> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Answers on privacy, fees, sign-in, funding, payroll, withdrawals, and the network Confiroll runs on.

Everything you need to know about how Confiroll keeps payout amounts private, why you never pay a network fee, and how employers and contractors move money. The questions are grouped by theme, so jump to the section that matches what you are trying to do.

<CardGroup cols={3}>
  <Card title="Privacy and security" icon="eye-slash" href="#privacy-and-security">
    What is hidden, what is public, and who holds the keys.
  </Card>

  <Card title="Fees and money" icon="gas-pump" href="#fees-and-money">
    Why every action costs you 0 XLM and what you pay with.
  </Card>

  <Card title="Getting started" icon="user-plus" href="#getting-started-and-getting-paid">
    Signing in, wallets, and getting ready to be paid.
  </Card>

  <Card title="Employers" icon="building" href="#for-employers">
    Adding contractors, funding, and running payroll.
  </Card>

  <Card title="Withdrawals" icon="download" href="#withdrawals">
    Cashing out your confidential balance to USDC.
  </Card>

  <Card title="Network" icon="hashtag" href="#network">
    The chain Confiroll settles on and what the money is.
  </Card>
</CardGroup>

## Privacy and security

<AccordionGroup>
  <Accordion title="Is my pay really private?" icon="eye-slash">
    Yes. Every payout amount is encrypted on-chain using a confidential token, so the number is
    not a visible argument in the transaction and does not appear on the block explorer. Only
    you, with your viewing key, can decrypt your own amounts. This is confidentiality of the
    amount, not anonymity of the payment: the settlement is public, and the amount is hidden.
    Confiroll never describes payments as unlinkable.
  </Accordion>

  <Accordion title="What does 'Confiroll-blind' mean?" icon="lock">
    Confiroll holds zero of your keys, so it has no way to read your amounts or move your funds.
    Payout amounts are hidden from the public, from other employers, and from Confiroll itself.
    The keys that could reveal an amount live only on your device. Confiroll builds the app,
    sponsors the network fee, and relays your already-signed transactions, and that is the full
    extent of what it can do.
  </Accordion>

  <Accordion title="Can someone see the amount on the block explorer?" icon="table">
    No. When you open a Confiroll payout on a public explorer, you see that the transaction
    settled, which accounts were involved, and the timestamp. You do not see a dollar figure,
    because the amount is carried as ciphertext and validated by a zero-knowledge proof rather
    than posted in the clear. The proof lets the network confirm the transfer is valid without
    ever learning the value.
  </Accordion>

  <Accordion title="What is public and what is hidden?" icon="eye">
    Public: that a payment happened, the accounts involved, the time it settled, and which
    account paid the fee. Hidden: the amount of every payout, your confidential balance, and the
    contractor-to-amount mapping in an employer's private ledger. The public transaction graph
    proves that money moved. Your amounts stay yours.
  </Accordion>

  <Accordion title="Can I still pass an audit if amounts are hidden?" icon="shield-check">
    Yes, and you stay in control of the process. As an employer you hold the escrow key (also
    called the disclosure key) on your own device. To satisfy an audit, pick a payout and
    disclose it: your device decrypts the amount with the escrow key and produces a verifiable
    disclosure that proves the amount matches the ciphertext recorded on-chain. Export it for an
    auditor. Confiroll cannot read the amount, and you can prove it. See
    [Compliance and disclosure](/guide/employer/compliance).
  </Accordion>

  <Accordion title="What are the two keys?" icon="key">
    Everyone has two keys, both generated and stored on your device and never uploaded. The
    first is your wallet signing key, which authorizes transactions. The second is your
    confidential viewing key, which decrypts your own amounts and builds the private proofs
    behind every confidential transfer. The viewing key is derived from your wallet, so it
    follows you when you sign in on another device.
  </Accordion>

  <Accordion title="What if I lose my key?" icon="rotate">
    Because Confiroll is non-custodial, it cannot recover a key it never held. Your viewing key
    is derived from your wallet, so keeping your wallet safe and backed up keeps your access
    intact. Follow the backup reminders in Settings under account and keys, and store your wallet
    recovery phrase somewhere durable. This is the trade-off for Confiroll never being able to
    touch your funds or read your amounts.
  </Accordion>

