Every vote, verified.
Every election, provable.
An open atlas of election law
Before building voting hardware, we built the map. The TrustVoting Atlas scores every jurisdiction's election code against six transparent methodologies — 97 jurisdictions, 45,064 statute sections, 100 datapoints, all sourced to primary law. It's how we decide where TrustVoting matters most.
Top-scoring jurisdictions
Full leaderboard →Overall = mean across 6 methodologies. No system scores 100%.
Six methodologies
All →How professionally and independently is election administration codified?
How accessible is the franchise under codified procedure?
How well is money in politics regulated and disclosed?
How robust are mechanisms to resolve election disputes?
How well does the framework support voter confidence and audit?
How well does the legal framework defend against vote-altering attacks?
Why this matters for TrustVoting: our hardware enforces integrity inside the precinct. The Atlas measures whether the surrounding legal framework supports it — chain-of-custody rules, audit triggers, campaign-finance disclosure, dispute resolution. The product and the research are the same project.
Elections run on blind trust
Today's voting systems ask you to trust the vendor, trust the software, trust the process. But trust without proof is not security — it's hope.
No proof the software is what was tested
Vendors ship binaries. Counties trust their word. No independent verification exists.
No link between voter check-in and ballot
An unattended machine can print unlimited ballots. Nothing stops it cryptographically.
"Air gaps" that aren't
Network interfaces disabled in software, not removed. A config change away from exposure.
$15,000–$40,000 per precinct
Proprietary, closed systems with vendor lock-in. Counties can't switch without full replacement.
Current systems rely on procedural security — manual checks, chain-of-custody logs, and trust in vendors. TrustVoting replaces trust with proof.
Bitcoin solved double spending.
We solve double voting.
Before Bitcoin, digital money could be copied and spent twice. The breakthrough wasn't faster banks — it was a system where math makes cheating impossible, not rules. TrustVoting brings the same principle to elections.
Prevents double spending
- ◈Every transaction cryptographically signed
- ◈Public ledger anyone can verify
- ◈No central authority needed for trust
- ◈Math enforces the rules, not people
Prevents double voting
- ◈Every ballot session cryptographically authorized
- ◈Public verification package anyone can audit
- ◈No vendor trust needed — proof is public
- ◈Cryptography enforces the rules, not procedures
Four layers of cryptographic proof
From software build to final count, every step is signed, published, and independently verifiable.
Software Assurance Certificate
Every software release ships with a signed certificate binding exact binary hashes, test coverage (100% on critical paths), security scan results, and reproducible build proof. Devices refuse to install updates without a valid SAC.
No other voting system does this.
Election Definition Certificate
Before polls open, a signed certificate is published committing to the exact ballot layouts, contest mapping, and tabulation rules. Every device verifies the definition matches before accepting it.
No other voting system does this.
Ballot Activation Token
At voter check-in, the pollbook issues a cryptographically signed one-time token. The ballot marking device refuses to start a session without a valid, unexpired, unreplayed token. One voter, one ballot — enforced by math.
No other voting system does this.
Public Verification Package
After polls close, a downloadable package is published containing all certificates, device records, and result signatures. Anyone — candidates, press, academics, the public — can independently verify everything matches.
No other voting system does this.
Hardware that enforces integrity
An independent security microcontroller — separate from the main CPU — continuously monitors for tampering. If it detects anything forbidden, the device is permanently quarantined. No admin password can override it.
Open architecture, commodity hardware, no Windows licensing, modular design.
What's actually running your elections?
The machines that count your votes run on discontinued operating systems, end-of-life software, and proprietary code no one outside the vendor can inspect. Here are the verified facts.
Dominion's ballot marking devices run Android 5.1 — an operating system that stopped receiving security patches in 2018. ES&S election servers were found running Windows Server 2008, which reached end-of-life in 2020. These are the systems counting America's votes.
Sources: CISA Advisory ICSA-22-154-01 • Texas Secretary of State examination reports • EAC certification documents
Not incremental. Foundational.
TrustVoting isn't a better version of existing systems. It's a new architecture built on principles that current vendors cannot retrofit.
| Capability | TrustVoting Next-gen | VotingWorks Nonprofit | Dominion Incumbent | ES&S Incumbent | Hart Incumbent |
|---|---|---|---|---|---|
| Cryptographic software assurance (SAC) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Signed election definition (EDC) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Public verification package (PVP) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Ballot activation token (BAT) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Hardware-enforced air gap | ✓ | ✗ | ✗ | ✗ | ✗ |
| Out-of-band tamper quarantine | ✓ | ✗ | ✗ | ✗ | ✗ |
| AI operations intelligence | ✓ | ✗ | ✗ | ✗ | ✗ |
| Open-source verification | ✓ | ✓ | ✗ | ✗ | ✗ |
| Linux-based OS | ✓ | ✓ | Mixed | Mixed | Mixed |
| Paper ballot ground truth | ✓ | ✓ | ✓ | ✓ | ✓ |
| Precinct cost | ~$10k | N/A | $15–40k | $15–40k | $15–40k |
The TrustVoting column reflects our designed, committed architecture (the device is in development) — including open-source code with reproducible builds. Competitor columns reflect their current shipping systems. Based on publicly available information, vendor documentation, and system architecture analysis.
