How MyVoteMatters protects a vote

A plain account of what is enforced today and what is not yet.

Two jobs kept apart

An election must check that the right person votes once, and it must stop anyone learning how they voted. MyVoteMatters keeps those jobs in separate database roles:

The application role manages elections and voter eligibility. It has no permission to read ballots.
The counting role can read encrypted ballots, and only after voting closes. It has no permission to read the voter roll.
Ballots carry no voter reference, no timestamp and no sequence number, so there is nothing to join them on.

Encryption

Each ballot is encrypted (X25519, HKDF-SHA256, AES-256-GCM) to a key created when the election is approved. The private key is handed once to the approver and never stored by MyVoteMatters. Ballots are padded to a fixed size so their length reveals nothing.

Voting links and receipts

Each voter gets a private link. The secret in it sits after the #, which browsers never send in server logs, and only a hash of it is stored. After voting, the voter gets a receipt code that proves the ballot was accepted, without revealing the choice. Anyone holding it can check it on the verify page.

Integrity

One vote per entitlement is a database constraint with row locking, not an application check.
Recording that an entitlement voted and storing the ballot happen in one transaction: neither can happen without the other.
Accepted ballots, receipts and counts cannot be edited or deleted, even by the schema owner.
Counting refuses to produce a result unless ballots match recorded votes by number and voting units.
Each organisation's data is isolated by row-level security in PostgreSQL.

Known limits of this pilot

The server encrypts the ballot, so choices exist briefly in server memory.
In weighted votes, a very large holding can be recognisable from its size during counting.
A single tally key holder can decrypt. Production should split the key among independent trustees.
Whoever holds the database administrator password can bypass role separation.
Administrator accounts do not yet have multi-factor sign-in.

MyVoteMatters is not STQC-certified and should not be used for legally binding shareholder votes until certification and review by Indian corporate counsel are complete.