Qstamp / Elections

Election integrity

Election records that cannot be forged, without revealing a single vote.

Governments must be able to show that every certified return, every count and every declared result is exactly what was recorded, and that no record was altered, inserted or backdated. QBallot, the election integrity SDK of the Qstamp family, gives election authorities, observers and courts post quantum evidence of the whole electoral record while ballot secrecy remains absolute.

Live flow

How QBallot runs inside an election.

Each step lights in turn as a record moves through it. Steps inside your systems never send content out. Only the anchor reaches the Quantova network, and only chain facts are public on QVMScan.

Live flowQBallot, from polling station to the explorer

Your systemsElection management systemSoftware builds and the mandates of officials registered
Your systemsPolling stationReturn signed by the presiding officer and witnesses
Your systemsCount centreBallot records fingerprinted with fresh salts, no voter identified
Your systemsTabulationEvery action sealed in a hash chained log
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1106 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QBallot, with no record content
PublicObservers and courtsProve the declared result equals the certified returns

Inside your systemsQuantova networkPublic and verifiable

The challenge

Public confidence depends on records that can be checked.

National, regional and leadership elections, referendums and votes in parliaments and parties all produce a chain of records, from the station return to the declared result. Today that chain is protected by paper procedure and, where it is digital, by classical signatures that a quantum computer will be able to forge. A disputed result then rests on trust in the systems of the authority whose conduct is in question.

Altered returns

A station return changed between the count and the national tabulation can be hard to detect when the only copy is held by the system that changed it.

Forged authority

A result submitted under the name of an official who never certified it, or by software that was never approved, undermines the whole declaration.

Future forgery

Election records are kept for years and may be challenged long after polling day. Records signed with RSA or elliptic curve keys will be forgeable once large quantum computers exist.

The framework

Six stages, each sealed and linked.

QBallot follows the established structure of an election and adds a cryptographic seal at each stage. Each seal is signed with ML DSA under FIPS 204 and fixed in time on the Quantova network, so the integrity of the record can be verified independently of the authority that produced it.

Stage 1 · Before polling day

Software and authority registered

The election authority registers the fingerprint of every certified tabulation and election management software build, and signs the mandate of each returning officer, presiding officer and count supervisor, naming the station or count they are responsible for. Any software or official that was not registered in advance is detected at the count.

Stage 2 · At the polling station

Records sealed where they are made

When the poll closes, the presiding officer and the appointed witnesses sign the station return, including the ballot account and the result, under their registered keys. The return is fingerprinted and anchored before it leaves the station, so its content is fixed at the moment it was certified.

Stage 3 · At the count

Every ballot record fingerprinted, no voter identified

Each scanned ballot image or cast vote record is fingerprinted at the counting centre with a fresh random salt and anchored in batches. Only salted commitments leave the centre. No voter identity, no ballot paper number linked to a voter and no ballot content is ever published.

Stage 4 · In transmission

Results that cannot be altered on the way

Results travel from station to constituency to national tabulation as signed records. The tabulation system accepts a result only when it carries the valid signatures of the officials registered for that station, so a result altered or inserted in transit is rejected.

Stage 5 · During tabulation

A tamper evident record of every action

Each action in the election management system, including adjudication of a disputed ballot, a correction or a recount, is written to a hash chained log sealed by anchored checkpoints. An action cannot be removed, reordered or backdated without detection, and each adjudication is shown to follow its recorded reason.

Stage 6 · After the declaration

Independent verification by observers and courts

Candidates, parties, observers and courts can confirm that the declared result is the sum of the certified station returns, that each return is unchanged since it was signed, and that every anchored record existed at its stated time, without trusting the election authority's own systems.

QBallot

The election integrity SDK of the Qstamp family.

QBallot brings the proven parts of the family together for elections. Qstamp fixes every record in time. QSign carries the signatures of presiding and returning officers. QMandate proves which official was authorised for which station and count. QLog keeps the tamper evident record of every action in tabulation. QBallot adds the election specific rules, the structure of station returns and the verification procedure for observers and courts.

QBallot is being built for release as part of QGov, the government branch of the Qstamp family, and will be published only after rounds of security review and live testing on the Quantova network. Election authorities can begin pilots today with the live SDKs, which provide each of the protections described on this page.

What QBallot detects

A station return altered after certification
A result inserted under the name of an unregistered official
A result produced by unregistered software
A ballot record changed after it was fingerprinted
An adjudication or correction removed, reordered or backdated
A declared total that differs from the certified returns

Ballot secrecy

Integrity of the record, secrecy of the vote.

QBallot never records who voted, how any person voted or any link between a voter and a ballot. Ballot records are fingerprinted with a fresh random salt and only the salted commitment is anchored, so nothing published can be traced back to a voter or used to confirm a guess about a ballot. Voter registers and identity data remain entirely within the systems of the election authority.

Integration

How an election authority adopts the framework.

1. Legal and procedural basis

The authority sets out in its election rules which records are sealed, who signs them and how observers and courts may verify them, in line with national electoral law and the oversight of its electoral commission.

2. Key ceremony

Keys for the authority, returning officers and presiding officers are created in a witnessed ceremony and held in hardware protected stores. Each official's mandate names the stations and counts they may certify and the period of their authority.

3. Software registration

The fingerprint of every certified build of tabulation and election management software is registered and anchored before polling day, after the national certification process has approved it.

4. Polling and count

Station returns, ballot records and tabulation actions are sealed as they are produced, as set out in the six stages above. Paper ballots remain the record of voter intent wherever the law requires them.

5. Audit and recount

Post election audits, including risk limiting audits, compare a sample of paper ballots with the sealed ballot records. Every recount and correction is itself sealed, so the audit trail cannot be rewritten.

6. Disputes and retention

In a challenge, the authority produces the relevant records and receipts, and any party or court verifies them independently. The evidence remains verifiable for the full retention period of electoral records.

Scope

What the framework does and does not do.

QBallot proves that election records are unchanged since they were sealed, that they were sealed by registered officials and software, and when. It does not replace certified voting equipment, paper ballots or the procedures of the electoral commission, it does not establish that a ballot reflects the intent of the voter, and it does not by itself prevent coercion or vote buying, which remain matters for electoral law and its enforcement. It is designed to support the standards that govern each jurisdiction, such as the Council of Europe Recommendation CM/Rec(2017)5 on standards for e voting and the Voluntary Voting System Guidelines of the United States Election Assistance Commission, and each authority remains responsible for compliance with its own law.

The current releases of the Qstamp SDKs anchor on the Quantova test network ahead of production use.