After the election, verify it yourself
You shouldn't have to trust us, the county, or anyone. Here's exactly what we publish after every election and how you — a citizen, journalist, candidate, or researcher — can independently check it.
Download the Public Verification Package
After polls close, we publish a PVP — a single downloadable bundle containing every certificate, device record, and result signature from the election. No FOIA request needed. No waiting. It's public by default.
Verify the software was what was tested
The Software Assurance Certificate (SAC) inside the PVP binds the exact binary hashes to test results, security scans, and a full software bill of materials. You can confirm the code running on Election Day is the code that passed certification.
Verify the ballot definition wasn't changed
The Election Definition Certificate (EDC) commits to every ballot layout, contest mapping, and tabulation rule before polls open. Compare the EDC hash to what devices logged — if they don't match, you'll know.
Verify the results are consistent
Every precinct device signs its poll-open and poll-close records. The result export bundles are signed. You can trace the chain: certified software → locked definition → signed results. All with an open-source verifier tool we provide.
Check voter-to-ballot reconciliation
The Ballot Activation Token system produces a reconciliation report: tokens issued vs. tokens consumed vs. ballots scanned. If the numbers don't add up, it's visible — not buried in a manual log.
What we publicly disclose after every election:
No vendor trust required. No FOIA requests. No court orders. Public by design.
Your job gets easier, not harder
We know what election administrators deal with: aging equipment, angry vendors, confusing updates, certification headaches, and public distrust. TrustVoting is designed to make your life simpler — not add complexity.
Smooth Election Day Setup
Each device verifies its own software and election definition at boot. If everything checks out, green light. If something is wrong, the device tells you before polls open — not after. No guesswork.
Seamless Security Updates
Updates ship with a signed Software Assurance Certificate. Load the update media, the device verifies the signature and installs. No vendor technician needed on-site. No hoping the update didn't break something — the SAC proves it passed testing.
VVSG 2.0 Certification Built In
We design for federal VVSG 2.0 certification from day one — not as an afterthought. Our modular architecture means the core platform is certified once, with device-specific extensions as lightweight additions. Fewer recertification triggers for you.
Real Answers for Public Trust
When a citizen or reporter questions the results, you can point them to the Public Verification Package — a published, downloadable proof bundle they can check themselves. No more "trust us" — you have cryptographic evidence.
AI Operations Dashboard
Real-time device health across all precincts. Printer jams, scanner errors, battery levels, queue estimates — all in one place. Predictive alerts tell you which device might fail before it does. Spare positioning recommendations based on actual data.
Dramatic Cost Savings
~$10,000 per precinct vs. $15,000–$40,000 from incumbents. $1,200/year support vs. opaque multi-thousand-dollar contracts. Open architecture means you're never locked into a single vendor. Linux means no Windows licensing fees.
Ballot Accounting That Actually Works
The Ballot Activation Token system automatically reconciles voters checked in, tokens issued, ballots printed, and ballots scanned. At poll close, you get a reconciliation report — not a stack of paper to count by hand.
Hardware You Can Trust
Tamper detection is hardware-enforced, not software-configured. If a device is compromised, it quarantines itself — you don't have to catch it. Sealed chain-of-custody records are cryptographically signed, not just initialed on a form.
What changes for your office
- ✗ Vendor technician on-site for updates
- ✗ Manual hash verification procedures
- ✗ Paper-based ballot reconciliation
- ✗ "Trust us" answers to public inquiries
- ✗ Reactive equipment troubleshooting
- ✗ $15k–$40k per precinct
- ✓ Self-verifying signed updates
- ✓ Automatic device self-check at boot
- ✓ Automated cryptographic reconciliation
- ✓ Public proof bundle for anyone to verify
- ✓ Predictive AI monitoring dashboard
- ✓ ~$10k per precinct
We build it. You prove us right — or wrong.
We develop TrustVoting in-house. What we need is what makes election security credible: independent, unbiased academic review from researchers with no stake in the outcome. This is how trust is earned — through peer scrutiny, not marketing.
Independent Security Audit
Evaluate our tamper detection, cryptographic protocols, and boot chain. Publish your findings — favorable or not.
Peer Review & Publication
Our architecture introduces novel approaches to verifiable elections. Analyze, critique, and publish in top-tier venues.
Technical Advisory Board
Provide ongoing expert guidance on security architecture, certification strategy, and threat modeling.
Pilot Evaluation
Design and conduct independent evaluations of real-world pilot deployments. Measure what works and what doesn't.
Joint Grant Proposals
NSF SBIR and SaTC funding for independent evaluation of verifiable election infrastructure — a novel and fundable research area.
Graduate Research
Election security, applied cryptography, embedded systems verification — real problems for thesis-level work.
Let's build elections people can verify
We're talking to university labs this week. If your research touches election security, verifiable systems, or applied cryptography — we should talk.