Why Balotiq Chains Every Ballot

Elections fail people in two ways: either the process is opaque and people don't trust the count, or it's so cumbersome that turnout suffers. Most platforms we looked at while building Balotiq picked one failure mode or the other — a simple form that nobody trusts, or a heavyweight verification process nobody finishes.

The part we weren't willing to compromise on was trust in the result. So every ballot Balotiq records is encrypted and stores a hash of the ballot before it. Change a single historical vote and every hash after it stops matching — the tampering isn't just theoretically detectable, it's structurally impossible to hide. It's the same idea a lot of tamper-evident logging systems use, applied to a ballot box instead of a server log.

That covers registered elections, where we import an eligible-voter list and enforce one ballot per voter. The other half of Balotiq is public pay-per-vote — pageants and open contests where there's no membership list to check against, just a phone number to verify and a vote to bill. Different trust problem, same underlying principle: verify what can be verified, make the rest visible rather than assumed.

One more constraint shaped the build: every organization's data is walled off at the database level, not just in application code. A bug in a query shouldn't be able to leak one client's voter list into another's results.

Balotiq is still early-stage and actively being built out, live at balotiq.com.