What Makes an Online Election a True Secret Ballot?
Sooner or later a member asks it directly: "If I vote online, can the board see how I voted?"
Most organizations answer with some version of "no, it's anonymous." Ask the follow-up — anonymous to whom? — and the answer tends to get vaguer. The survey tool hides the email column. The vendor says its staff don't look. The committee chair promises not to open the export.
Those are all promises. A secret ballot isn't a promise that nobody will look. It's an arrangement in which there is nothing to look at.
The problem every election has to solve
An election needs two pieces of knowledge that pull in opposite directions. It has to know who voted, so nobody votes twice, nobody votes who isn't eligible, and the board can track turnout. And it must never know how any particular person voted.
Paper solved this long ago with the double envelope. The voter signs the outer envelope; the ballot goes inside an unmarked inner one. Election workers check the signature, set the outer envelope aside, and drop the inner one into the pile with everyone else's. Identity is used once, at the door, and then physically separated from the choice.
A lot of improvised online voting skips that separation. A form response is a single row: email address, timestamp, choices. An "anonymous" setting may hide the identity on screen, but if the tool collected an email to stop duplicate votes, the link still exists — in the database, in an export, or in an admin view someone forgot about.
Six ways the link survives
The useful question isn't "is it anonymous?" It's: could anyone — an administrator, the vendor's staff, someone holding a copy of the database — connect a ballot to a voter? In practice, the connection survives in six places.
1. The ballot record carries a voter reference. Not just a visible name. A hashed email, an internal voter ID, or a token that can be looked up is still a link. In a true secret ballot, the stored choices contain no reference to the person at all.
2. Participation and choices share a record. They should be two separate records: a roster that says a person voted, and a pile of ballots that says what was chosen. That's the double envelope, rebuilt in data.
3. Timing gives it away. If the roster shows a member voted at 9:14:07 PM and a ballot was stored at 9:14:07 PM, the separation is cosmetic. In a small election, even the minute can be enough. Ballot timestamps should be too coarse to match on.
4. The shape of a ballot gives it away. If one member holds 5,000 shares in a weighted vote, the ballot carrying weight 5,000 is theirs. If a question is shown only to a group of four, answering it narrows the field to four. A system can't always prevent this, but it should tell you when your own setup creates the risk.
5. Partial results are visible while voting is open. In a 30-person election, an administrator who watches the tally go from 11–9 to 12–9 moments after a particular member says they've voted has just learned that member's vote. Sealing counts until close protects secrecy, not only fairness.
6. The receipt proves too much. Voters reasonably want to confirm their ballot was counted. But a receipt showing how someone voted can be shown to someone else — an employer, a neighbor, a person offering to buy the vote. A good receipt proves inclusion, not content.
The trade-offs to expect
A real secret ballot has consequences that sometimes surprise boards. A vendor who raises them up front is being straight with you.
Voters can't change a cast ballot. To replace a ballot, a system has to find the old one — which means it can connect ballots to voters. If a tool offers vote changing, ask how it finds the ballot to replace.
Nobody can audit an individual's vote. If a member insists their ballot was recorded wrong, there is nothing to pull up. Disputes get resolved with records — who was eligible, who participated, what was counted — not by opening ballots.
Secret isn't the same as compliant. Whether your bylaws or state law require a secret ballot for a particular vote, and whether an electronic ballot satisfies that requirement, is a question for your governing documents and, where it matters, your counsel.
Nine questions to ask any online voting vendor
Worth saving for whoever is evaluating tools:
- Does a stored ballot contain any voter identifier, including hashed or internal IDs?
- Could your own staff, with full database access, match a ballot to a voter?
- How precise are the timestamps stored on ballots?
- Do you warn us about rare vote weights or very small voter groups before launch?
- Can anyone — our administrators or yours — see partial results before voting closes?
- How does a voter confirm their ballot was counted, and does that reveal their choices?
- Can a voter change a cast ballot? If so, how do you find it?
- Who can see or copy a voter's voting link?
- What participation record do we keep afterward, and does it contain any choices?
If the answers are vague, the ballot is probably confidential rather than secret. That may be fine for a straw poll. It isn't fine for a contested board seat.
How Fast Elections handles it
Fast Elections was built to give the second kind of answer. Cast ballots are written with no reference to the voter who submitted them — no name, no email, no account link — and there is no admin screen, database query, or export anywhere in the product that connects a person to their choices. That includes us.
Each voter gets a unique, single-use voting link, stored only as a hash. The roster records that someone voted; the ballot records what was chosen; ballot timestamps are rounded to the hour. While voting is open, organizers see turnout but never the tally. If a weighted election has a weight held by fewer than ten voters, or a question is limited to a group with fewer than ten eligible voters, you're warned at launch — before the vote, not after.
Every voter is shown a receipt code the moment they cast. When results are published, the full list of codes is published with them — codes only, no choices — so a voter can find their own and confirm it was counted. And the trade-offs apply: cast ballots are final.
One detail on tiers. On paid tiers, voting links are only ever emailed; administrators can't see or copy them. The free tier sends no email, so the administrator copies each voter's link and delivers it personally. The ballot secrecy is identical — who handles the links is not.
If your organization has a vote coming up, you can build it in Fast Elections for free — up to 25 voters, no credit card — send yourself a test ballot, and see exactly what your voters will experience before paying anything.