Lenient when you want. Mandatory when it matters.
A sentiment poll and a binding association election should not share a front door. Verification scales with what is at stake — but the one-token rule never moves, at any tier.
Casual
Sentiment and community polls where the cost of a wrong answer is low and participation matters more than proof.
- Optional demographics
- Configurable verification
- Still one token per participant
- Aggregate-only by default
Organization
HOAs, associations, boards and member votes — where the result is binding on the people who cast it.
- Member roster / invite gates
- Address-bound invites, non-forwardable
- Optional KYC attributes
- Exportable audit trail
Country-grade
Official voting and polling with mandatory verification and an evidentiary standard that has to survive challenge.
- KYC: ID upload, image checks, webcam / live video
- Voter ID sync and eligibility databases
- Mandatory demographics where required
- Never publishes per-address choice
Tier 03 capabilities are on the product path. We do not describe them as shipped until they run in production — see what we do not claim.
The four gates
Any poll can compose these independently. They are evaluated before a ballot exists, not after a vote is cast, so a rejected participant never enters the tally in the first place.
- Personhood — is this a unique human who has not already been counted? Enforced by a nullifier issued once per verified person.
- Eligibility — is this human allowed in this poll? A member roster, a district, an eligibility database.
- Capacity — has the poll reached the participant cap its creator set?
- Invitation — for a private poll, can this address prove membership in the allowlist?
Why one address is not one person
The obvious way to gate a blockchain vote is one address, one vote. It does not work: addresses are free and unlimited, so that rule counts wallets, not people. The less obvious failure is worse — if an operator role can mark addresses as verified, that role can mint an electorate.
So personhood is bound to a nullifier rather than to an address. A second registration by the same human collides with the nullifier already on record and is refused, whatever address it arrives from. Revoking frees the nullifier so a real person can re-enrol after losing keys, and a rebind moves a live personhood to a new address atomically — without ever producing two live accounts that share one.
Private and invite-only polls
A private poll carries a Merkle root of eligible addresses; joining requires a proof against it. The leaf is bound to the address, which makes an invite non-forwardable — a proof authorises the address it was generated for, not whoever ends up holding the code. An invite link that leaks does not become a vote.
What "official" adds
Marking a poll official is not a badge. It changes what the contract permits:
- Creating one requires an election-officer role — not any user.
- It must be a verified vote. An official poll can never run in open, unverified mode.
- It may never publish per-address choice, at any setting.
- It cannot certify a winner from an empty ballot set.
These are contract-level refusals rather than review steps, which is the difference between a guarantee and a promise.
Bring a vote that has to hold up.
Tell us what you need to run and what standard it has to meet.