A verifiable pilot that runs alongside your normal vote. Every voter, observer, and reporter can confirm the result independently — and your paper record still governs. Zero risk to your certified count.
You can't settle that with a louder assurance. A recount just re-runs the same trust in the same people. What actually ends a dispute is letting the people who voted — and anyone watching — check the result for themselves.
The pilot runs alongside your existing process. Nothing about how you vote today changes.
For a public pilot, the outcome is a demonstration. Your official result stands untouched.
The paper record stays authoritative. Verification is added on top — it never replaces the count.
Established voters and members enroll automatically. Anyone with an identity question verifies in person — or remotely with a licensed notary over secure video. No courthouse trip.
A blind-signature step proves the voter is eligible while making the ballot impossible to trace back to them.
The vote is encrypted on the device before it leaves it. No individual ballot is ever opened — only the totals.
A tracker code confirms your ballot is in the count, without revealing your vote. Pressured? Re-vote before close — the later ballot quietly supersedes the first.
Every claim on this page is demonstrable in a browser, today — before you commit to anything. Cast a ballot, check your own receipt, then try to decrypt the result with too few custodians and watch it refuse.
The working reference implementation. No signup, nothing to install.
A risk-limiting audit compares the pilot to the paper record and confirms the outcome to a stated confidence.
The full election record is published. Anyone can run the verifier and get a single VALID — no operator to trust.
Every voter can check their receipt on the public board. The more who check, the more of the count is witnessed by the people who cast it.
Source published at pilot / independent audit included / no single custodian can read the votes.
You control your own membership roll, so enrollment is straightforward and a binding internal election can run in a matter of weeks — a board seat, an officer race, a bylaw vote.
Every pilot ends with a public audit report — the result, the paper comparison, and the cryptographic proofs, written so any skeptic can re-run them. It's the document that turns one clean election into the reason for the next.
Here's the template every pilot's report is built from — so you can see exactly what you'll be able to publish afterward.
Not in the way people rightly fear. It's a verifiable pilot layered on a paper-governed election. The paper record stays authoritative; the system adds a way for anyone to check it. We never ask you to replace your ballots with an app.
The design assumes someone will try. Ballots are encrypted, the announced tally carries a public proof it wasn't altered, and tampering with the public record breaks a hash anyone can check. The point isn't that attacks are impossible — it's that a miscount can't hide.
A voter under pressure can quietly re-vote any time before close; the later ballot supersedes the first, so a coerced or sold vote can be undone in private. It's the strongest available answer — and honestly, it reduces coercion rather than eliminating it entirely. We don't overstate it.
Yes, by construction. Identity is checked once at enrollment, then cryptographically separated from the vote. No record links a voter to their ballot, and only aggregate totals are ever decrypted — by a quorum of custodians you choose, never one party alone.
In-person options remain, and remote verification is done with a licensed notary over secure video — the accommodation is built into the enrollment design, not bolted on afterward.
No. Paper governs. The pilot is parallel and, for public elections, non-binding. It adds independent verification; it takes nothing away from what you already do.
Two honest limits. It can't fully rule out malware on a voter's own device altering a vote before it's encrypted — receipt-checking is the mitigation, not a cure. And results at pilot scale don't automatically transfer to a large public electorate. Both are stated in every audit report, up front.
Not yet — the first pilot is in scoping, and we'd rather say so than imply otherwise. What exists today is a complete working system you can test right now, built on the same primitives used by ElectionGuard in real U.S. elections. Being an early partner means shaping the process and owning the first published audit; it also means accepting that you're first. We'd rather you weigh that honestly than find out later.
A short call to pick one race or question and set dates. We bring the platform, the cryptographic setup, and the published audit. You bring the race and your roll.
Start with a callKristen Hall · kristen@bornbetween2generals.com