Register Integrity
Biometric de-duplication, auditable claims and objections, and a published register with a verifiable hash.
Flagship Proprietary Platform
STAR™
Secured · Transparent · Auditable · Rig‑Free
The Electoral Integrity Platform
Engineered so that a result can be defended — in a collation centre, in a courtroom, and in public.
An election is not won by the system that counts fastest. It is settled by the system that can prove what it counted.
What STAR™ stands for
Four properties. All four, or none of them.
The name is not decoration. It is the specification. Each letter is a property the platform must hold at every stage of the electoral chain, and the fourth is what the first three produce.
S
Secured
Every material act is signed where it happens, using hardware-backed credentials held by an identified officer. Transmission is tamper-evident from the polling unit to the declaration. Nothing is reconstructed after the fact, because a record assembled later is a record someone had the opportunity to shape.
T
Transparent
Results are published at polling unit granularity with the source document beside every figure. Observers, party agents and citizens see the same data at the same time, and they see it as it arrives rather than after it has been reconciled.
A
Auditable
An append-only custody ledger records every actor, time and location. Corrections are appended with attribution; the original survives. A tribunal can reconstruct what happened without relying on the testimony of the people involved.
R
Rig‑Free
Not a fifth feature bolted on — the consequence of the first three. No system can make interference impossible. What STAR™ makes it is detectable, attributable and provable, which is what deters it.
A necessary caveat
What “rig-free” does and does not claim
We should be precise, because overclaiming here damages the very trust the platform exists to build. No technology can guarantee an election free of manipulation. Ballot stuffing, voter intimidation, procedural abuse and legal manoeuvring all sit outside any software system, and a vendor who tells a commission otherwise is selling something.
What an engineered platform can do is remove the undetectable forms of interference. If every result is signed at source, published immediately at unit level and recorded in an append-only ledger, then altering an outcome requires altering evidence that many independent parties already hold copies of. The manipulation does not become impossible. It becomes visible — and visible manipulation is manipulation that can be challenged, prosecuted and reversed.
That is the honest claim, and it is the one we will make to a commission in the room.
Designed for
- Electoral commissions
- Boundary & registration authorities
- Election tribunals & courts
- Domestic & international observers
- Political parties & agents
The problem STAR™ addresses
Elections fail in the gaps between systems
Very few disputed elections turn on a failure of counting. They turn on the seams: a register nobody can independently verify; an accreditation device that cannot explain why it rejected a voter; a result sheet that changes between the polling unit and the collation centre with no way to establish which version was original.
Those are integration failures, and they are the failures our engineering practice exists to close. STAR™ is the product of applying that practice to one domain repeatedly — the one domain where the evidentiary standard is set by a court rather than by a service level agreement.
The platform’s organising requirement is therefore not speed. It is provability: every material act in the electoral chain is signed at the point it occurs, time-stamped, and verifiable afterwards by a party that does not trust the commission, the vendor or us.
Design commitments
- Sign at the source. Evidence is created where the act occurs, not reconstructed later.
- Offline is normal. Field operation assumes no connectivity and reconciles deterministically.
- Nothing overwrites. Corrections are appended with attribution; the original remains.
- Verification without trust. Third parties can check the arithmetic and the custody chain themselves.
- Open at the edges. Proprietary internals, published interfaces — STAR™ does not lock in a commission either.
Capability set
Seven capabilities, engineered as one system
Individually, several of these exist somewhere in the world. Our engineering claim is narrower and more defensible than a superlative: we are not aware of a national deployment that combines all seven in a single integrated architecture — and the combining is where the difficulty actually lies.
| Capability | STAR™ | Why it matters, and why it is usually absent |
|---|---|---|
| Offline biometric verification | Included | Accreditation must work where there is no network. Systems built for connected environments degrade into manual fallback exactly where scrutiny is weakest. |
| QR-code-based vote encryption | Included | Binds each vote to a verified voter without revealing identity, in a form a field device can produce and a station can hold offline. |
| Hash-chained vote logging | Included | Altering any committed record invalidates every record that follows it. Tampering is not prevented — it is made self-announcing. |
| Observer dashboards with live hash verification | Included | Observers check ledger integrity themselves, in real time, rather than receiving the commission’s assurance that it was checked. |
| Voter-verified physical record | Configurable | A recountable artefact where the legal framework requires one. Offered as a first-class configuration rather than removed in the name of modernity. |
| Real-time public transparency | Included | Publication at polling unit granularity as results arrive — not aggregated totals released after reconciliation. |
| Voter receipts without compromising secrecy | Included | Confirms a vote was recorded and included without disclosing the choice — the property that makes a receipt safe from vote-buying and coercion. |
We deliberately do not publish a table scoring other nations’ electoral systems against ours. Those systems change, our information about them is second-hand, and a single inaccuracy in such a comparison would hand a technical committee a reason to distrust everything else on this page. We are content to be assessed on our own architecture.
