Security & Compliance
Davis-Stirling Compliance by Design
Last updated: June 10, 2026
Condo Elects is a California HOA inspector of elections providing electronic and paper ballot administration under the Davis-Stirling Act. This page describes how the requirements of the Act are met by our election system.
These obligations are commonly met by procedure. In our system, the central ones — ballot secrecy, custody before tabulation, and inspector independence — are also built into the design itself, as described below.
The Secret Ballot — Civil Code §5115
The electronic equivalent of the double envelope
Civil Code §5115 requires the double-envelope secret ballot: an outer envelope that identifies the voter for eligibility, and an inner envelope that conceals the vote itself, so that no one — including the inspector — can connect a member to their choices.
Our electronic system applies the same separation during the voting period:
- Voter eligibility is verified at submission through an authenticated session tied to the unit's verified record — the function of the outer envelope.
- The ballot's contents are encrypted the moment they are submitted, independently of the voter's identity — the function of the inner envelope. Plaintext selections are never stored.
- One ballot per eligible voter is enforced at the database level, structurally — not by a procedure that depends on someone checking.
Each election is protected by its own encryption keys, generated for that election alone and never reused. The records of one association's election have no cryptographic relationship to any other's.
Custody Before Tabulation — Civil Code §5120
Sealed ballots that are not opened before tabulation
Civil Code §5120 requires that sealed ballots remain in the custody of the inspector and not be opened before tabulation. In a paper election, that protection is a locked ballot box and the inspector's word.
In our system, the protection is mathematical. Every electronic ballot is sealed by industry-standard authenticated encryption (AES-256) at the moment of submission, and the key required to open any ballot remains sealed for the entire voting period. While voting is open, ballot contents are not merely off-limits — they are unreadable. There is no administrative screen, support function, or code path that displays a ballot's contents before tabulation.
Unsealing the election is a deliberate, recorded act. It can occur only after voting has closed and the election is formally marked complete, and the system permanently records who performed it and when. The locked ballot box, in other words, keeps a signed log of its own opening.
Ballot Integrity
Every ballot is tamper-evident and bound to its election
The encryption protecting each ballot is authenticated: any alteration to a sealed ballot, however small, causes it to fail verification when the election is opened. Each ballot is also cryptographically bound to the specific election and submission it belongs to. A ballot cannot be modified after submission, duplicated under another identity, or moved from one election to another without that tampering being detected — automatically, as a property of the mathematics rather than a manual review step.
This means the integrity of the count does not rest on trusting that nothing was altered. It rests on the fact that an alteration cannot go unnoticed.
Inspector Independence — Civil Code §5110
No stake in the outcome, by structure
Civil Code §5110 requires that the inspector of elections be independent — a third party with no interest in the result. We treat that requirement as structural, not aspirational.
Condo Elects serves exclusively as Inspector of Elections. We do not provide legal services, we are not affiliated with any law firm, and we offer no service whose value depends on how any vote turns out. The party attesting to the integrity of the election has nothing to gain from its result — and nothing to defend except the accuracy of the count.
Custody of Election Records — Civil Code §5125
Records preserved in the Inspector's custody
Civil Code §5125 places election materials in the custody of the inspector after the election. Our system preserves the complete election record — in its original, sealed form — for no less than one year following the election, and the record of who unsealed the election, and when, is preserved permanently.
Because the underlying records are cryptographic rather than procedural, what is preserved is not a description of what happened. It is the evidence itself.
Data Handling
How voter information is protected
- All data is encrypted in transit and at rest.
- Voter contact information is used solely for election administration and is never sold, shared, or used for any other purpose.
- Ballot contents become readable only after the recorded unsealing of a completed election, within the Inspector's custody.
- We do not publish our client list. Discretion is part of the service.
Changelog
Revision history
- June 2026 — Initial publication of this page.