Security
Last updated: July 9, 2026
This page describes the security practices that apply to the VOTIC platform. It is maintained by the VOTIC team and is not a certification or independent audit report.
Transport & storage
- All traffic is served over HTTPS with modern TLS.
- HSTS is enabled site-wide so browsers refuse to downgrade to plaintext HTTP.
- Data at rest is encrypted by the managed database provider.
Response headers
VOTIC sets modern security response headers on every page, including Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.
Access controls
- Role-based access separates super administrators, organization moderators, and anonymous participants.
- Row-level security policies scope every read and write to the calling user's organization.
Tenant isolation
Each customer organization operates inside its own logical tenant. Discussions and participant tokens issued by one organization are not readable by another.
Anonymity for participants
Participants contribute through rotating anonymous tokens rather than user accounts. Contributions are not linked back to a real identity by the platform.
Responsible disclosure
If you believe you have found a security issue, please email security@votic.app. We appreciate reports and will respond promptly.