Secret ballot and security
How ElectionKeeper protects the secret ballot, keeps ballots sealed until voting closes, and lets every voter confirm their ballot was counted. We also say plainly what it doesn't do.
Nobody can link your ballot to you
Your right to vote is checked with a blind-signed token: we confirm your voter key and sign a token for you without ever seeing it. Your ballot is then sent with that token only, never with your key or your name.
So nothing we store links your ballot to you, even for us. Ballots carry no time and no voter, request logs for voting are switched off, and ballots are reshuffled when voting closes. Our database keeps no history from before that shuffle.
Ballots stay locked until voting closes
Your browser locks your ballot before it's sent. It's time-locked to the closing moment using a public randomness network run by independent organizations: the key that opens it doesn't exist until voting closes. Until then, nobody can read any ballot or any count, including ElectionKeeper, the organizers and our hosting providers.
Organizers choose one of two security levels for each election:
| Standard | Strict | |
|---|---|---|
| Ballots linked to voters | Never | Never |
| Ballots readable before voting closes | No | No |
| Who can open results | The organizers, a minute or two after voting closes | Only organizers holding the election's results key, which ElectionKeeper never has. Optionally, an observer must approve too. |
| If voting is extended | Ballots cast before the original closing time can technically be opened from then, by someone with database access. The product never shows them before the final close. | Nothing can be opened until the organizers unlock the results. |
| Organizer setup | None | A short key setup at launch, and a recovery code to keep safe |
Results are only ever published by the organizers. Nothing is published automatically. In Strict, if every copy of the results key is lost, that election's results can't be recovered by anyone.
Confirm your ballot was counted
After voting, you get a ballot code, worked out by your own browser from your locked ballot. After voting closes, the list of counted codes is published. Find yours to confirm your ballot is in the count, unchanged.
The code doesn't reveal your choices, and ballots are never published, so nobody can use your code to see how you voted. Write-ins aren't published either.
- Results are digitally signed when they're produced. Anyone can check the published results haven't been changed since.
- The admin log is tamper-evident: actions such as launching, extending or voiding a ballot are recorded, and each entry is chained to the one before it.
- Ties can't be steered: the random seed that breaks ties is committed to when the election launches and revealed when it closes.
- Observers (from the Standard plan up) can watch the process and co-sign the official report, without ever seeing voter details or ballots.
Voter keys and sign-in
- Each key is random, works once, and can be revoked or reissued before it's used.
- Keys are stored as a keyed hash for checking, plus an encrypted copy whose encryption key is kept outside the database. Revealing or printing keys is recorded in the admin log.
- In voting links, the key sits after the
#, the part of a web address browsers never send to servers. - Organizations can also ask voters for a second detail, such as a member number, so a forwarded invitation isn't enough to vote.
- Staff must use two-factor sign-in or a passkey before revealing or exporting keys, unlocking results, or running a Strict election.
Your organization's data
- Each organization's data is walled off in the application and again in the database itself.
- Accounts are protected by passwords checked against known data breaches, one-time email codes, rate limits and bot protection.
- Voter names and emails are deleted a year after voting closes. The election itself, with anonymous ballots and results, is kept for 12 months (24 on the Organization plan). See the privacy policy.
- We don't sell data, and we don't use it for advertising.
What it doesn't do
Being clear about limits matters as much as the protections:
- It doesn't prove the count itself. Your code confirms your ballot is in the count we report; the count is backed by our digital signature, not a public recount.
- It assumes the voting page is the published version. The voting page's code is open source with published fingerprints, so anyone can check what's served. Someone who could change the software, or deliberately spy on our systems while voting is open, could get around these protections.
- It can't stop someone watching you vote. No online voting can. Nothing we give you afterwards proves how you voted, although a technically skilled voter could extract proof from their own browser.
- It isn't for public or government elections, or any vote the law requires to be run a particular way.
Reporting a security issue
If you think you've found a vulnerability, email security@electionkeeper.com. Please give us a chance to fix it before telling anyone else. We'll reply and keep you updated while we work on it.