Security at Electra Labs

Political and public data is sensitive by nature. This page explains how we protect it and how to tell us if something is wrong.

How we protect data

• Encryption. Data is encrypted in transit and at rest.
• Separation. Each client works in its own environment. Data is never pooled or shared between clients.
• Least access. Staff get only the access their role needs. Every access is logged and reviewed.
• Human approval. A person signs off every outbound message and every field payment.
• Minimal collection. We hold only the data an engagement needs, for as long as it needs it.

Where data is kept

We follow the data-protection and electoral law that applies in each country we work in, including rules on where personal data must be stored. Where the law requires data to stay in a country, it does.

This website

This site is static. It sets no cookies, runs no analytics and loads nothing from other companies. It is served over HTTPS with a strict content security policy. The only data it collects is what you type into the briefing form (see the privacy notice).

Report a vulnerability

If you find a weakness in this website or in how we handle data, please tell us through the briefing form and start your message with the word Security. Include what you found, where, and the steps to reproduce it. Our contact details are also published in security.txt.

What we ask: do not access or change other people's data, do not disrupt the service, and give us reasonable time to fix the issue before you share it.

What you can expect: we will acknowledge your report, keep you informed, and not pursue researchers who act in good faith.

Out of scope

Social engineering of our staff, physical attacks, and automated scanning that degrades the service.

Last updated 16 October 2026.