Security

How StrataVoterAI protects your organization

StrataVoterAI is still in development. This page separates what's built from what must happen before launch.

We hold

Name and unit

So people can vote and the tally can be trusted.

Encrypted by default

Email address

For join codes and notices. With encryption on, board members can't read it. Members can add or delete their own address at any time.

Never collected

Everything else

No mailing addresses, birthdates, phone numbers, ID numbers or passwords in a member's profile.

Built so far

No passwords to steal

Passkeys use the fingerprint, face or PIN on your own device, and only work on the real site, which helps stop phishing.

A separate space for each organization

Data is separated in the application and again in the database. Membership is checked on every request.

Names masked on bank lines

Personal names are masked when a statement comes in, and showing one is logged. Masking catches common patterns but can miss a name, so a person checks before saving.

Encryption with each organization's own key

Email addresses and the original bank line details are encrypted under a key that belongs to that organization.

Two people for sensitive changes

Role changes and board access to email addresses need a second board member's approval.

Records you can check

The activity log can't be edited, and the app can verify that no entry has been changed.

Before launch

An independent security test
A legal review of our privacy and security commitments
A real-world check of sign-in on members' own devices