Every vote leaves a record

Receipts and tracking codes voters can check afterward, a tamper-evident audit chain, and end-to-end verifiable ballots for online, yes/no, one-member-one-vote, non-proxy votes.

Every vote cast online produces a receipt and a tracking code. After the meeting closes, a voter can check that code against a public record and confirm their vote was counted — without revealing how they voted to anyone else looking at the same record. In-person voting is recorded as an aggregate count rather than individual ballots, so it carries a signed tally attestation instead of a receipt per voter.

Every action on a ballot — opened, closed, a vote cast, an in-person count entered — is appended to a hash-chained audit log. Altering an earlier entry breaks every hash that follows it, so the chain itself proves nothing was changed after the fact. In-person counts carry a cryptographically signed attestation from the administrator who entered them.

Online ballots that are yes/no, one-member-one-vote, and free of proxies are end-to-end verifiable: votes are encrypted on the voter’s device, checked with zero-knowledge proofs before they’re recorded, and tallied against a public bulletin board. Weighted, proxy, and hybrid ballots sit outside that mechanism, but they aren’t unverifiable — online votes on them get the same receipts, in-person counts the same signed attestation, and every ballot the same hash-chained audit trail.