Security & claims

Exactly what Confiroll does and does not guarantee: testnet only, amounts hidden (not the graph), no mainnet privacy claim, and how to verify it yourself.

Confiroll is deliberately precise about what it claims. This page is the reference for those boundaries. Keep to this language when describing the product.

Testnet only

Confiroll runs on the Stellar testnet with test-only USDC. It is a working developer preview, not a production payroll service. Do not send real funds. There is no fiat off-ramp; withdrawal yields crypto USDC.

What “confidential” means here

Hidden

Per-recipient payout amounts and each account’s ongoing confidential balance are encrypted on-chain, readable only by the payer, the payee, and the escrow-key holder.

Public

The transaction graph (who paid whom, and when), the total you deposit, and the amount you withdraw. These are visible on-chain by design.

Say “amounts hidden on-chain (testnet).” Never say:

• “unlinkable” or “anonymous”: the payment graph is public. This is confidentiality, not anonymity.
• “private on mainnet” or any mainnet privacy guarantee. See below.
• that totals are hidden: the deposited aggregate and withdrawn amounts are public.

Claims discipline checklist

Use this side-by-side when writing about the product. The left column is accurate; the right column is off-limits.

Do say	Do not say
”amounts hidden on-chain (testnet)"	"unlinkable” or “anonymous”
the per-recipient split and ongoing balances are hidden	that totals or withdrawn amounts are hidden
the deposited total and the withdrawn amount are public	that the transaction graph is private
confidentiality on testnet	mainnet or production privacy
fees are sponsored, 0 XLM for you, Confiroll holds zero user keys	that Confiroll can move or read your funds

No mainnet privacy claim

Mainnet amount-hiding is gated on a third-party audit of the underlying confidential token. The OpenZeppelin and Nethermind audit of the confidential token must complete first. Until then, Confiroll makes no mainnet privacy claim. Do not describe the confidential features as production- or mainnet-ready.

What Confiroll can and cannot do

Because Confiroll holds zero user keys, the boundary is sharp. It cannot touch your funds or read your amounts, and it cannot recover a lost key. It can only pay fees and serve public data.

Action	Confiroll
Move your funds	Cannot. You sign every payment; the sponsor only pays the fee and never holds your key.
Read your amounts	Cannot. Your device derives and uses the viewing key that decrypts them; it never leaves your device.
Recover a lost key	Cannot. Self-custody means backing up your keys is your responsibility.
Fee-bump a transaction you signed	Can. The sponsor wraps your signed inner transaction in a CAP-15 fee-bump.
Serve public directory data	Can. The recipient directory exposes public data only.
Sponsor the network fee	Can. Every action is 0 XLM for you.

Non-custodial guarantees

The security model rests on Confiroll holding zero user keys:

• Confiroll cannot move your funds: you sign every payment; the sponsor only pays the fee and never holds your key.
• Confiroll cannot read your amounts: your device derives and uses the viewing key that decrypts them, and it never leaves your device.
• The escrow/disclosure key is employer-held, so compliance disclosures work without Confiroll ever being able to read a payout.

This has a trade-off: because Confiroll holds no keys, it cannot recover a lost key for you. Self-custody means backing up your keys is your responsibility. Read the full model in Non-custodial model.

Sponsor safety

The fee-bump sponsor is a guard-railed relay, not an open one: a contract allow-list, a per-transaction fee cap, a per-account quota, and key separation (the hot signing key holds no other authority) bound its exposure. The API additionally binds a fee-bump to the requester’s own account. Details in Fee sponsorship.

How to verify it yourself

You do not have to take these claims on trust. Every settled payout is on the public testnet ledger, and every contract address is published. Check them directly.

1. Open stellar.expert on the testnet network

   Go to the Stellar network explorer and switch it to testnet. Everything Confiroll settles is visible there.

2. Look up a settled payout transaction

   Open a confidential_transfer transaction by its hash. You see the from and to accounts, the timestamp, and that the fee was paid by the sponsor account, and you see that there is no amount argument on the operation. The amount lives inside the proof and the encrypted event fields, not on the transaction.

3. Look up the contract addresses

   Pull the confidential token and Soroban contract addresses from Contracts and search each one on stellar.expert testnet. The contracts are immutable and store zero secrets; the ledger confirms what they hold.

Testnet capabilities

These capabilities run on Stellar testnet today:

Capability	How it works on testnet
Sign-in (SEP-10 wallet + Privy email)	Each path issues a session JWT from payroll-api.
Fork B POST /transfer	Fee-bumps a browser-signed confidential transfer, proven end to end on testnet.
Confidential token operations	register, deposit, transfer, merge, and withdraw run on testnet via the apps/payroll/client scripts.
POST /withdraw and POST /auditor/disclose	Both API routes return 501; those operations run in the client tooling.
Batch runs (POST /batch)	Run a confidential batch through the SDP relay.

When in doubt, describe a capability as shown here, and always with the testnet qualifier.

FAQ

If amounts are hidden, why can I still see the payout on-chain?

Because Confiroll gives you confidentiality, not anonymity. The transaction graph (who paid whom, and when) and settlement are public, and so are the total you deposit and the amount you withdraw. What stays hidden is the per-recipient split and each account’s ongoing balance. A viewer sees that a transfer happened, but not the amount.

Can Confiroll read my payout amounts if compelled?

No. Confiroll holds zero user keys, and the viewing key that decrypts amounts is derived and used on your device. Compliance disclosure uses an employer-held escrow key, and that disclosure is a client-side read-and-decrypt: it signs nothing and submits no transaction. Confiroll itself never has the key material to read a payout.

Is any of this safe to use on mainnet?

Not for privacy. Confiroll runs on Stellar testnet with test-only USDC. Mainnet amount-hiding is gated on the OpenZeppelin and Nethermind audit of the confidential token, which must complete first. Do not describe the confidential features as production- or mainnet-ready, and never make a mainnet privacy claim.