Settings, team, and roles

Organization details, your connected wallet and on-device keys, teammates and approval roles, defaults, and the testnet transparency panel.

Settings is where you manage your organization, your keys, your team, and how payroll behaves by default. It is organized into focused sections you can move between from a single page. Your keys stay on your device throughout: nothing in this screen uploads a secret.

Overview

Organization

Company name, logo, and profile details.

Account and keys

Connected wallet, viewing key status, escrow key, and backup reminders.

Team and roles

Invite teammates as Admin, Approver, or Viewer, with an optional approval workflow.

Defaults

Default currency and pay schedule for new runs.

Network and transparency

A persistent Testnet badge and the on-chain contract addresses.

Notifications

Email preferences for runs, approvals, and account events.

Organization

Set your company name, upload a logo, and fill in the profile details that appear across the app and on generated documents. This is the identity your teammates and contractors see when they sign in.

Account and keys

This section reflects the two keys that make Confiroll non-custodial, plus your connected wallet. Both keys are derived and held on your device. Neither ever leaves it.

Item	What it shows
Connected wallet	The Stellar wallet you signed in with, and its address. This wallet signs your transactions.
Confidential viewing key	The status of the key derived on your device from your wallet. It decrypts your own amounts and builds your private proofs.
Escrow/disclosure key	The status of the key you hold to disclose a payout amount and prove it matches the chain.
Backup reminders	Prompts to back up your keys, with the standing reminder that your keys never leave your device.

Your confidential viewing key is derived from your wallet, so it follows you across devices. Sign in on a new device with the same wallet and the key is re-derived locally. Confiroll never sees it, never stores it, and cannot re-create it for you.

Self-custody means backing up your keys is your responsibility. Confiroll holds zero keys and cannot recover a lost key or a lost wallet for you. Follow the backup reminders here, and keep your wallet recovery method safe. If you lose access to your wallet, you lose the ability to decrypt your amounts and to disclose them.

Team and roles

Invite teammates and assign each a role. Roles scope exactly what a person can do, from full control down to read-only visibility.

Capability	Admin	Approver	Viewer
View activity, contractors, and reports	Yes	Yes	Yes
Add and edit contractors	Yes	Yes	No
Build a payroll run	Yes	Yes	No
Approve a run when approvals are required	Yes	Yes	No
Start a run (submit payouts)	Yes	No	No
Manage organization, keys, and defaults	Yes	No	No
Invite teammates and change roles	Yes	No	No

1. Invite a teammate

   Enter their email and choose a role. They receive an invitation and sign in with their own wallet or email, which creates their own on-device keys.

2. Assign the role

   Pick Admin, Approver, or Viewer based on what they need to do. You can change a role later.

3. Turn on the approval workflow (optional)

   Require that an Approver signs off on a run before it can start. With approvals on, a run moves from Ready to started only after an Approver approves it, adding a second set of eyes before any payout submits.

Each teammate holds their own keys on their own device. Roles govern what actions they can take in the app, and their wallet signature authorizes any transaction they submit. A teammate’s role never gives Confiroll or anyone else access to their keys.

Defaults

Set the defaults that pre-fill new runs so you are not re-entering the same choices each cycle.

Currency

The default currency your amounts and reports are shown in. Payouts settle in test USDC on the Stellar testnet.

Pay schedule

Your default cadence, for example monthly or biweekly, used to label cycles and prompt the next run.

Network and transparency

Confiroll runs on the Stellar testnet, and this section makes that verifiable rather than a claim you have to take on faith.

Testnet badge

A persistent Testnet badge marks the environment. Payouts use test USDC.

Contract addresses

The on-chain contract addresses for the confidential token and the vault, shown in full so anyone can look them up on the block explorer and confirm what the app is talking to.

The vault contract is owned by your organization, not Confiroll. Publishing the token and vault addresses here means a contractor, an auditor, or a teammate can independently verify the contracts your payroll runs against, without asking you or Confiroll to vouch for them.

Notifications

Choose which emails you receive: run completions and failures, approval requests when the approval workflow is on, and account events like a new teammate joining. Set preferences per category so your inbox reflects what you actually want to be told about.

FAQ

How do I invite a teammate?

Open Team and roles, enter their email, and pick a role: Admin, Approver, or Viewer. They accept the invitation and sign in with their own wallet or email, which creates their own on-device keys. You can change their role at any time.

Can I require approvals before a run starts?

Yes. Turn on the approval workflow in Team and roles. With it on, a run sits at Ready until an Approver signs off, and only then can it start and submit payouts. It adds a second set of eyes without giving anyone access to your keys.

What happens if I lose a key?

Confiroll holds zero keys and cannot recover one for you. Your confidential viewing key is derived from your wallet, so as long as you can sign in with the same wallet, it re-derives on your device. If you lose access to the wallet itself, you lose the ability to decrypt and disclose your amounts, which is why the backup reminders in Account and keys matter.

How do I rotate my keys?

Rotation is driven from your wallet, since your keys are derived on your device and never held by Confiroll. Account and keys shows the current status and reminds you to back up before you change anything. Because Confiroll cannot see or store your keys, any rotation happens entirely on your side, under your control.