Security - Flip by Stepping Stone Systems

🔒

Flip uses two separate security models: password-protected accounts for coordinators, and time-limited share tokens for volunteers. Neither role can access another campaign's data.

Coordinator Accounts

Coordinators log in with email and password. Passwords are never stored in plain text.

Password storage

Hashed with BCrypt using a per-account salt. The original password cannot be recovered from what is stored.

Session token

JWT signed with HMAC-SHA256. Carries only email, role, and display name - no sensitive data.

Token lifetime

24 hours. After expiry the coordinator must log in again.

Signature validation

Every API request verifies the token's signature and expiry before returning any data. A tampered or expired token is rejected.

Data access

Coordinators see only the campaigns they are assigned to. One coordinator's data is not accessible to another.

Compromised account

An account can be disabled immediately. Disabled accounts are rejected at login even with a correct password.

Route Share Links

Volunteers never create accounts. Each route is assigned a unique share link that the coordinator distributes to their volunteer. Possessing the link is the credential.

Token format

8-character string using A-Z, a-z, and 0-9. Generated with a cryptographically secure random number generator.

Combinations

62⁸ = approximately 218 trillion possible tokens. Guessing a valid token at random is not a practical attack.

Scope

Each token grants access to exactly one route. It cannot be used to browse other routes, other canvasses, or any coordinator data.

Volunteer data

Volunteers provide their name and email when claiming a route. That information is stored on the route record and is visible to the coordinator. It is not shared with other campaigns or other coordinators.

Completed routes

Once a route is marked complete, its share link is locked. No further changes can be made through that link.

What Each Role Can Access

Platform Admin

Manages coordinator accounts. Can view all campaigns. Cannot impersonate coordinators or access data without an authenticated session.

Coordinator

Sees only the campaigns they are assigned to. Can create canvasses, generate routes, view volunteer progress, and export results for their own campaigns.

Volunteer

Accesses a single route via share link. Sees voter names, addresses, and household notes for that route only. Cannot see other routes, the coordinator dashboard, or any other campaign data.

Infrastructure

Flip runs on Microsoft Azure. All API endpoints and static files are served over HTTPS. Campaign data is stored in Azure Table Storage in the Central US region.

No voter file data is stored on the volunteer's device. The route data is fetched from the server when the volunteer opens their link and is not cached to local storage.