Security at BallotLink
How the secret ballot is handled
A stored ballot holds a ballot key and the selections on it. The connection between that ballot key and a household lives separately, and the Inspector of Elections reaches it through the inspection tools.
In short: vote choices are stored separately from voter identity.
When results come into existence
No running totals are computed, stored, or displayed anywhere before the inspector finalizes. Counting happens only at finalization, and only if quorum has been met.
What is recorded
Every inspector view of a ballot is logged as an access record. Changes to data are attributed to the user who made them.
A member who votes electronically receives an emailed receipt confirming their ballot was received.
Signing in to BallotLink requires multi-factor authentication.
One ballot per household
The one-ballot rule is built into the system itself, not just the screens a person uses. Repeat submissions are rejected and logged.
How voters sign in
Voters do not hold passwords. Ballot access is a single-purpose personalized link, so there is no voter account to be phished or reused.
How ballots travel
Ballots are transmitted over encrypted connections.
Records
Election records are kept for the one-year statutory period. Keeping them longer than that is the association's responsibility.
What BallotLink doesn't do today
- There is no way for a voter to test their device beforehand.
Reporting a security concern
Email info@ballotlink.vote.