Security

The ElectionBuddy Service has been servicing elections and voting needs for more than 10 years, and over that time we’ve developed a robust security culture that is managed by ElectionBuddy Inc.. We use industry best practices to ensure that your elections, your voters, and your results are secure.

HTTPS and HSTS for secure connections

ElectionBuddy forces HTTPS for all services using TLS (SSL), including our public website and the Dashboard.

• ElectionBuddy’s official libraries connect to ElectionBuddy servers over TLS and verify TLS certificates on each connection

We use HSTS to ensure browsers interact with ElectionBuddy only over HTTPS.

Payment data

ElectionBuddy is PCI DSS compliant. Further, no credit card data is stored on any ElectionBuddy server or database in any format: data is ephemeral in memory. Credit card data is immediately encrypted and transmitted to Stripe, our payment processor. Stripe has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry.

Data security

You own all data associated with your account, including election results, ballots and voting records. We provide the service and maintain the integrity of your data. We never purge records during the lifetime of your account. You may export all or part of your data any time in a variety of portable formats, including: XML, CSV and Microsoft Excel.

We run automatic, at-least-daily encrypted backups to ensure your online data is safe and protected.

• We host the ElectionBuddy application on firewalled cloud servers, with automatic security updates enabled.
• We do not store plaintext passwords, only hashes.
• We regularly update the libraries and frameworks we use, and promptly apply available security and bug patches.
• We are constantly improving our features, provide free updates, and regularly add new features at no extra charge.

Sub processors

• Stripe, Inc. — payment processing
• Help Scout, Inc. — cloud-based customer support services
• Sparkpost, Inc. — email delivery platform
• Amazon Web Services, Inc. — cloud servers, cloud storage, data processing
• Plivo, Inc. — SMS and voice call delivery platform
• Lob, Inc. — SMS and postal delivery platform