Introducing Shutter Governance

Today we’re introducing Shutter Governance, a system for municipalities, councils, universities, unions, and cooperatives to run elections where every ballot stays private and every result can be independently verified by anyone.

It’s something we’ve been building toward for years. Since 2022, our vote encryption on Snapshot has protected more than 370,000 votes across over 800 digital communities.

Shutter Governance builds on that work for institutions.

Why we cared enough to build it

Ask yourself something. The last time you saw an election result, could you actually verify it, or did you just have to trust that everyone behind the curtain did their job?

Until recently, you’ve always had to trust those running the election alone.

The count happens somewhere you can’t see, and you’re asked to take it on faith. That’s how doubt gets in. A leak here, a contested number there, a rumor that spreads faster than the facts, and a perfectly fair result could end up in a fight.

We didn’t want people arguing over whether to trust the results. We wanted them to be able to check for themselves.

What Shutter Governance does

Shutter Governance keeps every vote secret and lets anyone confirm that the final tally is correct. Your choice is hidden from us, from the organizers, from the government, from everyone. And yet you can check that your own vote was counted, and anyone can verify the result, with no account and no special access.

To understand this better, give our interactive demo a try.

Three proven techniques, working together

The Shutter Governance system secures votes using ElGamal homomorphic encryption. This is a special type of encryption with a property that sounds impossible: you can add numbers together without ever seeing them. The election authority never decrypts individual votes. It adds all the encrypted votes together and decrypts only the final sum — the result — with the inputs never revealed to anyone.

The logical follow up question: couldn’t encrypted votes contain anything, like invalid choices or multiple votes by a single voter? That’s where zero-knowledge proofs come in. When you submit your encrypted vote, you also submit a mathematical proof that demonstrates your vote is valid without ever revealing your vote. The proofs are tied to the unique voter identity, ensuring that each eligible voter can only submit one valid proof per election. If someone tries to vote twice, the system will detect that a proof from that voter already exists and reject the duplicate. The system rejects any vote without a valid proof and any duplicate submissions, making both ballot stuffing and double voting impossible.

The decryption process uses threshold cryptography, where the decryption key is split among multiple independent parties like election monitors, civic organizations, and international observers. A predetermined number of these parties (for example, three out of five) must cooperate to decrypt the final tally, since no single entity can decrypt votes alone. This distributed approach eliminates the need for a central authority that made previous digital voting systems vulnerable.

The result? A system that’s permanently private, publicly verifiable, and practically scalable to millions of voters.

Why this wasn’t possible until now

If this sounds like it should already exist, you’re right, and plenty of serious people have tried. West Virginia, Switzerland, Moscow, Iowa: the track record is a graveyard of leaks, cracks, and crashes. Every attempt hit the same wall. You could have privacy, transparency, or scale, but never all three at once.

What changed wasn’t a faster computer. The field had been trying to solve the wrong problem.

Developers chased encryption that could run any computation on sealed data. That’s like building a Formula 1 car to drive to the grocery store. Impressive, but unnecessary and impractical, and far too slow and expensive for a real election. Because an election doesn’t need to compute anything on your ballot. The only thing it needs is a final, accurate vote count.

So we built on ElGamal encryption then paired it with zero-knowledge proofs and threshold encryption. The result: votes stay encrypted forever, yet anyone can verify the tally is correct. Like counting ballots inside sealed envelopes without opening a single one. The wall is simply gone.

A new standard for modern voting

Shutter Governance isn’t here to replace how elections are run, it’s here to strengthen it.

The system works alongside voting systems institutions already use, so municipalities, councils, universities, unions, and cooperatives can add privacy and verifiability without starting over. The same approach scales from a staff council vote to an election with millions of voters. Everything is built in Europe, GDPR-compliant by default, and fully open source, so anyone can check how it works.

While Shutter Governance itself is new, and it adds new capabilities, the ideas behind it are not.

Encrypted ballots, publicly verifiable tallies, and decryption keys split among independent parties have been the foundation of academic voting research for years. Systems like Belenios, which grew out of French public research, have run elections on these same principles since 2015.

The ground it stands on has been tested by cryptographers.

If you run elections, or build the platforms that do, we’d like to hear from you. Contact us for a discovery call and start with a small pilot to see a verifiable result for yourself.

Democracy shouldn’t run on faith alone. And now anyone can verify every vote.