A result no one can open alone
A nominating board splits the key to your ballot box between the people your organisation trusts, so the count stays sealed until enough of them agree to open it. Not even CharterVote can look inside.
The problem it solves
Every online election asks its members for one piece of trust: that whoever runs the platform, and whoever runs the organisation, did not look at the votes early or change them. Usually that trust is reasonable and nobody thinks about it. Then comes the election where it is not: a contested chair, a recall, a rule change that half the membership opposes. In that election somebody will ask how they can know, and "because we say so" is not an answer that survives it.
A nominating board removes the need for that trust rather than asking for more of it. The ballots are encrypted before they leave the voter's device, under a key that no single person holds, not the organiser, not the board, and not us. What we store is unreadable. It stays unreadable until a number of your trustees, agreed in advance, act together to open it.
How it works, step by step
Your organisation keeps a roster of trustees
A board is drawn from a roster your organisation maintains: the people it would trust to hold a share of an election key. They are invited by email and accept in their own account. A roster member can be suspended and reinstated, and none of it touches an election that is already sealed, because a board is frozen once its election launches.
The people in these screenshots are invented; everything else on this page is the real product, photographed on a running installation.
You choose the board, and the number that must agree
While the election is still a draft, you pick the holders and propose a threshold: how many of them must act together before the box can open. The platform is candid with you here rather than selling you the feature, because the protection is real and so are its consequences. There is no recovery and no override. You are always a holder of your own election, so a silent board cannot lock you out. Everything freezes when voting opens.
Three of five suits most boards. It is enough that no single person, including you and including us, can open the box alone, while two holders being unavailable on results day still cannot stall the count.
Each trustee runs a key ceremony in their own browser
Every holder completes four steps: they register their key, deal their shares to the others, combine what they were dealt and publish their public share, and download a backup protected by a passphrase they choose. All of it happens in their browser. The private share is never sent to CharterVote, which is why the backup is not optional: the file and the passphrase together are the only durable copy, and the only thing that will let that holder act when the results are opened.
A holder who has to leave mid-ceremony can move it to their phone with a QR handover. The envelope is sealed in the browser before it travels and the code that opens it never reaches our servers.
You watch the board form, and finalise when it has
The organiser sees each holder's progress through their four steps and can chase whoever is outstanding, at most once a day however often the button is pressed. When all of them have finished, the board is finalised and the election key exists. Only then can voting open, because that key is what ballots are encrypted under from the first vote to the last.
You can also set the date from which the board may review, so a count is not opened the instant polls close if your rules require a waiting period.
When voting closes, the board decides whether to open the box
Holders are shown the evidence before they act: the sealed voter roll, the sealed configuration, the number of ballots in the box, and a live recheck confirming every one of them still matches the seal taken the moment voting closed. Their decision is whether that evidence is good enough, not what the result should be. They cannot alter what is inside the box; they can only agree to open it or decline.
Once the threshold of holders has agreed, the count is decrypted and the result is published. Everything that happened, and who did it, is on the record.
When it is worth the cost, and when it is not
Worth it
A contested chair or general secretary. A recall or a no-confidence motion. A merger, a demutualisation, a change to the constitution. Any election where the losing side has a reason to doubt the winner, or where a regulator, a court or a parent body may later ask how the count was protected.
Probably not worth it
A routine committee vote, an uncontested slate, a poll to pick a date. The ordinary sealed record already gives you a result that can be recomputed and verified; a board adds the guarantee that nobody could have looked early, and that guarantee has an administrative price in the ceremony every holder must run.
What you still get without one
Anonymity, a sealed voter roll, a sealed configuration and a result any member can recompute from the ballots themselves. A board does not add verifiability, which you have either way. It removes the possibility of an early look.
Questions organisations ask
Can CharterVote read our ballots?
Not on a board election. Each ballot is encrypted in the voter's own browser under a key that exists only as shares held by your trustees. We store ciphertext. Until the threshold of holders acts together, there is nothing on our servers that anyone, including us, can turn back into votes.
What happens if a trustee loses their key?
Nothing, as long as the threshold can still be met. That is the reason to choose a threshold below the full number: three of five survives two people being unreachable. If more than that are lost, the result is unreadable permanently, by everyone. There is no recovery and no override, because an override would be a back door and a back door would defeat the whole arrangement.
Can the board change the result?
No. Holders can open the box or decline to; they cannot alter what is inside it. Before they decide, they are shown the sealed voter roll, the sealed configuration and a recheck confirming every ballot still matches the seal taken when voting closed. Their choice is whether the evidence is good enough to publish, not what the numbers say.
Can a board be added after voting starts?
No. The election key is what ballots are encrypted under from the moment voting opens, so it has to exist first. A board is assigned while the election is still a draft, and the membership, the threshold and the key are frozen at launch, even if somebody later leaves the organisation.
Do our members have to do anything differently?
No. They receive their access code and vote as they always would. The encryption happens in their browser, so the only practical requirement is that JavaScript is enabled, which it is in essentially every browser in use.
Is a nominating board worth the cost?
It is worth it when somebody might not believe the result. For a routine committee vote, the ordinary sealed record is enough. For a contested chair, a recall, a merger or a constitutional amendment, a board is the difference between asking your members to trust the organisation and being able to show them that trust was not required.