The ballot box that anyone
can audit.
We do not ask you to take our word for it: we give you the tools to check everything. This is the machinery inside, with its technical names and no small print.
Change one ballot and everything stops adding up.
In summary: If anyone changes a vote, the figures stop matching: during the Vote the administrator and the election monitors can check this whenever they like, and after it closes, anyone can.
Each Vote builds a Merkle tree: the cryptographic structure that makes any change to a vote detectable by anyone.
Change a ballot and the root no longer matches.
Each ballot is a leaf of a Merkle tree whose root is sealed at close with an independent time authority. Anyone can recalculate the tree with the published ballots: if the same root is not obtained, the record is not the one that was sealed.
The leaves are ordered by random identifier: the order of issue is not stored anywhere.
Guide: verify it yourself, step by step →Each voter can verify their own ballot.
When you vote you receive an anonymous receipt. With it you can check that your Ballot is in the final tally count — without revealing to anyone how you voted.
If it is enabled in the Vote, you can also set a personal key on your Ballot: you then use it to find your Ballot later, once the Vote has been sealed.
How the receipt works →A PDF record that reveals any tampering.
On closing, the record is generated with the root of the tree, the time stamp and a QR code. Scan it — or enter its code — and the platform recalculates everything in front of you.
Verify a record now →The same guarantees, without the smoke and mirrors.
A sealed Merkle tree offers the same verifiable immutability that a blockchain promises, without its cost, its slowness or its intermediaries. We explain why it is not magic — and why you do not need it.
The blockchain myth in voting →Technical details
- Fingerprint of each ballot
- An SHA-256 hash computed over its identifier, the ballot contents and its weight in the count.
- Merkle tree
- The fingerprints are combined in pairs until there is a single root. The leaves are ordered by random identifier, never by time of issue.
- During voting
- Each Ballot leaves its fingerprint when it is cast and is copied at that same moment into a separate register in the database. The integrity check compares Ballot, fingerprint and copy: it is launched by the administrator and the election monitors whenever they like and is run again automatically on closing. If anything does not match, the record is not sealed.
- Intermediate roots
- Every 100 Ballots or every hour, an intermediate root of the tree is fixed, as a witness to what has been cast up to that point.
- Timestamp
- On closing, the final root is sealed with an RFC 3161 time stamp from an external authority: only its SHA‑256 fingerprint travels, never the Ballots.
- Verification
- The record contains the root, the time stamp and a QR code. The public verification recalculates the tree with the published Ballots and compares the roots.
Protected in transit. Encrypted backups.
In summary: Your data travels protected and backups are stored encrypted. Here we tell you exactly how.
Open-standard encryption where it protects: in the connection, in access and in backups. Here are the specifics.
In transit
Connections to the platform are encrypted with TLS 1.3 (or TLS 1.2 if your browser does not yet support it). TLS is the protocol that encrypts the communication between your browser and the server — the padlock in the address bar — and version 1.3 is the latest and most robust. Nothing travels in plain text.
Backups
Daily backups are encrypted with AES-256 before leaving the server, and a backup is never stored unencrypted.
At login
Two‑factor verification (2FA) for administrators, single‑use voting links and passwords that are never stored in plain text. Identifiers in URLs are always encrypted.
Technical details
- Protocol
- HTTPS with TLS 1.3, or TLS 1.2 for older browsers; TLS 1.1 and below are rejected. The HSTS header (one year, including subdomains) makes the browser stop trying to use an unencrypted connection.
- Backups
- Daily dump compressed and encrypted with AES‑256‑CBC before leaving the server; the key is derived with PBKDF2‑SHA256 with 100,000 iterations. If the key is missing, the backup is not made: a backup is never stored in plain text.
- Passwords
- They are stored with bcrypt, a slow hash with its own salt: even with access to the database they cannot be read.
- Identifiers
- The internal numbers that appear in web addresses are encrypted with AES‑256 and a separate key for each area of the application, so that they cannot be guessed or enumerated.
- Session and forms
- HttpOnly, SameSite and Secure cookies; the session identifier is renewed on login. Each form and request carries a CSRF token that rotates every hour.
- Attempts
- By default, five failed logins in 15 minutes lock the account. Verification codes, voting links and public record verification all also have an attempts limit.
We know that you voted. Never what you voted.
In summary: Once your vote is recorded, nothing links it to your identity, and nobody can vote twice, not even through different channels.
