Introducing Confidential Voting with Zama

As more institutions move onchain and regulatory frameworks mature, the requirements for onchain systems are becoming more diverse. Public-by-default infrastructure remains a critical foundation, but organizations increasingly need ways to protect sensitive information while still meeting requirements around auditability, disclosure, and compliance. Neither absolute transparency nor absolute privacy will fit every use case.

Different projects will make different tradeoffs between transparency, privacy, usability, and compliance. There is no single model that works for every organization, and our tools need to support more of those choices.

Today, we’re introducing Confidential Voting, an Aragon OSx governance plugin built on Zama Protocol. It allows individual votes to remain encrypted while they are counted, while preserving the familiar experience of casting a vote on Aragon. Zama’s programmable confidentiality also makes it possible to define what information can be decrypted, by whom, and under what conditions.

The result is a new governance primitive for organizations that need confidential votes while retaining familiar UX, composability, and the flexibility to design around their own compliance requirements.

Casting a confidential vote should feel like casting any other vote

Confidentiality can introduce friction at the application layer, requiring additional interactions or specialized environments that change how users participate. Zama is designed to abstract that complexity while keeping encrypted state available for onchain computation.

With Confidential Voting, voters interact with the proposal through the familiar Aragon interface. Their vote is encrypted client-side and remains encrypted as it is counted using Zama’s Fully Homomorphic Encryption (FHE). The voting experience remains familiar, while the individual choice remains confidential.

This makes confidentiality a property of the governance process without requiring a fundamentally different voting experience.

Confidentiality can be programmable

Confidentiality does not have to mean making information permanently inaccessible. While some organizations require that guarantee, others may need to disclose specific information to an auditor, regulator, or other authorized party.

Zama makes these disclosure rules programmable, allowing applications to define what can be decrypted, by whom, and under what conditions. In a governance process, individual votes can remain confidential while the final tally is made public, with the option to grant designated parties access to specific encrypted information where required.

This creates the option for programmable compliance: organizations can protect information from general disclosure while defining access around their regulatory or operational requirements.

Confidentiality without sacrificing composability

Aragon OSx uses a modular plugin architecture, allowing organizations to introduce Confidential Voting alongside other governance primitives.

Projects can determine how confidentiality should work within a governance process and how that process fits into their broader operational architecture, including different approval stages, timelocks, veto mechanisms, or execution controls.

This gives organizations more flexibility to introduce confidentiality where it is useful while designing a governance system that meets their unique needs.

How Confidential Voting works

The Confidential Token Voting plugin keeps individual votes encrypted from the moment they are cast through the end of the voting process. Only the final aggregate result is decrypted.

1. Cast and encrypt a vote. Voters select Yes, No, or Abstain through the Aragon interface. The choice is encrypted client-side using Zama’s Relayer SDK and submitted with an input proof.

2. Validate the encrypted choice. The plugin derives a one-hot representation of the ballot using FHE equality checks against Yes, No, and Abstain. This guarantees that exactly one valid option is counted without relying on the client to submit a correctly formed vote.

3. Apply voting weight and tally while encrypted. The voter’s voting weight is applied to the encrypted choice and accumulated into encrypted Yes, No, and Abstain tallies. The plugin can continue computing over these values without revealing which option an individual voter selected.

4. Keep individual ballots permanently confidential. The plugin grants itself the permissions required to compute over encrypted ballots and tallies, but does not grant decryption rights over individual ballots or make them publicly decryptable. This can be configured to give designated parties access under predefined conditions, allowing organizations to build for specific disclosure or compliance requirements.

5. Decrypt the aggregates at close. Once the voting period ends, the plugin submits only the final Yes, No, and Abstain tallies for threshold decryption. The resulting cleartext totals are returned with a proof, allowing the plugin to evaluate support and quorum against the final result.

6. Execute if the proposal passes. If the proposal meets the configured support and quorum requirements, the plugin instructs the Aragon DAO to execute the proposal’s actions.

To preserve confidentiality throughout the voting period:

• No running tallies. Results remain encrypted until voting closes, preventing the evolving count from influencing subsequent voters.
• No early execution. Proposals are evaluated only after the voting period ends and the aggregate tallies are decrypted.
• Vote replacement. Voters can change their encrypted vote until close without revealing either choice. This also provides coercion resistance: a vote cast or shown before the deadline does not prove the voter’s final choice.

More options for onchain governance

As the range of organizations operating onchain expands, so will the range of governance requirements they bring with them. Some processes will benefit from complete transparency. Others may require stronger privacy guarantees. Others need confidentiality alongside familiar UX, composability, and the ability to meet disclosure requirements.

Confidential Voting adds another option to the Aragon governance stack. By combining Zama’s programmable confidentiality with Aragon’s modular governance architecture, projects have more flexibility to design governance around the requirements of their organization.

Get in touch to explore confidential voting.