Inside Balotiq's Ballot Chain: How We Make a Changed Vote Impossible to Hide

When we first wrote about Balotiq, we said every ballot is chained to the one before it, so changing a past vote can't be hidden. That one sentence hides a lot of engineering. This is the longer version: what an election system actually has to guarantee, and how each guarantee is built.

Three promises a voting system has to keep

Every election platform makes the same three promises, whether it says so or not. The result can't be quietly changed after the fact. Nobody can find out how an individual voted. And one organisation's election can never leak into another's. Balotiq keeps each promise with a specific mechanism, not a policy.

Promise one: a changed vote is visible

Every ballot Balotiq stores carries a fingerprint: a SHA-256 hash built from the previous ballot's hash, the election, the position, the encrypted choice and the exact time it was cast. Because each fingerprint includes the one before it, the ballots form a chain. Alter any historical ballot and its fingerprint changes, which breaks the link to every ballot after it. You can't edit one vote quietly. You'd have to rewrite the entire chain from that point forward, and the mismatch is exactly what an audit looks for.

Chains are fragile in one specific way: two votes arriving at the same instant. If both read the same "last ballot" and chain to it, the chain forks and silently corrupts. Balotiq prevents this with a database lock scoped to each organisation, so ballot inserts for one organisation happen strictly one after another, while different organisations never wait on each other. The first ballot in each organisation's chain starts from a fixed starting value, so every chain has a clear beginning.

Promise two: nobody can see how you voted

Each election gets its own RSA key pair (2048 bit). Every selection is encrypted with the election's public key using RSA-OAEP before it is ever written to the database, so no vote is stored in readable form. The private key needed to read them is itself encrypted at rest, under a separate master key.

Decrypting ballots happens at exactly one moment, tallying, and only an organisation administrator can trigger it. An election manager can run an election from start to finish but cannot decrypt a single ballot.

Secrecy also depends on what the database doesn't store. The ballot table has no column that points back to a voter. When you vote, a one time voting token connects your eligibility to the act of casting, and is then marked used. After that, nothing in the system links that ballot to you. Not for administrators, not for us. It isn't an access rule that someone with enough privileges could switch off. The link simply doesn't exist.

Promise three: organisations stay walled off

Universities, associations, churches and pageants all run elections on the same platform. Each organisation's data is separated inside the database itself using PostgreSQL row level security, not just by careful application code. The application connects as a deliberately limited database user that cannot bypass those rules. A bug in a query can't reach into another organisation's voter list, because the database refuses to return it.

The trade off we haven't finished

We believe in saying what isn't done yet. Today, ballots are encrypted on our server the moment they arrive, before they're saved. That means the plaintext choice exists briefly in server memory during the request, even though it is never stored. The stronger design encrypts in the voter's own browser, so the server never sees a readable choice at all. That's on our roadmap. We'd rather tell you that than let you assume it.

Why we build it this way

An election is only as useful as people's belief in the result. Every mechanism here exists to make that belief rest on something checkable, rather than on trust in us. If you're running an election for a school, association, church or competition, Balotiq is live at balotiq.com, and we're happy to walk your committee through exactly how it works.