Pepvote

Security at Pepvote

Pepvote runs elections, polls and award voting for organisations. People trust it with voter lists, ballots and payments, so this page explains how we protect that data, how to tell a real Pepvote message from a fake one, and how to report a problem.

Report a security issue

If you find a vulnerability or see Pepvote being abused, email security@pepvote.com. Include the URL, what you saw, and steps to reproduce if you have them. We read every report and aim to reply within two business days. Please give us time to fix an issue before publishing it.

Our contact details are also published in the standard location at /.well-known/security.txt.

How voting works, and what we ask you for

  • Voters receive a link from the organiser. The link opens a voting page on pepvote.com or on a domain the organiser connected to Pepvote.
  • Depending on the organiser's settings, the voting page may ask for an email address to send a one-time code, a voter key the organiser issued, or a registration step.
  • We never ask for your Pepvote password, bank login or card details by email, chat or phone. Payments, where an organiser enables them, happen only on the voting page through Paystack or Stripe.
  • A vote is recorded once. After you vote you receive a confirmation code so you can check that your ballot was counted.

How to recognise a real Pepvote email

  • Our emails come from addresses ending in @pepvote.com, and the underlying envelope sender is send.pepvote.com. Our domain publishes SPF, DKIM and a DMARC "reject" policy, so a forged pepvote.com sender should be rejected by your mail provider.
  • Links in our emails point to pepvote.com, a subdomain of it, or a custom domain the organiser connected. Hover over a link to check before you click.
  • We do not send attachments, and we do not ask you to download software.
  • If an email claims to be from Pepvote and does not match this, forward it to security@pepvote.com.

How we protect data

  • All traffic is encrypted in transit with TLS, and the site enforces HTTPS with HSTS.
  • Application data is stored in Convex, which encrypts data at rest. The website is served by Vercel. See our Subprocessors page for the full list of providers and what each receives.
  • Access to the dashboard requires an account with a verified email. Sign-up and password reset are protected against bots with Cloudflare Turnstile.
  • Organisers control who can vote through voter lists, invitations, voter keys and verification settings. Ballot casting is rate limited and checked for duplicates.
  • Payment card data never touches Pepvote servers. It is handled by Paystack and Stripe.
  • Service health is published at status.pepvote.com.

Questions

For anything else, email support@pepvote.com. Our Privacy Policy explains what data we collect and why.