An election is only as good as the trust of the people who lost it. This page sets out how PollGuard keeps a ballot secret, what it writes down, where your data sits, and, just as plainly, the certifications, guarantees and claims we do not make.
Written to be read by a board, not a sales team.
We publish no uptime percentage. When something goes wrong that members, officers or boards can see, it is entered under Incident history below.
Ballot secrecy on PollGuard is operational, not cryptographic. Today it rests on who may open which screen. It does not yet rest on keeping who you are and what you chose in two places, and we would rather tell you that here than have you find it out.
Read across a row. Where today falls short of what we are building, the cell says so.
| Person | That a member has voted | How a named member voted | Running counts before close | What they change |
|---|---|---|---|---|
| Member Android app or station | Their own Their receipt shows their ballot is recorded | No The receipt check never returns a choice | No | Written Votes cast are recorded, never the choice |
| Returning officer runs a station | Yes Officers see who has voted | No Never how | No | Written, by name Assists go under the officer’s own account |
| Organisation admin the board’s side | Yes Turnout and who has voted | Not on any screen No PollGuard screen shows it | Yes, today A gap. Hiding totals until close is being built | Written, by name Openings, closings, imports |
| PollGuard support our own staff | Can reach it Support staff can reach customer data | Could, today With database access, because the ballot is linked to the account | Can reach it The counts exist while voting is open | Written like anyone’s A support-access log with a reason is on the roadmap |
An officer, a candidate’s agent or a member using the app as designed to find out how a named member voted.
Role permissions and a record of every change. It is operational secrecy: not end-to-end cryptography, and not a blockchain.
The production database is reachable only from inside the server itself; nobody reaches it from the internet. That lowers the risk above. It does not remove it, and we won’t tell you it does.
The record is an operational audit log: one row for every change made through PollGuard, written as it happens, carrying the account and role that made it, the action, the time and where it came from.
There is no board-facing view of the record yet. One is being built, for the electoral board and the auditors or observers it names.
The full record as CSV and PDF, each export carrying the election, the period and who exported it. Election results already export today.
We would rather you plan for the risk than discover it on polling day. Here is how PollGuard is hosted today, including the parts a larger provider would leave out.
The platform runs on one server, in one hosting region, with one provider. There is no standby copy running in a second region.
We raise this with every board in the briefing before a live election.
A full database backup every night at 00:30 UTC, the last seven kept. Identity-document images are not yet in it.
It works only on public web content. Its analytics data is held in a separate warehouse.
On their own phone or computer, with a document and a live selfie. Where a person needs help at a station, an officer can step in, and does so under their own account.
The member photographs their identity document in the Android app or on the web. An outside AI document-reading service helps read it.
Taken with the camera at that moment, inside the app, not chosen from the gallery. Liveness prompts, then a face match to the document.
Software reads, checks and scores; a named reviewer approves or declines every verification under their own name. Borderline matches get the closest look. A clear mismatch fails the check, and the member can start again.
At a station, an officer can identify a member. The action is written to the record under the officer’s account.
Member verification does not check documents against IPRS or any other government identity database. Eligibility comes from your organisation’s own roll.
Before a ballot is cast: a face re-check against the verified face, or the phone’s own fingerprint or face unlock. Kept: the document images, the selfie, the check results and a numeric face template, for as long as the data-protection notice says. The face model is a widely used open model, not retrained on members. No accuracy figure is published.
How identity checks workSix things a board may hear about election software. None of them is true of PollGuard today, and we say so before anyone asks.
We hold neither certification yet. If we begin an audit, it will be listed here with its status.
We don’t publish one. We list incidents instead, with dates.
Secrecy is operational. The receipt shows a ballot is on record; it is not a cryptographic proof of the whole tally.
PollGuard is independent of the IEBC: not affiliated, not endorsed, not integrated. Only the IEBC declares national results.
Nothing is. We tell you what is logged and who can change it, so a change leaves a trace.
Sentimeter measures what was said in public. It does not predict who will win.
An entry goes here when members, officers, boards or visitors could see the problem. Entries are not removed when they become old or awkward.
The TLS certificate that secures the PollGuard website expired before it was renewed. While it was expired, browsers showed a security warning in place of the site, and most visitors could not get through. A new certificate was issued and the site returned to normal.
No open incidents at the time this page was reviewed, 13 October 2026.
It is the standard we design and test against. It is a target, not a claim of conformance, and no independent audit has been done.
On our redesigned screens, nothing smaller than 12px.
For thumbs at a crowded station.
A green chip also says what it means, in words and with a shape.
Found a barrier? Tell us at manage@pollguard.africa and say which page and device.