  <Accordion title="Does Confiroll hold my money?" icon="wallet">
    No. Confiroll is non-custodial. Your funds sit in accounts that only you control, and every
    payment is signed by you as the transaction source. Confiroll relays your signed transaction
    and pays the network fee for it. It never takes possession of funds or keys. For the full
    model, see [The non-custodial model](/developers/non-custodial-model).
  </Accordion>
</AccordionGroup>

## Fees and money

<AccordionGroup>
  <Accordion title="Do I need to hold XLM for fees?" icon="gas-pump">
    No. You never hold XLM to use Confiroll. Every on-chain action, paying, receiving,
    registering, depositing, merging, and withdrawing, is fee-sponsored. Your account balance in
    XLM stays flat at zero cost to you.
  </Accordion>

  <Accordion title="Who pays the network fee?" icon="hand-holding-dollar">
    Confiroll's fee sponsor does. You sign your transaction as the source account, and Confiroll
    wraps it in a fee-bump so a sponsor account covers the network fee. The result on-chain shows
    the sponsor as the fee account and your balance unchanged in XLM. The sponsor can pay a fee
    but can never alter or redirect your transaction. See
    [Fee sponsorship](/developers/fee-sponsorship).
  </Accordion>

  <Accordion title="What currency do payouts use?" icon="coins">
    Payouts are denominated in USDC, moved as a confidential token so the amount stays encrypted
    on-chain. On the network Confiroll runs on, this is test USDC. Balances, payouts, and
    withdrawals are all expressed in USDC in the interface.
  </Accordion>

  <Accordion title="Is there a fee to use Confiroll?" icon="receipt">
    There is no network fee for you, because every action is sponsored to 0 XLM. Anchoring a
    payslip cycle costs the same whether you pay 3 people or 300, because one Merkle root covers
    the whole cycle. You move value in USDC and the plumbing is covered.
  </Accordion>

  <Accordion title="What is test USDC?" icon="money-bill-transfer">
    Test USDC is the USDC asset on the Stellar testnet. It behaves exactly like production USDC
    inside Confiroll: you fund with it, pay with it, and withdraw it. You bring test USDC in with
    a single click from the built-in faucet, by bridging from another testnet chain, or by
    depositing existing testnet USDC you already hold. See [Funding](/guide/employer/funding).
  </Accordion>
</AccordionGroup>

## Getting started and getting paid

<AccordionGroup>
  <Accordion title="How do I sign in?" icon="signature">
    There is one sign-in for everyone. Connect a Stellar wallet and sign a one-time challenge
    (the SEP-10 standard), or sign in with email, in which case an embedded wallet is created for
    you. Confiroll then reads your data to determine your role, employer, contractor, or both,
    and routes you to the right place. A short-lived session keeps you signed in. See
    [Getting started](/guide/getting-started).
  </Accordion>

  <Accordion title="Do I need a crypto wallet?" icon="wallet">
    Not to start. If you sign in with email, an embedded wallet is created for you on the spot,
    so you get the two keys without installing anything. If you prefer to bring your own wallet,
    connect it and sign the challenge. Either path gives you a wallet signing key and a
    confidential viewing key on your device.
  </Accordion>

  <Accordion title="Why does a contractor register before the first payout?" icon="user-plus">
    A confidential payout is encrypted to the recipient's public viewing key, and that key only
    exists on-chain after a contractor connects a wallet and self-registers once. Until a
    contractor registers, there is no key to encrypt an amount to, so they show as Invited or
    Onboarding rather than Ready. Registration is a single fee-sponsored step. See
    [Contractor onboarding](/guide/contractor/onboarding).
  </Accordion>

  <Accordion title="How long does onboarding take?" icon="clock-rotate-left">
    A few minutes. Sign in, connect or create a wallet, and self-register your confidential
    account. Registration is fee-sponsored, so you need nothing in XLM. Once your status reaches
    Ready, you can receive payouts and see your confidential balance decrypt in your browser.
  </Accordion>

  <Accordion title="Can I be both an employer and a contractor?" icon="users">
    Yes. Roles come from your data, not from separate accounts. If you run payroll for a team and
    also receive payouts yourself, Confiroll gives you access to both the employer app and the
    contractor portal from the same sign-in, and you switch between them freely.
  </Accordion>
</AccordionGroup>

## For employers

<AccordionGroup>
  <Accordion title="How do I add contractors?" icon="users-gear">
    Open Contractors and invite a person by wallet address or email. They start as Invited, move
    to Onboarding while they connect a wallet and self-register, and become Ready once their
    confidential account exists on-chain. Only Ready contractors are payable, so a payroll run
    always encrypts to a live viewing key. See [Contractors](/guide/employer/contractors).
  </Accordion>

