Skip to main content
Confiroll is deliberately precise about what it claims. This page is the reference for those boundaries. Keep to this language when describing the product.

​
Testnet only

Confiroll runs on the Stellar testnet with test-only USDC. It is a working developer preview, not a production payroll service. Do not send real funds. There is no fiat off-ramp; withdrawal yields crypto USDC.

​
What “confidential” means here

Hidden

Per-recipient payout amounts and each account’s ongoing confidential balance are encrypted on-chain, readable only by the payer, the payee, and the escrow-key holder.

Public

The transaction graph (who paid whom, and when), the total you deposit, and the amount you withdraw. These are visible on-chain by design.
Say “amounts hidden on-chain (testnet).” Never say:
  • “unlinkable” or “anonymous”: the payment graph is public. This is confidentiality, not anonymity.
  • “private on mainnet” or any mainnet privacy guarantee. See below.
  • that totals are hidden: the deposited aggregate and withdrawn amounts are public.

​
Claims discipline checklist

Use this side-by-side when writing about the product. The left column is accurate; the right column is off-limits.

​
No mainnet privacy claim

Mainnet amount-hiding is gated on a third-party audit of the underlying confidential token. The OpenZeppelin and Nethermind audit of the confidential token must complete first. Until then, Confiroll makes no mainnet privacy claim. Do not describe the confidential features as production- or mainnet-ready.

​
What Confiroll can and cannot do

Because Confiroll holds zero user keys, the boundary is sharp. It cannot touch your funds or read your amounts, and it cannot recover a lost key. It can only pay fees and serve public data.

​
Non-custodial guarantees

The security model rests on Confiroll holding zero user keys:
  • Confiroll cannot move your funds: you sign every payment; the sponsor only pays the fee and never holds your key.
  • Confiroll cannot read your amounts: your device derives and uses the viewing key that decrypts them, and it never leaves your device.
  • The escrow/disclosure key is employer-held, so compliance disclosures work without Confiroll ever being able to read a payout.
This has a trade-off: because Confiroll holds no keys, it cannot recover a lost key for you. Self-custody means backing up your keys is your responsibility. Read the full model in Non-custodial model. The fee-bump sponsor is a guard-railed relay, not an open one: a contract allow-list, a per-transaction fee cap, a per-account quota, and key separation (the hot signing key holds no other authority) bound its exposure. The API additionally binds a fee-bump to the requester’s own account. Details in Fee sponsorship.

​
How to verify it yourself

You do not have to take these claims on trust. Every settled payout is on the public testnet ledger, and every contract address is published. Check them directly.
1

Open stellar.expert on the testnet network

Go to the Stellar network explorer and switch it to testnet. Everything Confiroll settles is visible there.
2

Look up a settled payout transaction

Open a confidential_transfer transaction by its hash. You see the from and to accounts, the timestamp, and that the fee was paid by the sponsor account, and you see that there is no amount argument on the operation. The amount lives inside the proof and the encrypted event fields, not on the transaction.
3

Look up the contract addresses

Pull the confidential token and Soroban contract addresses from Contracts and search each one on stellar.expert testnet. The contracts are immutable and store zero secrets; the ledger confirms what they hold.

​
Testnet capabilities

These capabilities run on Stellar testnet today: When in doubt, describe a capability as shown here, and always with the testnet qualifier.

​
FAQ

Because Confiroll gives you confidentiality, not anonymity. The transaction graph (who paid whom, and when) and settlement are public, and so are the total you deposit and the amount you withdraw. What stays hidden is the per-recipient split and each account’s ongoing balance. A viewer sees that a transfer happened, but not the amount.
No. Confiroll holds zero user keys, and the viewing key that decrypts amounts is derived and used on your device. Compliance disclosure uses an employer-held escrow key, and that disclosure is a client-side read-and-decrypt: it signs nothing and submits no transaction. Confiroll itself never has the key material to read a payout.
Not for privacy. Confiroll runs on Stellar testnet with test-only USDC. Mainnet amount-hiding is gated on the OpenZeppelin and Nethermind audit of the confidential token, which must complete first. Do not describe the confidential features as production- or mainnet-ready, and never make a mainnet privacy claim.