Security and trust

Trust you can check.

EIRIS handles field evidence, agent locations and results. It is designed so every record belongs to one organization, every important action leaves a permanent record, and every photo can be checked against what was captured in the field.

No system is perfectly secure, and we will not tell you otherwise. This page describes what EIRIS is designed to do, and how you can check it.

Request a security walkthroughOpen the live demo
Audit log
append-only
  • 16:43:01Coordinator · Bauchi LGAbroadcast.sent12 wards · 214 agents
  • 16:42:52Election adminexport.createdIncidents CSV · reason recorded
  • 16:42:43Agent · PU 05/02/01/019result.submittedBirshi/Miri · sheet photo + hash
  • 16:42:34Verifier 01media.viewedSheet photo · PU 05/02/08/021
  • 16:42:25Coordinator · Kangereincident.acknowledgedINC-0412 · High · Kangere
  • 16:42:16Verifier 03result.acceptedPU 05/02/15/007 · totals match sheet
  • 16:42:07Agent · PU 05/02/04/012checkin.createdDawaki ward · GPS 38 m from unit
Written in the same transaction as the changedemo data
Tenant isolation

Your data stays inside your organization.

EIRIS can host many organizations. Observer groups, media monitors and campaign situation rooms never see each other's agents, incidents or evidence. Isolation is enforced in layers.

  1. 01

    Every record carries its organization

    Incidents, results, media, agents and audit records are stored with an organization ID. Election records also carry an election ID.

  2. 02

    Every request is checked

    The application and the API confirm the organization on each read and write, not only at sign-in.

  3. 03

    The database adds a second lock

    PostgreSQL row-level security is applied where practical, so a missed check in code is not the only safeguard. It is being introduced in stages.

Request path · demo

Ward coordinator · Example Observer Group
GET /incidents?ward=dawaki
  • Signed in, session valid
  • Role allows viewing incidents
  • Organization matches
  • Ward is in scope
200 · 6 incidents, all in Dawaki ward
Same user
GET /incidents/INC-7731 · belongs to another organization
  • Signed in, session valid
  • Role allows viewing incidents
  • Organization does not match
404 · not found, attempt recorded
Org A
org_id=a1forg_id=a1forg_id=a1f
Org B
org_id=b72org_id=b72org_id=b72
Org C
org_id=c09org_id=c09org_id=c09
Roles and scope

A role is never the whole answer.

Every permission is checked against four things: the organization, the election, the role, and the geography a person is responsible for. A ward coordinator in Dawaki sees Dawaki, not the next ward.

OrganizationExample Observer GroupElectionGovernorship (demo)RoleWard coordinatorAreaDawaki ward, Bauchi LGA
  • View incidentsOwn ward
  • Acknowledge and resolve incidentsOwn ward
  • See agent check-in locationsOwn ward
  • Accept or flag a resultNo access
  • Message agentsOwn ward
  • Export sensitive dataNo access
  • Change election setupNo access
  • See another organization's dataNever
AllowedWithin their areaNeeds confirmationNo accessexample configuration

A ward coordinator can

  • See their own ward
  • See their assigned polling units
  • See their assigned agents
  • Handle incidents in their area

A ward coordinator cannot

  • Open unrelated wards
  • Change billing or organization settings
  • See another organization
  • Change election configuration
Audit trail

Every important action leaves a record.

Audit records are written in the same database transaction as the change they describe, so one cannot happen without the other. They are append-only: the application has no way to edit or delete them.

  • Sign-in and sign-out
  • Role changes
  • Account creation
  • Assignments
  • Report edits
  • Incident status changes
  • Verification decisions
  • Result corrections
  • Media requests and deletions
  • Exports
  • AI actions
  • Support access
  • Configuration changes
One audit recordaudit_events · #48,213
actor
Verification officer 03
action
result.accepted
entity
Result · PU 05/02/04/012 · Dawaki
before
status = pending_review
after
status = accepted
reason
Typed totals match the sheet photo
time
20 Feb · 16:42:07 WAT
session
browser · session 7f3a · IP recorded
organization
Example Observer Group
election
Governorship (demo)
Evidence integrity

The original is never altered.

