1. How is my ballot kept secret, and can my vote ever be linked to me or my voter credentials?
Voter identity and ballot content are handled by two separate systems and are never stored together.
Authentication happens first. The voter proves eligibility using the credentials on their Voter Information Letter. Once that check passes, the voter has access to their ballot and once submitted, the voter’s record is marked to show that the elector has voted, which is what prevents a second ballot. That record lives in the voters’ list system and contains no ballot information.
The ballot is then cast separately and deposited into the encrypted Ballot Lockbox with no voter identifier attached to it. The Lockbox holds only anonymous ballots. There is no field in it linking a ballot to the elector who cast it, so no query can produce that association, by Voatz or by anyone else. Once a ballot is cast, it is completely anonymous. Another way of thinking of this is the double-envelope system often used for mail-in ballots. An inner “security” envelope holds the ballot, while a voter signs an outer “signature” envelope that holds the inner envelope. Just as a clerk would verify the signature on the envelope and put the signed outer envelope and inner ballot envelope into separate piles, so the Voatz platform verifies the voter’s credentials, and removes all data connected to the voter from the ballot package, leaving an anonymous ballot to store. After the ballot is separated from all personally-identifying information, the system generates a random string of characters to identify the ballot within the system; this makes the ballot anonymous. (Furthermore, this allows an auditor to establish that there are an equal number of voters and cast ballots, without being able to determine which ballot belongs to which voter.)
The Lockbox stays sealed for the entire voting period. It can only be opened at the close of voting, and only when the Election Trustees appointed by the municipality combine their individual Secure Tokens. No one at Voatz holds those tokens. The Clerk controls when results become visible, not the vendor.
2. Who independently verifies that the online voting system is secure and counts every vote accurately?
The system is subject to independent third-party security assessment, not self-certification.
For the 2026 Canadian municipal elections, the Voatz voting platform underwent an application penetration test conducted by Digital Boundary Group, an independent Canadian cybersecurity firm, with the final report issued in August 2026. That assessment identified no relevant risk vulnerabilities.
Voatz also operates under an ISO/IEC 27001 certified information security management system. That certification is issued and periodically re-audited by an accredited external body, which means the security controls, access management and operational procedures are verified by an independent auditor rather than asserted by the vendor.
The platform has been used and assessed across multiple jurisdictions and election cycles, including Canadian municipal elections in 2022 and 2026, the 2024 Mexican federal election, and state and federal elections in the United States from 2020 through 2026.
Beyond third party testing, the municipality verifies accuracy itself. The municipality conducts its own rounds of testing of the voting platform, culminating in Logic and Accuracy (L&A) testing. In that test, the Clerk’s staff generate a Zero Report confirming the system contains no ballots, cast a controlled set of test ballots with a known expected result, close the test election and generate the results. The output must match the expected tally exactly. This test is run by municipal staff on the municipality’s own ballot, and it is the municipality’s direct evidence that votes are counted accurately. Once the L&A testing is completed, the Online Voting System is ready for the live election.
3. With today’s advances in technology, including artificial intelligence, how is the online voting system protected against hacking?
The system is built on multiple independent layers of protection, so that no single point of compromise can alter or expose a ballot.
Encryption. Ballots are encrypted within the user’s device at the moment they are cast and remain encrypted at rest inside the Ballot Lockbox for the entire voting period. Access to the infrastructure does not produce readable ballots.
Distributed key control. The keys that open the Lockbox are not held by Voatz. They are split among the Election Trustees appointed by the municipality, and a minimum number of them must act together before results can be produced. There is no vendor override.
Certified security programme. All access to the platform is controlled and logged, and the system is operated under an ISO/IEC 27001 certified information security management system that is externally audited.
Adversarial testing. The platform is independently penetration tested by Digital Boundary Group, who attempt to breach it using the same techniques an attacker would. The 2026 assessment found no relevant risk vulnerabilities.
Verifiability. Voters receive confirmation that their ballot was submitted. The Zero Report and Logic and Accuracy testing establish a verified baseline before any live vote is cast. Together these mean the count is independently checkable by the municipality rather than something the public is asked to take on trust.
