When a mail ballot is challenged, the only answer an election official can give is “trust our records.”
That is an engineering failure, not a character failure. The records are almost always correct. They are simply not provably correct — and only one of those two properties ends an argument.
What we built
A custody record that cannot be quietly changed and can be checked by someone who does not trust the office that produced it.
Every custody transfer is signed at the moment it happens and written to an append-only log. The log is periodically anchored so that any later alteration breaks the chain visibly. A voter — or a challenger, or a court — can be handed a proof for one specific ballot envelope and verify it independently, using a tool the election office does not control.
The shift that matters
The election official stops having to be believed and starts being able to be checked.
For an honest administrator, being checkable is strictly better than being trusted. It is the difference between an argument that cannot be won and one that is simply over.
Three fields solved this already
Election administration is not the first field to face an adversarial custody problem. Three others solved it structurally, and their solutions converge on the same architecture.
01
Forensic laboratories
Evidence integrity decides whether a case survives challenge in court. Sealed, signed, timestamped transfer records — verified independently at trial.
02
Pharmaceutical supply
A counterfeit or diverted drug must be detectable across a global chain. Serialized units with cryptographically verifiable custody at every handoff.
03
Financial audit
A ledger controlled by the audited party cannot audit that party. Append-only journals, external attestation, independent reconciliation.
In each field the change was initially resisted as an implication of bad faith, and subsequently understood as protection for the honest participant — because it is the honest participant who currently has no way to demonstrate their honesty.
The common pattern
Stop asking the custodian to be trusted. Give the custodian a way to be checked.
Three things that make this procurable now
01
No federal certification gate
VVSG 2.0 governs voting systems — equipment that marks, casts, or tabulates. A custody service is an election system and sits outside that boundary by design. Standard software procurement timeline.
02
Built and tested, not proposed
The event log core is complete: append-only storage, Ed25519 signing, Merkle anchoring, role-based access, KMS integration, offline scanner sync, envelope encryption. The production entrypoint refuses to start rather than fall back to in-process keys.
03
Priced as infrastructure
$0.20–$0.75 per registered voter per year, tiered. A 150,000-voter county runs about $75,000 annually.
The instruments
Everything below runs in your own browser, against the same engine that would produce a county’s proofs. Nothing is sent to a server; there is no server.
Module 1
Map your own custody chain
Module 3
Hashing, and the chain built out of it
Module 4
An append-only log, with its refusals showing
Module 5
The tree, and the receipt a voter is handed
the point of the whole thing
Check it yourself
Module 3
What that vendor claim actually means
Module 7
Turn the question bank into a requirements section
Module 6
When must this record still exist?
§6
What this costs
Stated without hedging
It does not reveal how anyone voted, and it does not prevent tampering.
Overclaiming is the fastest way to destroy the trust this is meant to build. A voter told that verification means more than it does, who later learns otherwise, becomes a permanent adversary — and rightly so.
The ask
Two pilot jurisdictions for the 2027 cycle. Discounted pricing in exchange for permission to name the jurisdiction publicly, a written reference, and a joint conference presentation.
We are looking for a customer who will let us be examined.
A product whose entire premise is that claims should be checkable rather than trusted cannot reasonably ask to be adopted on trust. The right first customer is one who will subject this to scrutiny and publish what they find.