Security and privacy
How your vote stays secret, and how far
A page written for you to check, not to take on trust. The status of every claim sits beside it: ✓ is running today; a clock means still being built.
1. Shared key and counting
No one can open the ballot box alone
- 1Member’s phoneThe vote is encrypted with the public key the moment it is stamped
- 2Public recordEncrypted votes only, linked to one another by hashes
- 3Encrypted totalAll votes are added without opening any of them
- 4Key holdersThe total opens only when at least 3 of 5 come together
- 5ResultTotals only; not a single vote is opened on its own
- The key that encrypts votes is public; the key that opens them is not in any one person’s hands.
- At the count, votes are not opened one by one. They are added together while still encrypted, and only the final total is opened (homomorphic tally).
- The opening key is split into five parts, held by people your committee appoints; ematsewa holds no more than one. The total cannot be opened unless at least three of them come together.In progress
2. Encryption
What is encrypted, and where the key is kept
- Your choice is encrypted inside the browser, before it leaves your phone (exponential ElGamal over ristretto255, from audited open-source libraries). All that reaches the server is the encrypted code.
- The membership roll and the record of votes are in separate tables, with no column or relation linking the two. A test checks this on the live database itself.
- Each organisation’s data is kept separate at the database level (row-level security). One organisation sees nothing of another’s.
- The record can only be added to; the database itself blocks changes and deletions.
- A mathematical proof (zero-knowledge) that a vote is correctly formed, without opening it.In progress
What we can see, and what we cannot
Our server holds the encrypted votes and the list of who has voted, but no column the two share, so the record cannot link a vote to a voter. What we see: how many people voted, and the final total. Limitation: there is currently a single key that opens the total; until splitting it among 3 of 5 holders is built, its security depends on the operator.
3. How long data is kept
What is kept, and what is deleted
- The encrypted record and the result are kept until the complaint period ends, so that anyone can repeat the count and check it later.
- Passcodes and contact details such as phone numbers are deleted once the election and any complaints are dealt with.
- The exact period is set in the written agreement with each organisation, according to its constitution.
- There is no third-party advertising or tracking code in the voter app.
4. Complaints and disputes
At every tier of service
- Every voter can check for themselves, with their receipt code, whether their vote is on the record. If it is not found, that receipt is the evidence for a complaint.
- In tiers 1 and 2, complaints are decided by your own election committee; we provide a technical report with the record, hashes and system logs.
- In tier 3, complaints are heard by a neutral returning officer under the written agreement.
- In every tier: any member can repeat the count themselves from the public record.In progress
5. Audit
Open to independent audit
- Every security claim is tied to an automated test. We make no claim without a test.
- An organisation, or an expert it chooses, can ask to inspect the source code, the tests and the election record.
- An external, independent security audit before any binding election.In progress