Security & access control.

Data protection

• Encryption in transit. All traffic is served over HTTPS/TLS; the application and its APIs are not reachable over plaintext.
• Encryption at rest. Voter records and model outputs are stored on encrypted volumes.
• Isolated environments. Staging and production run as separate stacks, so test activity never touches live voter data.

Access control

Access is role-based and least-privilege. A canvasser sees only the turf and doors assigned to them; personally identifiable information is gated behind explicit read roles, and analytics are separated from PII. No account is granted broad access by default.

• Region-scoped permissions keep users inside the geography they are authorized for.
• Sign-in is on a dedicated authenticated surface at app.voterra.io; the public site collects no credentials.
• Administrative provisioning is explicit — accounts are created and scoped, not self-granted.

Voter contact compliance

Field tools are built to keep contact compliant. Peer-to-peer messaging is one-voter-per-action by design — there is no bulk-send affordance — which keeps outreach within TCPA expectations rather than relying on operator discipline.

Auditability

Changes to the roll and to voter contact are tracked to the household, so activity is attributable rather than anecdotal. Data is handled under strict provenance and access control end to end.

Reporting a concern

If you believe you have found a security issue, please email hello@voterra.io with details. We take reports seriously and will respond promptly.