Want to know more?
Tell us your situation and a consultant will contact you in no time.
Contact us at
Features
Secure identification for online voting
Secure identification
Identification is one of the key processes in any electronic voting—whether in-person, online, or hybrid. To prevent any potential challenge from advancing, Kuorum’s software ensures regulatory compliance by giving the client the option to choose between basic identification via token and advanced identification using 2FA or qualified certificate.
However, security is not the only relevant factor in electronic identification processes. Usability is essential to ensure that voters of all ages participate without obstacles. That’s why Kuorum’s technology allows you to design different alternative identification flows for the same vote. In this way, it is possible to maintain process security while, at the same time, allowing each voter to choose the identification method that suits them best.
With Kuorum, you can also organize assemblies or elections that combine online and in-person voting. In these cases, you can disable the second authentication factor for those voters attending the in-person event, or enable dedicated devices, such as Kuorum voting kiosks, for those who do not have a smartphone. The platform keeps an audit log of everything that happens during the event, for your peace of mind and that of the auditors.
Furthermore, if you do not have an up-to-date database of your voters, Kuorum’s forms functionality will be useful for collecting that data while complying with electronic identification regulations.
Secure Voter Identification: The Different Types
Secure identification is the process by which an electronic voting platform verifies that each participant is who they claim to be before casting their vote. It is the step that ensures an online vote has the same legal validity as an in-person vote. Kuorum offers two levels of identification—basic via token and advanced via 2FA or a qualified digital certificate—so that each organization can choose the level of security appropriate for its type of vote (shareholders’ meeting, union election, residents’ association meeting, internal consultation, etc.), in compliance with the eIDAS Regulation and Spanish electronic signature regulations.
Basic Security in Voter Identification
Basic identification on Kuorum is done through a unique token sent to the voter via email, which serves as a credential to access the vote:
> How it works: The organizer uploads the voter registry, and each person receives an individual, non-transferable token linked to their identity in the registry.
> When it’s sufficient: internal processes with a low risk of challenge, non-binding referendums, or votes in communities where the voter roll has already been verified by another means (for example, a membership roster).
> What it guarantees: it prevents basic impersonation and duplicate voting, although it does not provide the evidentiary weight of a qualified electronic signature.
>Traceability: Each token is recorded in the audit log (who voted, when, and using which method).
Advanced voter identification security
Advanced identification combines two-factor authentication (2FA) or a qualified digital certificate (DNIe, FNMT certificate, or certificates from other eIDAS-qualified issuers), providing enhanced legal validity against challenges:
> 2FA: token (via email) + second factor (via SMS or through a knowledge-based factor), which reduces the risk of identity theft even if the first factor is compromised.
> Qualified certificate: identification equivalent to a qualified electronic signature under eIDAS, with the highest level of evidentiary value available in an electronic process.
> When recommended: shareholder meetings, union elections, and, in general, processes where legal challenges pose a real risk.
> Hybrid compatibility: In hybrid events (in-person + online), the second factor can be disabled for those who identify themselves on-site, without compromising security for remote voters.
> Certifications supporting this level: ISO 27001, ISO 9001, and the National Security Scheme (high level).
Usability in Voter Identification
Kuorum allows you to configure several alternative authentication flows within a single vote, so that each voter can use the method that best suits their situation without compromising the overall security of the process:
> Multiple parallel flows: a simple token for some voters, 2FA or a certificate for others, depending on the profile or channel (in-person/online).
>Accessibility for all ages: designed for voter registries with low digital adoption rates (residents’ associations, professional associations, labor unions).
> Voting kiosks: dedicated devices for voters without smartphones at in-person or hybrid events.
> Audit log: all identification details (method, time, result) are recorded and visible to administrators and external auditors.
> Voter registration forms: If the organization does not have an up-to-date voter database, Kuorum’s forms module allows it to be compiled in compliance with eIDAS.
The 4 Steps to Secure Identification
Let’s take the online shareholders’ meeting of a publicly traded company as an example. The security of online voting depends on a four-step process, and each step must be at least as robust as the one before it:
1 - Compiling the voter list. The company defines who is eligible to vote: all shareholders or, if proxy voting is permitted, only those who have registered in advance .