The link is destroyed when the vote is cast.
The identity ↔ content correlation is destroyed upon ballot submission. Separate tables, no correlatable key. Once the vote is recorded, not even an administrator with full database access can reconstruct who voted for what.
One vote per person, whichever way they come in.
You can vote by signing in with a username and password, with a personal single-use link, or at the in-person polling station. All three routes register participation in the same record, which only accepts one entry per person and Vote: once someone has voted one way, they cannot use another. That record states that you have voted, never how.
Anti double-voting, explained simply →Technical details
- Storage
- Records of who has voted and what has been voted are stored in separate tables, with no key linking them.
- Order of casting
- It is not stored: ballots are identified with a random value, so the voting time cannot be matched to the login time.
- Double voting
- A unique constraint (person + Vote) on the participation record, within the same transaction that saves the ballot: if two votes arrive at the same time, only one goes through. For link voting, the link is also marked as used in that same transaction.
- Receipt
- The verification code is random and unrelated to your account: only whoever has it can find their ballot.
Election monitors for each candidacy, with read-only access.
In summary: Each candidacy can have someone watching the process live, without being able to touch it.
Transparency is not a PDF at the end: it is being able to watch the process while it is happening.
Read-only access for those supervising.
Election monitors track the electoral roll, turnout and closing in real time, without being able to touch the administration. Each candidacy can appoint its own.
In-person ballot box, digital safeguards.
For assisted in-person voting, the polling station records who has voted and the ballots are entered afterwards, without tying them to anyone. Ballot secrecy is preserved off-screen as well.
- ID The polling station looks the person up on the electoral roll and marks them. From that moment on, they can no longer vote online.
- Ballot in the ballot box Vote on paper and place the ballot in the physical ballot box.
- Opening At the end, the polling station opens the ballot box and counts the ballots.
- Count Ballots are entered one by one, with no data about who cast them.
- Closing and record The record compares the number of people marked, ballots counted and ballots entered. If they match, it shows “Matches”; if not, it flags this alongside the polling station notes.
Your data lives in Europe. And it stays here.
In summary: Your data stay in Spain, are only used for your Vote, and are never sold.
All our servers are hosted in data centres within the European Union (Spain). We have fully complied with the GDPR from day one: the data from your Elections —votes, electoral roll and participants— are processed without transfers outside the European Economic Area and without third parties. No small print and no surprises.
GDPR-compliant
We only process the data that are essential for the electoral process, with a clear legal basis and defined retention periods.
Zero transfers outside the EEA
Voting data never leaves the European Economic Area. (If you choose to sign in with your Google or Microsoft account, that authentication goes through them.)
We never sell your data
No advertising, no profiling, and no transfer to third parties. Your electoral roll and your results are yours — and yours alone. Period.
No voting system protects everything.
We prefer to be clear with you. A guarantee that is not met is worse than offering none at all.
| Risk | Is it covered? | How |
|---|---|---|
| Someone changing a vote after closing | Yes | The root of the tree is sealed with a timestamp: anyone can recalculate it and see whether it matches. |
| Your vote not being counted | Yes | With your verification code you can check that your ballot is in the tally count, exactly as you cast it. |
| Someone voting twice | Yes | Each person has a single-use access that is consumed when they vote. |
| Your identity being linked to your vote once it is recorded | Yes | They are stored separately, with no key linking them, and without the order in which people voted. |
| What happens on the server at the moment of voting | In part | Whoever controls the server while the Vote is open could link voter and ballot before it is recorded. That is why secrecy from the platform operator is a commitment in our terms; towards the organisation and towards third parties, it is a technical guarantee. |
| Someone using your personal access | In part | Access is single-use, but if someone gets into your email or your mobile before you do, they could use it. Protect them, and notify the organisation if you receive an access you were not expecting. |
| Who was entitled to vote | No | The electoral roll is decided by the organisation. Election monitors can review it before opening the Vote. |
| A vote that never made it into the system | No | What is recorded is compared with what was sealed: something that was never stored does not leave a visible gap. |
| Someone putting pressure on you while you vote from home | No | No remote vote can prevent this. If it is a risk in your process, combine the online Vote with an in-person ballot box. |
| Your device being infected | No | It depends on your device: vote from an up-to-date device. |
Your electoral process, protected from the first vote.
Choose your next step.