Platform5 min
Online Voting Phishing Prevention: Six Checks to Run
Oct 20, 2026Read
← Back to Blog
Platform
How to Evaluate an Online Voting Vendor for Compliance: A 2026 Checklist
By Votem Compliance Team·July 31, 2026
7 min read
How to Evaluate an Online Voting Vendor for Compliance: A 2026 Checklist
When you shift an election online, you are not just buying software. You are transferring your organization's compliance risk to a third party. Evaluating an online voting vendor requires looking past the interface to understand exactly how they protect the audit trail, authenticate voters, and defend the results if challenged.
A union with 2,400 members in Ohio recently asked us how to choose a vendor after their previous self-service election was overturned by the Department of Labor. The problem was not the software itself, but the lack of verifiable chain-of-custody documentation. If your credit union, pension fund, or association is evaluating a new platform, you need a structured approach to vendor diligence.
The Difference Between Software and Service
The first question to ask is whether you are buying a self-service tool or a managed service. Many low-cost online voting platforms provide a blank canvas. You upload the voter list, build the ballot, and hit send. This approach is fine for a social club, but it is dangerous for regulated organizations.
If you use a self-service tool, your organization retains all the compliance liability. If a member claims they never received a credential, or if the tally is questioned, you must produce the logs. A managed service, by contrast, handles the entire election lifecycle. The vendor coordinates the notice distribution, manages the multi-channel voting, and automatically generates the board-defensible audit file.
The distinction matters because regulators do not care whose software failed. They care whether your organization can produce the required documentation. A vendor who simply provides a platform and steps back leaves you exposed when the DOL or NCUA comes calling.
Evaluating Authentication and Credentialing
How a vendor authenticates voters is the core of election integrity. A system that relies solely on an emailed link is vulnerable to forward-attacks, where a member forwards their ballot link to someone else. You must require multi-factor authentication or a unique, single-use credential that cannot be reused once cast.
Ask the vendor how they handle credential recovery. If a member loses their PIN, the recovery process must be secure and logged. A platform should never allow an administrator to see a member's active credential or cast a vote on their behalf. The system must enforce strict separation between voter identity and ballot selections to maintain secrecy.
For organizations subject to LMRDA Title IV, the DOL has been explicit: the voting system must ensure that only eligible members vote, that each member votes only once, and that the secrecy of the ballot is preserved. Any vendor who cannot demonstrate all three controls in writing is not ready for a regulated union election.
The 5-Point Vendor Compliance Checklist
Before you sign a contract with an online voting platform, require the vendor to answer these five questions and provide supporting documentation.
- Do you hold a current current SOC 2 documentation? This proves that an independent auditor has verified their security controls over a sustained period, not just a point-in-time snapshot. A SOC 2 Type I report covers design only. Type II covers actual operating effectiveness over at least six months.
- How do you handle multi-channel voting? If you need to offer phone (IVR) or mail ballots alongside web voting, the vendor must coordinate all channels in real time to prevent duplicate voting. Ask specifically whether deduplication is real-time or batch-processed overnight.
- What does your audit package look like? Ask for a sample of the final certification report. It should include delivery logs, authentication records, and a mathematical proof of the tally without revealing individual choices. If the vendor cannot show you a sample, they do not have one.
- Are your ballots WCAG 2.2 AA compliant? Accessibility is not optional for regulated organizations. The platform must support screen readers, keyboard navigation, and sufficient color contrast so every eligible member can vote independently, without assistance.
- Will you defend the election if it is challenged? If the results are challenged by the DOL, NCUA, or a member lawsuit, will the vendor provide the necessary data and expert testimony to support your organization? Get this commitment in writing before you sign.
Security Certifications and Data Handling
Security is more than encryption. While AES-256 encryption should be standard for data at rest and in transit, you also need to evaluate how the vendor handles data after the election ends.
The table below summarizes the key security and compliance markers to verify during vendor evaluation.
| Evaluation Area | What to Require | Red Flag |
|---|---|---|
| Security certification | current SOC 2 documentation | SOC 2 Type I only, or no certification |
| Data encryption | AES-256 at rest and in transit | TLS only, no encryption at rest |
| Ballot secrecy | Logical separation of identity and vote | Linked voter-ballot records |
| Data retention | Written policy with event-based triggers | Indefinite retention or no written policy |
| Uptime SLA | 99.9% or higher during election window | No SLA or SLA below 99% |
| Penetration testing | Annual third-party pen test with report available | Internal testing only |
The vendor must also have a clear process for preserving evidence during a challenge period and securely destroying personally identifiable information once that period expires. A platform that holds voter data indefinitely creates unnecessary privacy risks for your organization and may conflict with state privacy laws.
Regulatory Fit by Organization Type
Not every vendor understands the regulatory environment for every type of organization. A platform built for corporate shareholder votes is not the same as one designed for election operations under LMRDA, NCUA Part 701, or ERISA. Before you evaluate features, confirm that the vendor has documented experience with your specific regulatory framework.
Ask for references from organizations similar to yours. A vendor who has run 50 credit union board elections will understand the NCUA's examiner expectations in a way that a general-purpose survey tool simply cannot. The same applies to pension fund trustee elections under ERISA and labor union officer elections under Title IV of the LMRDA.
Frequently Asked Questions
What happens if the vendor's system goes down during an election?
A reliable vendor will have documented uptime SLAs and redundant infrastructure. Ask specifically about their disaster recovery plan, how they communicate outages to voters and administrators in real time, and whether the election window can be extended if a technical failure affects participation. Get the answer in writing in the contract.
Can a vendor prevent members from voting twice across different channels?
Yes, but only if the platform is designed for it. A secure platform issues a single, universal credential. The moment that credential is used, whether online, by phone, or by mail, the system immediately locks out any subsequent attempts. Ask the vendor to demonstrate this in a live demo before you commit.
Does the vendor need to understand our specific bylaws?
Yes. Your election must mirror your governing documents. A vendor should configure the system to enforce your specific quorum requirements, proxy rules, candidate eligibility criteria, and notice periods. A platform that cannot be configured to match your bylaws will create compliance gaps that regulators will find.
How do we verify a vendor's compliance claims?
Request the actual current SOC 2 documentation, not just a badge on their website. Ask for the most recent penetration test summary. Check whether their DHS or CISA review documentation is current. And ask for two or three references from regulated organizations in your industry who have been through a compliance audit or election challenge while using the platform.
The Bottom Line
Choosing an online voting vendor is a compliance decision, not just an IT purchase. The platform you select will either protect your organization when an election is challenged or leave you scrambling to produce records you do not have. By demanding rigorous authentication, verifiable audit trails, comprehensive security certifications, and regulatory expertise, you protect your organization from the kind of costly election challenges that end careers and trigger federal investigations.
If you are preparing for your next board or officer election and want to see how a compliance-first platform handles vendor diligence, our team can walk you through the requirements before you set a single deadline. Contact us to review your specific bylaws, or see our pricing to understand what a fully managed, board-defensible election looks like.