2 - Preliminary identity verification. Before the vote, the company verifies each shareholder’s national ID or passport and, where applicable, the documentation proving representation of legal entities or proxy voting. This step is handled by the company itself, without the involvement of the online voting provider.
3 - Voter identification. On voting day, upon accessing the platform, the voter identifies themselves to the system. This is where the online voting provider comes in, and its security level must match or exceed that of the previous steps. For a high level of security, the benchmark is two-factor authentication (something the voter possesses or knows + a dynamic code sent in real time), in line with the Technical Security Specifications of EU Regulation 2015/1502 and comparable to the level required by banks for online transactions.
4 - Activation of the vote. Once identity has been verified, data integrity must be ensured: the recorded vote must not be alterable. This is typically achieved using timestamps, generated by a trusted third party and linked to the date, time, and voter data (IP address, device, etc.); any subsequent alteration causes the timestamp to no longer match. Blockchain technology offers an alternative that provides this same guarantee of integrity without relying on a central certifying authority.
Connect it with your favorite tools
Integrate with leading video conferencing tools to offer your remote constituents a seamless experience. Compatible with all platforms, such as Zoom, Teams, Webex and many more.
Make collective decisions in a simple way
At Kuorum we help people around the world make collective decisions that matter. Tell us your goals and we'll tell you how we can help.
Legal Validity
Lower Emissions
Lower costs
Fewer incidents
Enhanced Security
More participation
Frequently Asked Questions About Secure Voter Identification
What is the difference between basic and advanced identification in online voting?
Basic identification uses a unique token sent to the voter and is sufficient for processes with low legal risk. Advanced identification adds 2FA or a qualified digital certificate, providing enhanced legal validity in the event of challenges; it is recommended for shareholders’ meetings or union elections.
What is a qualified digital certificate, and which ones does Kuorum accept?
It is an electronic certificate issued by a qualified trusted service provider under the eIDAS Regulation. Kuorum accepts certificates such as the DNIe or those issued by the FNMT, among others that are compatible with eIDAS.
Is a vote cast using a simple token as identification legally valid?
Yes, provided that the process is properly audited and the risk of a challenge is low. For processes with greater legal exposure (shareholders' meetings, elections), 2FA or a qualified certificate is recommended.
What are the steps that must be taken before a voter is identified on Election Day?
Before voters access the platform, the organizing company compiles the voter registry and verifies their identity (national ID or passport, and documentation of representation or proxy authorization, if applicable). Verification prior to compiling the voter registry can be done through the platform using the forms feature or independently, without the involvement of the online voting provider.
What level of security does EU Regulation 2015/1502 require for voter identification?
The regulations define several levels of electronic identification security (low, substantial, and high). To achieve the high level—which is recommended for votes involving significant legal risk—two-factor authentication is required: something the user possesses or knows, plus a dynamic code sent at that moment.
How is it ensured that a vote cannot be altered once it has been cast?
Through timestamps generated by a trusted third party, which link the vote to the date, time, and voter information using an alphanumeric key (hash). If the data is altered, the newly generated key does not match the original, revealing the tampering. Blockchain technology offers an alternative to this mechanism without relying on a central certifying authority.
Can in-person and online check-in be combined at the same event?
Yes. Kuorum supports hybrid events where in-person voters can verify their identity without two-factor authentication (verified on-site), while remote voters use 2FA or a certificate, without losing joint traceability in the audit trail.
How can a voter who doesn't have a smartphone verify their identity?
You can log in using Kuorum's voting kiosks—dedicated devices available at the in-person event—without needing a personal device.
What information is recorded during the identification process for a subsequent audit?
The platform maintains an audit trail that includes the identification method used, the time, and the result of each verification, which is available to administrators and external auditors of the process.
Can I use different forms of identification for different voters in the same election?
Yes. Kuorum allows you to design alternative authentication workflows within the same event, so that each voter can use the method best suited to their profile without compromising overall security.
What security certifications support voter identification on Kuorum?
Kuorum holds ISO 27001, ISO 9001, and the National Security Scheme at the high level—certifications that support both basic and advanced security in the identification process.
Does 2FA authentication slow down the voting process?
Not significantly: The second factor is sent and validated within seconds (via SMS, app, or email), and can be selectively disabled for in-person voters without compromising the security of remote voters.