  <Accordion title="How do I fund my balance?" icon="coins">
    Funding brings USDC into your confidential balance three ways. Use the built-in test-USDC
    faucet to mint and deposit in one click, bridge USDC from another testnet chain through the
    CCTP flow (burn, wait for the Circle attestation, mint into your vault, deposit), or deposit
    existing classic USDC you already hold by adding a trustline and depositing. The CCTP vault
    is owned by you, not Confiroll, and depositing and merging are fee-sponsored. See
    [Funding](/guide/employer/funding).
  </Accordion>

  <Accordion title="Why does a payroll run ask me to approve every payout?" icon="signature">
    Each payout is a confidential transfer that you sign as the transaction source. Your browser
    encrypts the amount and builds a zero-knowledge proof, and you provide a plain wallet
    signature. That is what keeps the flow non-custodial and lets Confiroll sponsor the fee
    without ever holding your key. A run of 12 payouts is 12 quick approvals, and the run screen
    walks you through them row by row with a live status for each. See
    [Run payroll](/guide/employer/run-payroll).
  </Accordion>

  <Accordion title="Where do the amounts in my history come from?" icon="clock-rotate-left">
    From your private ledger. Because amounts are hidden on-chain and Confiroll is blind, the
    mapping of who was paid how much is kept encrypted on your side. On-chain confirms that a
    payout settled; your ledger holds what the amount was. History reads both together, so you
    see the settled transaction and the amount that only you can decrypt. See
    [History](/guide/employer/history).
  </Accordion>

  <Accordion title="Can my team help run payroll?" icon="users">
    Yes. In Settings under team and roles you assign Admin, Approver, and Viewer roles and turn
    on an optional payroll approval workflow. An Approver reviews a run before payouts are signed,
    a Viewer sees reporting without the ability to change anything, and an Admin manages the
    organization. Signing still happens with each signer's own wallet. See
    [Settings](/guide/employer/settings).
  </Accordion>
</AccordionGroup>

## Withdrawals

<AccordionGroup>
  <Accordion title="How do I withdraw?" icon="download">
    Open Withdraw in the contractor portal and enter an amount. Your device merges any receiving
    funds into your spendable balance, builds a withdrawal proof, and asks for your signature.
    Confiroll fee-bumps the transaction so you pay 0 XLM, and the USDC lands in your regular
    balance. See [Withdraw](/guide/contractor/withdraw).
  </Accordion>

  <Accordion title="What happens to my remaining balance when I withdraw?" icon="eye-slash">
    The specific amount you withdraw becomes public on exit, so the USDC that leaves is
    verifiable. Everything you leave behind stays confidential: your remaining balance is still
    encrypted and readable only with your viewing key. Withdrawing part of your balance never
    reveals the rest.
  </Accordion>

  <Accordion title="Can I cash out to a bank?" icon="money-bill-transfer">
    You receive crypto USDC. There is no in-app fiat off-ramp, so Confiroll does not convert to a
    bank account for you. Once the USDC is in your regular balance you are free to move it wherever
    you like, including to an external service that converts to fiat.
  </Accordion>
</AccordionGroup>

## Network

<AccordionGroup>
  <Accordion title="What network does Confiroll run on?" icon="hashtag">
    Confiroll runs on the Stellar testnet and settles every payout there. Settlement is public on
    the Stellar network while amounts stay encrypted, and the on-chain contract addresses are
    listed in Settings under network and transparency so anyone can verify the deployment. See
    [Contracts and addresses](/developers/contracts).
  </Accordion>

  <Accordion title="Is this real money?" icon="coins">
    Payouts use test USDC on the Stellar testnet. It moves, funds, pays, and withdraws exactly
    like production USDC inside Confiroll, and every confidential feature, encrypted amounts,
    zero-knowledge proofs, sponsored fees, payslip anchoring, and disclosure, works end to end.
    For how Confiroll frames its privacy properties precisely, see
    [Security and claims](/developers/security-and-claims).
  </Accordion>
</AccordionGroup>

<Note>
  Confiroll protects the amount, not the fact of a payment. The transaction graph, who paid whom
  and when, is public by design; the amount is hidden. That is confidentiality, not anonymity.
</Note>