Security

What exists today: passwordless email-code sign-in with attempt limits and rate limits, per-organization access control, hash-chained append-only audit events, strict security headers and a no-inline-script content policy.

Limits: the platform has not been independently audited or certified, and must not be used for binding or statutory elections. Ballot secrecy design will be published before voting is enabled.