Impact
What a commission is actually buying
Not faster counting. The ability to answer a challenge with evidence rather than with assurance.
Electoral disputes are rarely settled by the commission being disputed. They are settled by tribunals, by courts and ultimately by public acceptance — and each of those audiences is persuaded by the same thing: a record that independent parties can check for themselves.
The technical architecture- Restores public trust by making the process checkable rather than merely declared honest.
- Reduces fraud and manipulation through immutable, independently verifiable records.
- Enhances international credibility by admitting independent observers to real-time verification.
- Reaches rural and low-infrastructure areas through offline-first design rather than a connectivity assumption.
- Survives disaster through redundant storage and optional headquarters-held paper trails.
Capability pillars
The five platform layers
Five layers covering the electoral cycle from register maintenance to public declaration, each producing independently verifiable evidence.
Polling Day Operations
Biometric accreditation on offline-first devices with explainable rejections and device attestation.
Sealed Transmission
Results signed at the point of capture and tamper-evident through every hop to declaration.
Collation & Tabulation
Multi-tier collation with variance detection and a court-ready evidence pack per contested unit.
Public Transparency
Results portal, observer and party access, and an independent verification API for anyone to audit.
Traceability
Which layer delivers which property
A commission’s technical committee will ask exactly this question. Every property is carried by more than one layer, which is what makes it hold when a single layer is compromised.
| Layer | Secured | Transparent | Auditable | How that property is evidenced |
|---|---|---|---|---|
| 01 Register Integrity | ✓ | ✓ | ✓ | Published register snapshots with cryptographic digests; any later version can be proved to differ from the one displayed during the statutory period. |
| 02 Polling Day Operations | ✓ | — | ✓ | Device attestation and hardware-backed keys; every accreditation decision logged with an explainable outcome, including rejections. |
| 03 Sealed Transmission | ✓ | ✓ | ✓ | Result signed at the polling unit with the result-sheet image bound to the signature; alteration in transit is detectable by any holder of the record. |
| 04 Collation & Tabulation | ✓ | ✓ | ✓ | Arithmetic reproducible by hand from published inputs; anomalies flagged for human adjudication and never silently corrected. |
| 05 Public Transparency | — | ✓ | ✓ | Open verification API allowing a university, newspaper or opposition party to recompute national totals independently. |
| Rig-Free | The emergent property. Achieved only when Secured, Transparent and Auditable hold simultaneously at every layer above — which is why the platform is assured as a whole rather than layer by layer. | |||
Architecture
STAR™ Platform Architecture
Five layers, one continuous chain of custody. The gold layer is the one that decides disputes: everything above it produces evidence, everything below it consumes evidence.
Module detail
Layer by layer
Layer 01 — Register Integrity
- Voter register management. Registration, transfer, update and removal with full event history; no destructive edits.
- Biometric de-duplication. Vendor-neutral matching behind an abstraction layer, benchmarked on the commission’s own data before selection.
- Claims and objections. Statutory display period workflow with adjudication records, appeal tracking and outcome notification.
- Register audit and publication. Point-in-time register snapshots with published cryptographic digests, so any later version can be proved to differ.
Layer 02 — Polling Day Operations
- Biometric voter accreditation. Verification against the register with an explainable outcome for every rejection — a rejection nobody can explain is a dispute waiting to happen.
- Offline-first field devices. Full polling unit operation with no network, hardware-backed keys, device attestation and tamper indication.
- Polling unit command and control. Real-time operational picture where connectivity exists: unit opened, materials present, accreditation counts, incidents.
- Accessibility and exception handling. Documented alternative procedures for voters whose biometrics cannot be captured, recorded as exceptions rather than as failures.
Layer 03 — Sealed Results Transmission
- Result capture and digital signing. The result is signed at the polling unit by the presiding officer’s credential, with the result sheet image bound to the signature.
