Open source · worker-first · built to be checked

A union nobody can silence, and nobody has to trust.

Project Ludlow lets coworkers sign union authorization cards that even the server can't read, then run their union with secret ballots, open books and fair case handling that every member can verify for themselves.

View the code on GitHub Try the lock, right here Read the threat model

Two halves

1 · Organize

Sign cards nobody can read

Coworkers sign electronic authorization cards on their own phones. Each card is encrypted in the browser with a key split among a few trusted trustees. One person can start alone and add the committee later. When the committee decides to go public, the browser builds the filing package locally: roster, cards, declaration and draft letters. Nothing is filed or sent for you.

2 · Run

Run it in the open

A workspace with secret-ballot votes, workplace cases with real deadlines, a ledger every member can audit, bylaws that carry out members' decisions by themselves, and petitions that let members force a vote or a recall.

Built so you don't have to trust us

Nobody can read a card early
Cards are encrypted on the signer's phone. The server only ever holds ciphertext, and any tampering is detected.
A lock that is enforced
Set a release number when the campaign starts. The server refuses to hand over the sealed cards until that many people have signed and been confirmed. Lowering the number takes several trustees.
Start with one person
Organizing begins with a conversation, not a committee. Go live the moment you have a key, then lock your early cards to the full committee when it exists.
Votes you can recount
Ballots have no link to voters. After the vote, any member's browser can recount them and check its own receipt.
Books that can't be quietly edited
The ledger and audit log are hash chains that every member's browser verifies. Big spending needs two different officers.
Software you can check
No trackers or third-party code, a strict content policy, and reproducible builds, so anyone can compare the served code with the source.

Try the lock

This runs the same cryptography as the app, on your device. Seal a (fake) card among five trustees, then see what it takes to open it. Nothing you type leaves this page.

The demo loads about 200 KB of cryptography, only when you ask.

Made for phones, in the light or the dark

Real screens from the running app: no mock-ups.

The home page: a navy banner reading Start a union at your workplace, safely, with a gold Start a campaign button — Start a campaign

An authorization card with a double rule, the union's name, the card text and a typed signature — The card a coworker signs

A progress bar with markers at 30, 50 and 70 percent and a gold marker showing where the lock opens — Progress, and where the lock opens

The trustee dashboard showing the committee, invitation links and the lock — Start alone, add the committee

Results of a secret-ballot vote in dark mode, with a button to recount every ballot in the browser — A vote any member can recount

The money page in dark mode, showing the ledger checked in the browser as an unbroken chain — Books checked in your browser

Built for anywhere, and for hard situations

The law lives in data

Thresholds, card wording and document templates are jurisdiction packs, not code. The US (NLRA) and UK (CAC) are in, plus a general pack. Adding a country is adding files.

Any language

English and Spanish today. A language is one file, and right-to-left scripts are supported. Every legal text is marked as a draft for a qualified reviewer.

Made for risk

A quick-exit button, QR invites that leave no message trail, a private record of employer conduct with a filing-deadline clock, neutral tab titles, and no tracking of any kind.

Honest limits

It is unaudited. Nobody independent has reviewed the cryptography or the code yet. That is the first thing we need.
The legal text is draft. Every document carries a warning and open TODO(lawyer) questions. Nothing here is legal advice, and nothing is ever filed or sent for you.
The release lock is enforced by the server, not by mathematics. It stops trustees, but not someone who can read the database, so host it where no trustee controls it.
A founder who starts alone can open early cards alone until the committee is complete. The app says so plainly.
Much of it was written with AI assistance (Claude Code) from written specs, which is exactly why it needs human reviewers.

The full threat model, with everything it does and doesn't protect against →

Join in

This only works if people who care look at it closely. Whatever you know, there is a place for it.

Developers

Small, well-tested Node and vanilla JS. Start with a good first issue.

Security & cryptography

Review the protocols, break the assumptions, and report privately.

Attorneys & organizers

Every file in content/legal is waiting for someone qualified. Real experience beats guesses.

Translators

Add a language, or check the Spanish, in one file. A bilingual reader should check the card text.

Designers & accessibility

Screen readers, contrast, low-end phones, right-to-left layouts.

Everyone else

Tell us what would break in real life in Discussions. Please never share real names or workplaces.

Contributing guide Open issues Discussions

Run it yourself in two minutes

git clone https://github.com/ChrisRyanWill/project-ludlow.git
cd project-ludlow
npm install
npm start        # http://localhost:8787
npm test         # unit, API and real-browser tests

Node 20 or newer. One SQLite file for data, and a Dockerfile if you prefer.