Zero-knowledge architecture
Confidentiality mapped to observable behavior: browser-sealed responses, ciphertext-only storage, and client-side admin decrypt.
On this page
Heads up
Terminology: in product copy, zero-knowledge means the service is designed not to hold the secrets needed to read poll answers. It is not a claim about formal ZK proof systems in academic cryptography.
InviziPoll's confidentiality goal is simple to state and hard to fake: the service never holds the secrets needed to decrypt responses. This page maps that goal to observable product behavior for security and architecture reviewers. For the seal path and crypto parameters, start with Encryption model overview.
Poll and response path
| Concept | Behavior |
|---|---|
| Poll keys | Browser-generated at publish |
| Server holds | Public keys + encrypted wraps only |
| Respondent path | Seal client-side before transport |
| Response rows | Ciphertext blobs only |
| Admin decrypt | In-app after results load |
| Backup wraps | Password/passkey; server sees wraps |
What this buys you
A database dump, a compromised ops account, or a production snapshot still yields sealed response blobs - not readable answer plaintext.
Shared folders (collaboration)
| Concept | Role |
|---|---|
| Poll → folder | Folder key wraps poll private keys |
| Folder → people | Per-collaborator encrypted wraps |
| Unwrap location | Browser only (folder → poll → payload) |
- Unwrap the folder keyEach collaborator unwraps their own folder-key wrap with local key material.
- Unwrap the poll private keyThe folder key unlocks the poll wrap for polls in that folder.
- Decrypt aggregatesCiphertext loads into the admin app; charts render only after client-side decrypt and threshold checks.
const folderKey = await unwrapFolderKey(localAdminKey, folderWrap);
const pollPrivate = await unwrapPollKey(folderKey, pollWrap);
const answers = await decryptAggregate(pollPrivate, sealedBlobs);
Before you promise linkage
Do not promise identity linkage the crypto cannot support. Access codes and ballots are designed so the service cannot join a code record to a specific stored response - see Access codes and anonymity.
Related anonymity controls
Pair these guarantees with Aggregate results and anti-inference and Respondent anonymity and zero telemetry. Residual threats and honest limits live in the threat model.
Next
Read Encryption model overview for the seal sequence and parameters, or Post-quantum cryptography for hybrid algorithms on new material.