiers, deletion schedules) are outside DDM.