- Tamper-evident transmission. Any alteration in transit is detectable; delivery is idempotent and survives repeated retry over poor links.
- Chain-of-custody ledger. An append-only record of every custody event with actor, time and location, reproducible from the raw evidence.
Layer 04 — Collation & Tabulation
- Multi-tier collation engine. Statutory collation hierarchy configured to the jurisdiction, with arithmetic that can be reproduced by hand from published inputs.
- Anomaly and variance detection. Turnout exceeding accreditation, impossible margins, duplicate submissions and late-arriving amendments flagged for human adjudication — never silently corrected.
- Dispute resolution evidence pack. On demand, a complete bundle for any contested unit: signed result, sheet image, custody log, accreditation counts, device attestation and adjudication history.
Layer 05 — Public Transparency
- Public results portal. Progressive publication at polling unit granularity, with the source document available beside every figure.
- Observer and party access. Credentialed access for accredited observers and party agents, with their own audit trail.
- Independent verification API. Open, documented and rate-limited, so a university, newspaper or opposition party can recompute the totals without asking the commission’s permission.
Assurance
How a commission can satisfy itself — and its critics
We expect to be tested. These are the assurance provisions we offer as standard rather than as concessions.
Independent security assessment
Third-party penetration testing and code review commissioned by the client, not by us, before every national deployment.
Source code escrow
Deposited with an agreed escrow agent, with release conditions defined at contract signature.
Logic and accuracy testing
Public, witnessed testing of accreditation and tabulation logic before each election, to a published script.
Mock election & failure injection
Full-scale rehearsal including deliberate connectivity loss, device failure and peak surge, observed by stakeholders.
Open interfaces
Documented APIs to identity, PKI and existing commission systems — a future commission can replace STAR™ itself.
Post-election audit support
Evidence packs, expert testimony and reconciliation support for tribunals and parliamentary inquiries.
White papers & technical briefs
STAR™ documentation
Written for chief electoral officers, ICT directors and legal advisers. Requests are reviewed before release.
WEB
WP‑00
Read
WP‑00
A Secure Voting System Using Encrypted QR Codes and Blockchain Principles
The full secure voting architecture: seven modules, cryptographic identity control, the write-once hash ledger, observer oversight, finalisation, and a candid section on what the architecture does and does not prove. Published in full on this site.
PDF
WP‑01
Request
WP‑01
Chain of Custody as an Electoral Design Requirement
Why evidentiary integrity must be an architectural property rather than an operational procedure. [PLACEHOLDER — attach PDF]
PDF
WP‑02
Request
WP‑02
Offline-First Accreditation in Low-Connectivity Jurisdictions
Deterministic reconciliation, conflict rules and device attestation for polling units without reliable networks. [PLACEHOLDER — attach PDF]
PDF
WP‑03
Request
WP‑03
STAR™ Reference Architecture & Interface Specification
Layer specifications, cryptographic design, integration points and data model overview. [PLACEHOLDER — attach PDF]
PDF
WP‑04
Request
WP‑04
Verifiability Without Trust: The Public Verification API
How observers, parties and researchers can recompute national totals from published evidence. [PLACEHOLDER — attach PDF]
[PLACEHOLDER — DOCUMENT DELIVERY] Decide whether white papers download
directly or are gated behind the request form. For electoral material, gating is usually
preferable: it keeps a record of who holds the architecture documentation. Place approved
PDFs in assets/docs/ and update each href.
Demonstration
Request a STAR™ demonstration
Demonstrations are conducted for electoral authorities and their advisers, either at your premises or in a controlled environment with synthetic data. A typical session runs half a day and covers the full chain from register to declaration.
We do not run generic sales demonstrations. Tell us the jurisdiction, the statutory framework and the specific concern — register integrity, transmission, collation or dispute resolution — and the session will be built around it.
Direct line
STAR™ Programme Office
[PLACEHOLDER — star@qcuboyds.example]
[PLACEHOLDER — +1 (000) 000-0000]
Note on neutrality
STAR™ is proprietary. Our advice is still not for sale.
STAR™ is the one component in our portfolio that we own, and it deserves a plain statement: we will tell a commission when STAR™ is not the right answer.
Where an existing electoral system is sound, our recommendation will be to strengthen it. Where the requirement is narrower than the platform, we will scope to the requirement. And because STAR™ exposes documented open interfaces, adopting it does not foreclose replacing it — which is the same standard we hold every other supplier to.
Why vendor-neutrality matters