Security & integrity
A church election only matters if the room can stand behind the outcome. Synod is built around that single duty — every ballot is admitted, recorded, and certified in a way the assembly can defend.
What protects the vote
Once a result is certified, its totals are frozen for good. If a voter has to be removed afterward, their ballot on an already-certified question is anonymized rather than deleted — the announced count is never recounted or quietly altered.
Registration is not a vote. Only people matched against your imported roster and approved by an administrator are admitted to a ballot, so the election stays with the members the assembly seated.
Approvals, ballots, and certifications are recorded as a full action history, so the body that runs the election can account for every decision after the fact.
In production, every connection between a voter, the display, and Synod is served over HTTPS with certificates managed automatically, so ballots travel over encrypted links.
Voters, rosters, and results are scoped to their own venue and section. One conference can never see into another, and a voter is held to the body they were seated in.
What protects the vote
Once a result is certified, its totals are frozen for good. If a voter has to be removed afterward, their ballot on an already-certified question is anonymized rather than deleted — the announced count is never recounted or quietly altered.
Registration is not a vote. Only people matched against your imported roster and approved by an administrator are admitted to a ballot, so the election stays with the members the assembly seated.
Approvals, ballots, and certifications are recorded as a full action history, so the body that runs the election can account for every decision after the fact.
In production, every connection between a voter, the display, and Synod is served over HTTPS with certificates managed automatically, so ballots travel over encrypted links.
Voters, rosters, and results are scoped to their own venue and section. One conference can never see into another, and a voter is held to the body they were seated in.
Certification freezes a result the moment it is announced. From that point on, the totals are read-only: a later correction to the roster can anonymize a ballot, but it can never reopen a count or move a number that the assembly has already received. The result you announce is the result that stands.
Security questions
