Security

Data Management & Security Practices

Security is not a feature, it is the foundation of the democratic process.

 
eBallot employs an Identity-first security architecture with end-to-end verifiability to ensure every election is temper-proof, audited, and compliant with global standards including SOC 1 & SOC 2, GDPR, and LMRDA. Below is a technical breakdown of the protocols we use to protect your organization's data and the integrity of every vote.

Core Infrastructure & Data Protection

 

Our Infrastructure is hardened via AWS WAF and Shield to mitigate Layer 7 and DDoS attacks, Ensuring 99.9% uptime during high-traffic election windows. 

eBallot follows a strict Data Minimization policy. Customer data is encrypted at rest using AES-256 and is purged following the retention period .

We provide a trustworthy ecosystem through End-to-End Verifiability (E2E-V) and rigorous third-party validation.  Our E2E-V protocols use verifiable methods that enable each ballot to be independently confirmed as cast, recorded, and tallied as intended, providing transparency and strong assurance that the final results accurately reflect the votes submitted. 

AdobeStock_136283864

Security Quick-Specs:


  Encryption: AES-256 (At-Rest), TLS 1.3 (In-Transit).

 Auditability: Immutable Administrator Fingerprint Reports & Voter Audit Logs.

 Infrastructure: 100% US-Based AWS Data Centers (East/West Redundancy).

  Identity: Support for SSO (SAML 2.0) and Multi-Factor Authentication (MFA).

 Legal: Compliant with LMRDA (Labor), GDPR (Privacy), & Section 508 (Accessibility).

  Third party Audit: Halo Securities Firewall monitoring

  Penetration Testing: Regular third-party penetration testing to identify and remediate potential vulnerabilities before they can be exploited.

AdobeStock_671433083

Security Assessment & Technology Certifications

 

Third-party assessment and certifications are an integral protection mechanism for any digital business.

Thousands of eBallot customers are protected each day by our cybersecurity partners who monitor our products, services, and practices.

Certification/Standard Status What it Means for You

SOC 1 & SOC 2

Certified
Our internal controls for security, availability, and confidentiality are independently audited annually.

ISO/IEC 27001

Aligned
Our information security management system (ISMS) follows the highest international best practice.

GDPR 

Compliant
We respect "The Right To Be Forgotten" and provide full data probability and provacy protection for global users

LMRDA (Section 401)

Supported
Our platform architecture specifically meets the US Department of Labor's requirements for union officer elections.

SSL Domain & Data Encryption

Certified
SSL certificates allow for data to be transmitted and stored securely. It is essential for safely submitting sensitive information.

McAfee Secure

Certified
To maintain this certification, Our network must routinely undergo audits to ensure no Malware & malicious links, No Phishing, & No weaknesses.

Data Privacy Framework

Certified
Reliable mechanism for personal data transfers to the United States from and fully compliant with EU, UK, and Swiss Law.

TRUSTe Verified Privacy

Certified
Our privacy programs, policies, and practices meet the requirements of EU-US and/or Swiss-U.S. Data Privacy Framework Principles

Additional Security Items

Disaster Recovery

Our recovery procedures ensure that your data is accessible, even in the event of a disaster.


Custom Data Setups

We're happy to work with clients on an individual basis to meet your data backup requirements. For more information about our standard and custom data setups, contact us.c

2

GDPR Compliance (European Union)

As a data processor, we follow standard GDPR rules & regulations, as mandated by the EU, on how to handle data originating from the EU.

Specifically, we adhere to the Privacy Shield Principles that apply to Swiss and EU resident data.

For more details visit Section 19 of our Terms of Use, Section 3 of our Privacy Policy, or contact us.

gdpr-compliance

 

Have a question about our security practices?

Let us know.