Photos and video from the field are kept exactly as captured. Previews, AI readings and corrections are stored separately, beside the original, never on top of it.

Chain of custody

Result sheet photo · PU 05/02/04/012

IMG_2041.jpg · 3.1 MB
  1. 16:38:52Captured

    Photo taken in the field app. Original bytes kept, metadata preserved.

  2. 16:38:52Fingerprinted on the phone

    SHA-256 computed before anything else touches the file.

  3. 16:41:10Uploaded when signal returned

    Saved offline first, then sent unchanged.

  4. 16:41:11Fingerprint checked on arrival

    The server recomputes the hash. It matches.

  5. 16:42:03Viewed by Verification officer 03

    Every view and download is logged against the photo.

sha256 at capture 9f2c41e07ab3d8c56e1f0b94a27d3c88e5b1a6f40c7d29e8b31f5a0c6d4e7b12
sha256 on server  9f2c41e07ab3d8c56e1f0b94a27d3c88e5b1a6f40c7d29e8b31f5a0c6d4e7b12 Match

Who has opened this photo

  • Verification officer 03
    16:42:03 · viewed
  • Coordinator · Dawaki
    16:55:40 · viewed
  • Election admin
    17:20:12 · downloaded · reason: legal team request
  • No resizing or re-encoding of originals
  • Signed, short-lived links to view media
  • Download permissions set per role
  • Duplicates suggested, never merged automatically
Privacy and location

Collect what the operation needs. Nothing more.

An agent's location is sensitive. EIRIS records it when an agent checks in or files a report, to show whether they are at their polling unit. It is not designed for continuous tracking.

Incident evidence is handled with care

Field evidence can include private people, vulnerable people or distressing images. Access is restricted by role, sensitive items can carry a content warning, downloads need permission, and every access is recorded.

Settings · Location and privacyset by your organization
  • Who can see agent locationsCoordinators, within their area
  • Location precision on the mapExact at check-in
  • Keep location records for90 days after the election
  • Keep movement historyOff
Changes to these settings are confirmed and recorded in the audit log. Values shown are an example.

Correct a submitted result

PU 05/02/09/004 · Majidadi B · Governorship (demo)

The original submission and sheet photo are kept. Your correction is stored as a separate record.

Confirm with your authenticator code
418092
CancelSave correction
Recorded in the audit log with your reason
High-risk actions

Consequential steps ask twice.

Some actions change what an organization can rely on. For these, EIRIS asks for stronger permission, a reason, an on-screen confirmation and, optionally, a second-factor code. Then it records all of it.

  • Giving someone a more powerful role
  • Correcting a submitted result
  • Exporting sensitive data
  • Suspending many agents at once
  • Deleting an election
  • Creating an API key
  • Transferring organization ownership
Reliability

Built to keep working when parts of it don't.

Election day is the wrong day to discover a weak link. EIRIS is designed to degrade gracefully, and its backups are only counted once they have been restored.

  • If the internet drops in the field

    Agents keep working offline. Reports send when signal returns.

  • If aI is unavailable

    Deterministic checks and human review carry on. AI is never a single point of failure.

  • If live updates fail

    Screens fall back to regular refresh. The database stays the source of truth.

  • If a detailed map layer fails

    The base map and polling-unit points remain.

Backups that have been restored

The production database has automatic backups with point-in-time restore. Before each election, a backup is restored into the staging environment and checked. A backup that has never been restored is not counted as one.

01Snapshot taken
02Restored to staging
03Record counts compared
04Sample evidence opened
05Drill logged
Where your data lives

Plain answers about hosting.

We would rather tell you exactly where things stand than hand you a badge.

Ask us a security questionDedicated deployments
Hosting today
The first release runs in Frankfurt, Germany (EU region eu-central-1). Data is encrypted in transit, and media is served through signed, short-lived links.
Nigerian data protection
A legal review under the Nigeria Data Protection Act 2023 is in progress. We will work through data-residency requirements with you before any deployment.
Dedicated or private hosting
For organizations that need their own infrastructure, Enterprise and Private deployments are scoped per engagement.
Certifications
EIRIS does not hold third-party security certifications today. We will say so plainly until that changes.