How ballots stay secret
A ballot is sealed on the owner's own device and stored with no link to their name. VoteStead cannot connect a voter to a ballot, and nobody opens the box until voting closes and two of the three key holders agree. The one exception is written plainly further down this page, because a security claim you have to qualify later is worth nothing.
A ballot carries no name
Ballots are stored with no name, unit or time, in a separate database with its own login. The system that knows who voted never holds a ballot, and cannot be asked which one is yours.
Nobody opens ballots early
The key that opens ballots is split into 3 shares. Two holders must enter their shares after voting closes.
Every step leaves a record
Ballots and admin actions each link to the entry before by hash. Changing any entry breaks every link after it.
Only what the election needs
VoteStead collects the roster fields your association already keeps and deletes election records after the retention period.
One ballot's journey
The owner confirms identity
A one-time code goes to the email or phone on file. VoteStead marks the unit as having received a ballot.
The owner receives a blind token
VoteStead signs a voting token without seeing it, so the signed token never matches back to the owner. This uses RSA blind signatures (RFC 9474).
The ballot is sealed on the device
The owner's browser encrypts the ballot with the election's public key before sending it.
The ballot box stores it with no name
The sealed ballot and a hash of its token go to a separate database with its own login. The owner's session ends when the ballot is confirmed.
Two key holders open the count
After voting closes, 2 of the 3 shares rebuild the key in memory. The key is never saved. Managed elections seat VoteStead, an independent inspector and one board member not up for election on the three shares. A self-serve board names its own three holders, or adds the independent VoteStead key holder, a $149 add-on, so no two people inside the community open the ballots alone.
Controls
| Control | What it means for your election |
|---|---|
| Separate registry and ballot databases | The owner list and the ballots live in different databases with different logins. No query joins them. |
| Sealed ballots (libsodium sealed boxes) | A ballot is unreadable from the moment it leaves the owner's device until the count. |
| 2-of-3 key sharing (Shamir secret sharing) | No single person, including VoteStead, opens ballots alone. |
| SHA-256 hash chains | A missing, added or changed ballot or audit entry shows up in the integrity check. |
| No ballot timestamps | Nobody matches a ballot to the moment an owner signed in. |
| Authenticator app sign-in for admins | A stolen password alone does not open the admin console. |
| Encryption of stored secrets (AES-256-GCM) | Voting links, key shares waiting to be viewed and admin sign-in secrets are encrypted in the database. |
| Roster lock during voting | Nobody changes an owner's email or phone to capture another unit's vote. |
Where we stand today
We publish what we have and what we do not.
| SOC 2 report | Not held |
|---|---|
| Admin sign-in with authenticator app | Required for every admin account |
| Encrypted connections | HTTPS only, with HSTS |
| Third-party trackers or ads | None |
The one exception, stated plainly
Every receipt carries a tracker code so an owner can confirm their own ballot reached the count. That code is derived from the sealed ballot, which means it points at one specific ballot in the box.
So there is a way to read a named owner's ballot: obtain that owner's tracker code from them, and hold two of the three key shares. The person who runs the count types two shares. A board member who both runs the count and collects tracker codes from owners could therefore read those owners' ballots.
This is the cost of letting owners verify their own vote, and every system that offers verification carries some version of it. Three things hold it down. An owner's tracker code is theirs and nobody can compute it without the sealed ballot or the published list. VoteStead tells owners on the receipt and in the thank-you email to keep the code private. And on a managed election, or any self-serve election that adds the independent VoteStead key holder, two of the three shares are never inside the community, so no group of owners can open ballots on their own.
We write this here rather than leave it to be discovered, because a security claim that needs qualifying later is worth less than a smaller claim that holds.
Report a security problem
If you find a weakness in VoteStead, email the details to security@votestead.com or use the contact form with the topic set to Security. Do not access other people's data or disrupt a live election while testing. We confirm receipt and tell you what we fixed.