> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & claims

> Exactly what Confiroll does and does not guarantee: testnet only, amounts hidden (not the graph), no mainnet privacy claim, and how to verify it yourself.

Confiroll is deliberately precise about what it claims. This page is the reference for those
boundaries. Keep to this language when describing the product.

## Testnet only

<Warning>
  Confiroll runs on the Stellar **testnet** with test-only USDC. It is a working developer
  preview, **not** a production payroll service. Do not send real funds. There is no fiat
  off-ramp; withdrawal yields crypto USDC.
</Warning>

## What "confidential" means here

<CardGroup cols={2}>
  <Card title="Hidden" icon="eye-slash">
    Per-recipient **payout amounts** and each account's ongoing confidential **balance** are
    encrypted on-chain, readable only by the payer, the payee, and the escrow-key holder.
  </Card>

  <Card title="Public" icon="eye">
    The **transaction graph** (who paid whom, and when), the **total you deposit**, and the
    **amount you withdraw**. These are visible on-chain by design.
  </Card>
</CardGroup>

Say **"amounts hidden on-chain (testnet)."** Never say:

* **"unlinkable"** or **"anonymous"**: the payment graph is public. This is
  *confidentiality, not anonymity.*
* **"private on mainnet"** or any mainnet privacy guarantee. See below.
* that **totals** are hidden: the deposited aggregate and withdrawn amounts are public.

### Claims discipline checklist

Use this side-by-side when writing about the product. The left column is accurate; the right
column is off-limits.

| Do say                                                            | Do not say                                  |
| ----------------------------------------------------------------- | ------------------------------------------- |
| "amounts hidden on-chain (testnet)"                               | "unlinkable" or "anonymous"                 |
| the per-recipient split and ongoing balances are hidden           | that totals or withdrawn amounts are hidden |
| the deposited total and the withdrawn amount are public           | that the transaction graph is private       |
| confidentiality on testnet                                        | mainnet or production privacy               |
| fees are sponsored, 0 XLM for you, Confiroll holds zero user keys | that Confiroll can move or read your funds  |

## No mainnet privacy claim

<Warning>
  Mainnet amount-hiding is **gated on a third-party audit** of the underlying confidential token.
  The OpenZeppelin and Nethermind audit of the confidential token must complete first. Until then,
  Confiroll makes **no** mainnet privacy claim. Do not describe the confidential features as
  production- or mainnet-ready.
</Warning>

## What Confiroll can and cannot do

Because Confiroll holds **zero user keys**, the boundary is sharp. It cannot touch your funds or
read your amounts, and it cannot recover a lost key. It can only pay fees and serve public data.

| Action                            | Confiroll                                                                                                 |
| --------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Move your funds                   | **Cannot.** You sign every payment; the sponsor only pays the fee and never holds your key.               |
| Read your amounts                 | **Cannot.** Your device derives and uses the viewing key that decrypts them; it never leaves your device. |
| Recover a lost key                | **Cannot.** Self-custody means backing up your keys is your responsibility.                               |
| Fee-bump a transaction you signed | **Can.** The sponsor wraps your signed inner transaction in a CAP-15 fee-bump.                            |
| Serve public directory data       | **Can.** The recipient directory exposes public data only.                                                |
| Sponsor the network fee           | **Can.** Every action is 0 XLM for you.                                                                   |

## Non-custodial guarantees

The security model rests on Confiroll holding **zero user keys**:

* Confiroll **cannot move your funds**: you sign every payment; the sponsor only pays
  the fee and never holds your key.
* Confiroll **cannot read your amounts**: your device derives and uses the viewing key that
  decrypts them, and it never leaves your device.
* The **escrow/disclosure key is employer-held**, so compliance disclosures work without
  Confiroll ever being able to read a payout.

This has a trade-off: because Confiroll holds no keys, it **cannot recover a lost key** for
you. Self-custody means backing up your keys is your responsibility. Read the full model in
[Non-custodial model](/developers/non-custodial-model).

## Sponsor safety

The fee-bump sponsor is a guard-railed relay, not an open one: a contract **allow-list**, a
per-transaction **fee cap**, a per-account **quota**, and **key separation** (the hot signing
key holds no other authority) bound its exposure. The API additionally binds a fee-bump to the
requester's own account. Details in [Fee sponsorship](/developers/fee-sponsorship).

## How to verify it yourself

You do not have to take these claims on trust. Every settled payout is on the public testnet
ledger, and every contract address is published. Check them directly.

<Steps>
  <Step title="Open stellar.expert on the testnet network">
    Go to the Stellar network explorer and switch it to **testnet**. Everything Confiroll
    settles is visible there.
  </Step>

  <Step title="Look up a settled payout transaction">
    Open a `confidential_transfer` transaction by its hash. You see the `from` and `to`
    accounts, the timestamp, and that the fee was paid by the sponsor account, and you see
    that there is **no amount argument** on the operation. The amount lives inside the proof
    and the encrypted event fields, not on the transaction.
  </Step>

  <Step title="Look up the contract addresses">
    Pull the confidential token and Soroban contract addresses from
    [Contracts](/developers/contracts) and search each one on stellar.expert testnet. The
    contracts are immutable and store zero secrets; the ledger confirms what they hold.
  </Step>
</Steps>

## Testnet capabilities

These capabilities run on Stellar testnet today:

| Capability                                    | How it works on testnet                                                                                          |
| --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Sign-in (SEP-10 wallet + Privy email)         | Each path issues a session JWT from `payroll-api`.                                                               |
| Fork B `POST /transfer`                       | Fee-bumps a browser-signed confidential transfer, proven end to end on testnet.                                  |
| Confidential token operations                 | `register`, `deposit`, `transfer`, `merge`, and `withdraw` run on testnet via the `apps/payroll/client` scripts. |
| `POST /withdraw` and `POST /auditor/disclose` | Both API routes return `501`; those operations run in the client tooling.                                        |
| Batch runs (`POST /batch`)                    | Run a confidential batch through the SDP relay.                                                                  |

When in doubt, describe a capability as shown here, and always with the testnet qualifier.

## FAQ

<AccordionGroup>
  <Accordion title="If amounts are hidden, why can I still see the payout on-chain?">
    Because Confiroll gives you **confidentiality, not anonymity**. The transaction graph (who
    paid whom, and when) and settlement are public, and so are the total you deposit and the
    amount you withdraw. What stays hidden is the **per-recipient split** and each account's
    ongoing balance. A viewer sees that a transfer happened, but not the amount.
  </Accordion>

  <Accordion title="Can Confiroll read my payout amounts if compelled?">
    No. Confiroll holds zero user keys, and the viewing key that decrypts amounts is derived and
    used on your device. Compliance disclosure uses an **employer-held** escrow key, and that
    disclosure is a client-side read-and-decrypt: it signs nothing and submits no transaction.
    Confiroll itself never has the key material to read a payout.
  </Accordion>

  <Accordion title="Is any of this safe to use on mainnet?">
    Not for privacy. Confiroll runs on Stellar **testnet** with test-only USDC. Mainnet
    amount-hiding is gated on the OpenZeppelin and Nethermind audit of the confidential token,
    which must complete first. Do not describe the confidential features as production- or
    mainnet-ready, and never make a mainnet privacy claim.
  </Accordion>
</AccordionGroup>