Privacy and keys
A payout amount that is encrypted on-chain. The network records that a payment settled and
which accounts were involved, while the amount itself is carried as ciphertext and readable
only with the right viewing key.
The token Confiroll pays with. It represents USDC but keeps balances and transfer amounts
encrypted, using OpenZeppelin’s Confidential Token design. You fund it, pay with it, and
withdraw from it just like a normal balance.
The property that Confiroll holds none of your keys and therefore cannot read your amounts or
move your funds. Amounts are hidden from the public, from other employers, and from Confiroll
itself.
Your private key for reading. It decrypts your own balances and amounts and helps build the
private proofs behind each confidential transfer. It is derived from your wallet on your
device and is never uploaded.
The Stellar signing key in your wallet that authorizes transactions. You sign every payout and
withdrawal with it, and it never leaves your device.
A key the employer holds on their own device that can reveal a specific payout’s amount for a
compliance disclosure. It lets you prove an amount to an auditor even though Confiroll cannot
read it.
A model in which you keep sole control of your keys and funds. Confiroll never takes possession
of your money or your keys; it relays transactions you have signed and sponsors the fee.
Money and balances
The confidential balance you can act on right now, decrypted in your browser with your viewing
key. It reflects funds that are merged and ready to send or withdraw.
Incoming funds that have arrived but are not yet merged into your spendable balance. The
interface shows these as pending until you merge them.
Confidential funds that are merged and ready to send in a payout or move out in a withdrawal.
Receiving funds become spendable once merged.
Moving USDC into your confidential balance so it is ready to pay with. Deposits are
fee-sponsored, so they cost you 0 XLM.
The step that moves newly received funds from your receiving balance into your spendable
balance. Merging is fee-sponsored and often happens automatically as part of a payout or
withdrawal.
Moving your confidential balance back out to regular USDC. The specific amount you withdraw
becomes public on exit so the USDC is verifiable, while your remaining balance stays
confidential. You receive crypto USDC, as there is no in-app fiat off-ramp.
The employer’s encrypted record of which contractor was paid how much. Because amounts are
hidden on-chain and Confiroll is blind, this mapping lives on the employer’s side. On-chain
confirms that a payout settled; the private ledger holds what the amount was.
Payments and proofs
A payout in which your browser encrypts the amount and builds a zero-knowledge proof, you sign
as the transaction source with a plain wallet signature, and Confiroll fee-bumps it. The amount
is hidden on-chain and the settlement is public.
A cryptographic proof that a transfer is valid, for example that balances stay non-negative,
without revealing the amount. It is what lets the network accept a confidential payout while the
value stays encrypted.
The account that pays the network fee on your behalf so you spend 0 XLM. It covers the cost of
your signed transaction without ever needing your key, and it can pay a fee but cannot alter
your transaction.
A Stellar mechanism (CAP-15) in which one account pays the fee for another account’s
transaction. It is how Confiroll makes every action gas-free for you while you remain the
source of your own payment.
The one-time, fee-sponsored on-chain setup that gives an account a confidential viewing key
on-chain so it can receive confidential balances. Contractors register before their first
payout, because a payout is encrypted to their public viewing key.
The contractor status that means a confidential account exists on-chain and can receive
payouts. The full set of statuses is Invited, Onboarding, Ready, and Inactive, and only Ready
contractors are payable.
An on-chain fingerprint of a cycle’s encrypted payslips, stored as a single Merkle root per
cycle. Only the hash goes on-chain, never the contents or amounts, so a contractor can verify a
payslip is unaltered. Anchoring costs the same whether you pay 3 people or 300.
A verifiable reveal of a chosen payout’s amount, produced on the employer’s device with the
escrow key. It proves the amount matches the ciphertext recorded on-chain and can be exported
for an auditor. Confiroll cannot read it; you can prove it.
Network and standards
The dollar-denominated asset Confiroll moves value in. On the network Confiroll runs on, this
is test USDC on the Stellar testnet, which behaves like production USDC inside the app.
Circle’s Cross-Chain Transfer Protocol, used to bring USDC from another chain into Confiroll.
You burn on the source chain, wait for the Circle attestation, mint into your own on-chain
vault, and deposit into your confidential balance. The vault is owned by the employer, not
Confiroll.
The Stellar standard for signing in with a wallet. Confiroll uses it to log you in by having
your wallet sign a one-time challenge, which starts your short-lived session.
The Stellar test network. Confiroll runs on the Stellar testnet, where payouts use test USDC
and every confidential feature works end to end.
The public blockchain Confiroll settles on. Stellar records that a payment happened while the
confidential token keeps the amount encrypted, so settlement is public and the amount is hidden.
The network cost to submit a transaction on Stellar. With Confiroll every action is fee-bumped
by a sponsor, so your cost is always 0 XLM.