One ballot. Verifiable end to end.
Follow a single vote from a voter's hand to a result anyone in the world can re-check. Four zones, one rule: the paper ballot is the truth, and data only ever leaves a voting machine on sealed, signed media a person carries by hand — never over a network.
Cast as intended
You see and check your own printed paper ballot before it goes in the box.
Recorded as cast
The paper ballot itself is the record. The machine only reads and counts it.
Counted as recorded
Every total is digitally signed and can be re-checked against the paper by anyone.
The ballot's journey
Read left to right. Notice what is missing: no line ever runs backward into a voting machine, and nothing touches the internet until the very end.
How to read this diagram
Software anyone can inspect
Before an election, the software is built in the open so experts can confirm the code that will count the votes.
- 1Public, reproducible builds — anyone can rebuild the exact software and get the exact same fingerprint.
- 2Each release is digitally signed by multiple key-holders (a Software Assurance Certificate).
◆ Signed software release + build fingerprint
✓ Rebuild from source; confirm the fingerprint matches
The voting center
Where you vote. Every machine here is sealed, tamper-evident, and completely offline.
- 1Check-in: a poll worker confirms you're eligible and issues a single-use ballot token.
- 2Mark: the ballot-marking unit prints a paper ballot you can read and check.
- 3Verify & drop: you confirm the paper is right and place it in the ballot box.
- 4Count: the scanner reads the paper and keeps a signed, tamper-evident running total.
◆ Paper ballot in the box + signed device totals
✓ Every ballot exists on paper, independent of any machine
County / State HQ
Sealed results are hand-carried here, checked, added up, and certified.
- 1Import: sealed media from each center arrives with a logged chain of custody.
- 2Verify: every device signature and certificate is checked before a single number is counted.
- 3Aggregate & certify: totals are combined and the official result is signed.
- 4Publish: a Public Verification Package is prepared for the whole world.
◆ Signed county canvass + public verification package
✓ Re-add the signed precinct totals yourself
Public verification
The only part that touches the internet — and it can only publish, never control anything.
- 1Results, certificates, and audit reports are published openly.
- 2An append-only transparency log makes it impossible to quietly change a published number.
- 3A free, open-source verifier lets anyone confirm the signatures and totals.
◆ Public results + transparency-log proofs
✓ Run the open verifier — trust the math, not the messenger
Voting center
What one voting unit actually is
Every machine in a center is the same hardened, single-purpose computer — built to prove it hasn't been touched.
No network, ever
No Wi-Fi, no Bluetooth, no Ethernet. Data moves only on sealed media a person carries.
Tamper-evident by hardware
Sensors watch the case, ports, and seals. Any intrusion trips an irreversible flag and takes the unit out of service.
Sealed keys (TPM)
The machine's keys unlock only if the software is unmodified and no tamper was detected.
Paper is the record
The unit prints a ballot you verify by eye. The paper — not the screen — is what gets counted.
Hash-chained audit log
Every action is written to an append-only log that can't be rewritten after the fact.
Signed at close
At poll close the unit produces one signed, sealed export bundle — the only thing that ever leaves it.
Three roles, one hardened base
Check-in unit — confirms eligibility, issues the single-use ballot token.
Ballot-marking unit — prints the paper ballot you verify and cast.
Scanner / counter — reads the paper and keeps the signed totals.
How you can verify the result — without trusting us
Verifiability means you don't have to take anyone's word for it. Here's what any citizen, journalist, or party can check independently.
Check the software
Rebuild the public source code and confirm its fingerprint matches the signed release that ran on the machines.
Check the count against paper
The paper ballots are the ground truth. A risk-limiting audit compares a random sample of paper to the reported totals.
Check the signatures
Download the Public Verification Package and run the free, open-source verifier to confirm every total is authentically signed.
Watch it can't be changed
The append-only transparency log means a number, once published, can't be quietly altered without everyone seeing.
Explore how common each gap is
See how today's elections score against these safeguards across the jurisdictions we've analyzed.
The same journey, in words
A plain-language, screen-reader-friendly walkthrough of the diagram above.
- 1
Before the election, the voting software is built in the open and digitally signed, so experts can confirm exactly what will run.
- 2
At the voting center — fully offline — you check in and receive a single-use token.
- 3
A machine prints a paper ballot. You read it, confirm it's right, and drop it in the ballot box.
- 4
A scanner counts the paper and keeps a signed, tamper-evident running total.
- 5
At close, each machine writes one signed, sealed export. It is hand-carried to HQ — nothing is sent over a network.
- 6
HQ checks every signature, adds up the totals, certifies the result, and publishes a public verification package.
- 7
Anyone, anywhere can download the results and run a free verifier — and the paper ballots remain to audit against.