A voter file comes with strings attached. The state gives it to your campaign for your campaign, and for nothing else. Here’s how we keep it that way, including the parts that still depend on a person rather than the software.
YOUR FILE IS YOURSThe voter file you load belongs to your campaign, and so does everything your people add to it: knocks, calls, notes, support scores. We don’t sell it or rent it. We don’t copy it into another campaign, and we don’t train AI on it. We use it to run your campaign and to help when you ask us to.
WHERE IT LIVESIn a Postgres database run by Supabase, in Amazon’s US East data center in Ohio. Supabase encrypts stored data with AES-256 and everything in transit with TLS, backs up paid databases every day, and holds a SOC 2 Type 2 report. Cloudflare serves the app itself.
EVERY CAMPAIGN IS WALLED OFF IN THE DATABASEEvery table that holds campaign data has row-level security on it, so Postgres decides who reads a row, not the app. A screen that asks for another campaign’s voters gets an empty answer back. If the same person is on two campaigns’ files, those are two separate records that never touch.
WHO ON YOUR TEAM SEES WHATManagers, captains and volunteers get different access, set campaign by campaign. Whether somebody can see the donor file is a switch a manager flips for that one person, and it starts off.
WHO ON OUR SIDE CAN SEE ITToday one person at Campaign Command, the founder, can open any campaign to fix a problem. A tighter control is already built: access to one campaign at a time, with a written reason, for one to twenty-four hours, on the record. It isn’t switched on yet. If you want it on, it goes in your contract.
SERVICES THAT TOUCH PART OF ITTo put houses on the map, street addresses go to the US Census geocoder, Geocodio and OpenStreetMap’s Nominatim. No names go with them. Walk routes are worked out on our own routing server, hosted by Fly.io, which gets door locations and nothing else. Email your campaign sends goes out through Resend, which gets the voter’s name and email address. Map tiles come from OpenStreetMap and Esri. When a walker taps Navigate, that one house opens in Google Maps on their phone.
CHANGES LEAVE A TRAILEvery change to a voter’s support level or vote plan writes a history row: what it was, what it became, who changed it and when. Nobody can edit that history, including the person who made the change.
GETTING IT OUTLists, mail files and walk packets export to a spreadsheet from the screen they live on. There isn’t one button that hands you the whole campaign in a single file yet. When you leave, we put that file together for you.
WHEN THE CONTRACT ENDSNothing deletes a campaign on its own. Tell us you’re done and we delete the campaign and every record in it, along with the voter files you uploaded, within 30 days. Copies in our database host’s backups go away as those backups expire on their normal schedule, and we never restore one except to recover your own campaign.
Want it in writing? Every quote comes with a one-page data agreement that says all of this, with your campaign’s name on it.
