Architecture
Security Practices
Our backend and frontend systems implement modern standards to protect every election.
Secure Authentication
Administrators authenticate using JSON Web Tokens (JWT) with automatic session expiry and rotation.
Password Hashing
Admin passwords are never stored in plain text. We use industry-standard PBKDF2/argon2 hashing algorithms.
Role-Based Access Control
Strict isolation between coordinators, candidates, and voters. Voters carry zero system login credentials.
TLS/HTTPS Encryption
All traffic is routed over TLS connections, encrypting every byte between voter browsers and backend servers.
Single-Use Voter Tokens
Each voter receives a cryptographically unique, time-limited link via SMS. Tokens are invalidated immediately after use.
Election Access Controls
State machines enforce strict voting windows. Ballots cannot be submitted before start times or after end times.
Audit Logs & Receipts
VoteSea tracks system events and issues cryptographic receipts so voters can verify their ballot was included.
Rate Limiting
IP-based rate limits protect all endpoints from brute-force voting attempts and automated script attacks.
Automated Backups
Scheduled database snapshots protect election data from infrastructure failures and service interruptions.
Best Practices for Organizers
Platform security is a shared responsibility. Keep your election secure by following these operational guidelines:
- Use strong, unique passwords for all administrator accounts.
- Restrict admin credentials strictly to authorized election commission members.
- Inspect the imported voter CSV for duplicate phone numbers before launch.
- Run a complete dry-run test election using dummy voter links before going live.
- Monitor voter turnout on the admin stats dashboard throughout the voting window.
Responsible Disclosure
We welcome security researchers and ethical hackers who want to help audit our security posture.
Please report vulnerabilities privately to security@votesea.com and allow our team time to investigate and patch before any public disclosure.