Vote privacy guarantees
How the secret ballot is designed in ASAMBYTE and what we have tested. No seals: just data you can repeat.
1. What the design guarantees
ASAMBYTE's database keeps no link between a person and their vote. It separates two things that are never joined: who has entered to vote and what was voted.
- Each worker or member gets an anonymous credential through a blind signature: the server signs it without being able to see who it belongs to.
- Ballots and spent credentials are stored without a timestamp and in random order.
- The person's session is deleted when they sign: nothing remains about who signed or when.
- Each person can vote only once.
2. What we have tested
On 17 October 2026 we ran a privacy test: 200 simulated voters and three ways of trying to find out who voted what, with access to the database and its history.
| Attempt to find out who voted what | Before the improvements | After |
|---|---|---|
| Matching the order of the rows | No advantage over chance | |
| Matching the timestamps | ||
| Following the trail in the database history |
The “after” figures vary slightly each time (between 41 % and 46 % in the first run); guessing with no information is right 60.5 % of the time, so the attack gives no advantage.
3. Check on the real database
This read-only query was run on ASAMBYTE's database on 17 October 2026, with two test votes:
| What is counted | Result |
|---|---|
| Ballots stored with a timestamp | 0 |
| Spent credentials stored with a timestamp | 0 |
| Tickets linking a person to a credential | 0 |
| Signed sessions kept | 0 |
4. What we do not guarantee
- We do not promise a 100 % secret. Some limits are outside our control.
- The hosting provider (Cloudflare) logs the address and time of each connection. In very small, spaced-out votes, someone holding those logs and the database history could link a vote to a person by when it happened.
- Votes cast before the improvements may remain in the database history for up to 30 days.
- Watching live results in a small group may allow someone to infer a vote.
- ASAMBYTE, as operator, has technical access to the infrastructure: the design reduces what that access reveals, but it does not remove the need to trust whoever runs it.
- The census is provided by the company and ASAMBYTE cannot check that it is genuine: we verify that the company exists and who its contact is, not the list of people.
5. What this test is and is not
It is an internal test, designed and run by the ASAMBYTE team with the help of an artificial-intelligence assistant (Claude, by Anthropic). It is not an independent audit or a third-party certification. Any company or auditor can ask us for the procedure and repeat it on their own.
The planned next step is an independent audit; when it exists, it will be published here with the name of whoever carries it out and its date.
Contact
Want to repeat the test or have a question? Write to info@asambyte.es.