Security & data
Your voter data is yours, and nobody else has it.
Downballot runs on infrastructure we operate ourselves. Your records are not resold, not shared between organizations, and not used to inform anyone else's.
Hosting and backups
Self-hosted, and backed up properly.
- Where it runs
- On infrastructure we operate and control. Your organization's data is not held by a third-party CRM vendor.
- Backups
- Continuous archiving with point-in-time recovery, written to storage we own. We can restore to a moment rather than to last night, which matters when the thing that went wrong was an import at 09:14.
- Encryption
- Backups are encrypted before they leave the host, and held on encrypted storage.
- Access to the systems
- Limited to the engineers who operate the platform, and only for operating it.
We do not hold a SOC 2 report or an external audit. Downballot is a small team running a beta, and we would rather say that plainly than imply otherwise. What we can show you is how the system is built and how it behaves, which is what this page is for.
How it is built
The parts that are hard to retrofit.
Most of what makes a system safe is decided early and is expensive to add later. These four were decided early.
- One place decides access
- Who may see a record is resolved by a single set of functions in the database. There is no page that filters by hand, and therefore no page that can quietly forget to.
- Organizations cannot see each other
- Isolation is enforced where the data is read, not by a filter a query might omit. A member of one organization has no path to another's records.
- Consent is append-only
- Consent events cannot be edited or deleted; the database refuses. A correction is a new event, which is what makes the record worth having when someone disputes it.
- Deletions are recoverable
- Records are soft-deleted and restorable rather than destroyed on click. Permanent removal is a separate, deliberate action with a higher permission.
The question everyone asks about a free beta
What happens to our data if you stop?
You get at least 90 days' written notice before the beta ends, and you can export throughout. Contacts and businesses export as CSV today; the Workplan export ships before the first organization is onboarded. We would rather build the export than narrow the promise.
Reporting something
Good-faith security research is welcome.
If you find a vulnerability, tell us before disclosing it and we will not pursue you for it. We will confirm receipt and keep you updated on the fix.
Bring this to your committee.
If there is a question your tech committee needs answered that is not here, ask it in your application and we will answer it directly.