How Confiroll works

Private amounts, no gas fees, and self-custody: the three ideas behind Confiroll, and what actually happens on each.

Confiroll rests on three ideas: amounts stay private, nobody pays gas, and you hold your own keys. You do not need to understand the cryptography to use the product, but the detail below shows exactly what happens underneath so you can trust what you are looking at.

1. Amounts stay private

On most blockchains, every payment amount is public forever. Pay a contractor from an ordinary Stellar account and anyone can look up precisely how much they earned, whenever they like.

Confiroll uses a confidential token instead. When you pay someone, the amount is encrypted in your browser before it ever reaches the network. The chain records that a transfer happened and which accounts took part, but the number itself is a ciphertext. Two people can read it: you (the payer) and the contractor (the payee), each with a key that lives only on their own device.

What actually happens: your browser reads the recipient’s public viewing key, encrypts the amount to it, and builds a zero-knowledge proof that the transfer is valid (you have the funds, nothing is created or destroyed) without revealing the figure. The amount is never a visible argument in the transaction. The settlement is public; the value is not.

This is confidentiality, not anonymity. The payment graph, meaning which accounts paid which accounts and when, is public. Confiroll hides amounts, not the existence of a payment, and never describes the graph as unlinkable. See Security and claims for exactly what is public and what is private.

2. No gas fees

Every blockchain action normally costs a small network fee, paid in XLM on Stellar. Left alone, that means a contractor would have to hold XLM just to receive money, an awkward barrier for someone who simply wants to get paid.

With Confiroll, a fee sponsor covers the network fee for you. You sign your payment, and Confiroll wraps it in a fee-bump that pays the cost. You send for 0 XLM, your contractor receives for 0 XLM, and withdrawing costs the contractor 0 XLM as well. Nobody has to top up on gas.

What actually happens: you are the source of your own transaction and you sign it with a plain wallet signature. Confiroll then submits a fee-bump transaction that names the sponsor as the fee account. The sponsor pays the fee; your balance moves by the payout only. Confiroll can pay your fee but cannot alter what you signed.

3. You hold your keys

Confiroll is non-custodial. It never takes possession of your funds, and it never holds the keys that control them.

What actually happens: every actor keeps two keys, and both live on your device. Your balance is decrypted in your browser by reading chain state and applying your viewing key, so Confiroll never sees the number. Because Confiroll holds zero user keys, it cannot move your money and cannot read your amounts. Confiroll calls this being Confiroll-blind: amounts are hidden from the public, from other employers, and from Confiroll itself.

The two keys

Wallet signing key

The Stellar key that authorizes transactions. It stays in your wallet, or in an email-based embedded wallet, and signs every payout and withdrawal.

Confidential viewing key

A separate key that decrypts your own amounts and builds your private proofs. It is derived from your wallet on your device, so it follows you across devices and never gets uploaded.

What’s public and what’s private

Public on-chain	Private to you
That a payment settled	The amount of each individual payout
The accounts involved (payer and payee)	Ongoing confidential balances
The total USDC you deposited into a balance	The mapping of amounts to contractors (your private ledger)
The specific amount a contractor withdraws on exit	Everything held inside the confidential balance until it is withdrawn

Deposits and withdrawals touch regular USDC, so those figures are visible where funds cross in or out. Everything that stays inside the confidential balance keeps its amount hidden.

Frequently asked

Can Confiroll see how much I pay each contractor?

No. Amounts are encrypted on your device and Confiroll holds none of the keys that could decrypt them. Confiroll relays your already-signed transactions and sponsors the fee, and nothing more. That is what being Confiroll-blind means.

If amounts are hidden, how does anyone audit a payment?

The employer holds an escrow key on their own device. To satisfy an audit, you disclose a specific payout: your device decrypts the amount and produces a verifiable proof that the figure matches the on-chain ciphertext. You can prove any amount you choose to, and Confiroll still cannot read it.

Is this anonymous?

No, and Confiroll never claims it is. The payment graph, meaning who paid whom and when, is public. What stays private is the amount. This is confidentiality, not anonymity, and balances are never described as unlinkable.

What happens if I switch devices?

Your viewing key is derived from your wallet, so signing in with the same wallet on a new device reconstructs it locally. Your balance decrypts again from chain state, and nothing needs to be exported from Confiroll because Confiroll never had it.

Want the technical version? See The non-custodial model in the Developers tab. It walks through the two keys, browser-side proving, and the fee-bump in detail.