Pre-release · source-reviewed design
Separate identity from the ballot.
Review SEVA’s intended identity and ballot separation, blind eligibility credentials, retention considerations and privacy limitations.
Privacy comes from the whole election environment. SEVA separates check-in from ballot handling in its source model, while operational metadata, devices and privileged access remain part of the threat assessment.
Eligibility and check-in
Authorized roll operations and supervised exceptions. Identity data belongs on this side of the boundary.
Separate responsibilities. Validate the complete path.
Ballot marking and encryption
A paired kiosk presents configured contests. Cryptographic components process selections; integrated assurance remains under evaluation.
Close, reconcile and review
Lifecycle controls, trustee components, paper reconciliation and result artifacts have distinct responsibilities. The independent verifier is incomplete.
Security depends on the complete implementation, trusted operations and reviewed evidence. No certification or independent audit is claimed.
Different stages, different data
Check-in works with eligibility records; ballot handling works with credentials and encrypted selections. Separate database grants limit direct access between those roles. This is a concrete separation in the source, not proof that every deployed component, log or administrator can never correlate activity.
Blind eligibility credentials
Blind-Schnorr components let a credential be issued without the issuer seeing the final unblinded credential. A token-derived nullifier supports spent-token checks. Protecting the complete issuance, card transfer and ballot workflow still requires protocol review and operational tests; the primitive is not a universal anonymity guarantee.
Plan the data lifecycle
An assessment should identify the eligibility information actually required, who may see it, how it is retained and how records are disposed of. Source backup permissions exclude roll and ballot schemas from the restricted cloud path. Confirm deployed privileges, exports and recovery procedures rather than assuming every copy has the same boundary.
State the limits openly
Device compromise, timing correlation, privileged hosts, audit metadata and physical observation require explicit controls. The current proof flow also carries a claimed selection sum. No independently established coercion resistance, complete memory erasure or universal unlinkability is claimed. Review voter-facing explanations and paper procedures during a supervised rehearsal.
Request consultation
Scope before commitment
Assessment only. Not yet suitable for any live election. Deployment and operation require authorized SparkGlim Security and Technical Teams.
Country context guides the consultation. It does not establish jurisdictional approval, regulatory compliance or product availability.