Build status
What is proven, and what is not
This project has one rule: no security claim is made that a test has not shown. This page applies that rule to ourselves. Where the answer is not in our favour, it is written down just as it is.
4 proven 4 still to come
| Property | Proof | Status |
|---|---|---|
| The ballot is encrypted before it leaves the device | Exponential ElGamal over ristretto255 · 37 tests | Proven |
| Identity and vote cannot be linked | No database relation between the two · checked on the live database | Proven |
| Tampering with the record cannot be hidden | A database trigger allows additions only; both changes and deletions are refused | Proven |
| Each organisation’s data stays separate | Row-level security, closed when it fails · 6 of 6 checks pass | Proven |
| One member, one vote | Single-use token and a uniqueness constraint, but reconciliation across channels is still to come | In progress |
| No one can open the ballot box alone | The 3-of-5 key-holder ceremony is not built yet | In progress |
| Every member can confirm their vote was counted | The receipt code exists, but the shared public checking portal is not built yet | In progress |
| A ballot is proven well-formed before it is accepted | The zero-knowledge validity proof (Chaum–Pedersen) is not built yet | In progress |
Test report, 19 October 2026
- Encryption (packages/crypto): 37 of 37 pass · exponential ElGamal, homomorphic addition, hashing
- Ballot box (apps/web): 7 of 7 pass · casting a vote, 50 simultaneous votes, receipt check, test_secrecy_invariant
These are our own automated tests, not a review by an independent body. No independent security review has taken place yet; when it has, its report will be published here. The full test results are available to auditors on request.
Before a real election
The cryptographic building blocks used here come from widely reviewed libraries. But the way we have put them together into an election system has not yet been checked by independent experts, and until it has, we will not say that it has. For real voting, this check is a mandatory condition, not an option.