> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Confiroll works

> Private amounts, no gas fees, and self-custody: the three ideas behind Confiroll, and what actually happens on each.

Confiroll rests on three ideas: amounts stay private, nobody pays gas, and you hold your own
keys. You do not need to understand the cryptography to use the product, but the detail below
shows exactly what happens underneath so you can trust what you are looking at.

## 1. Amounts stay private

On most blockchains, every payment amount is public forever. Pay a contractor from an
ordinary Stellar account and anyone can look up precisely how much they earned, whenever they
like.

Confiroll uses a confidential token instead. When you pay someone, the amount is encrypted in
your browser before it ever reaches the network. The chain records that a transfer happened
and which accounts took part, but the number itself is a ciphertext. Two people can read it:
you (the payer) and the contractor (the payee), each with a key that lives only on their own
device.

**What actually happens:** your browser reads the recipient's public viewing key, encrypts
the amount to it, and builds a zero-knowledge proof that the transfer is valid (you have the
funds, nothing is created or destroyed) without revealing the figure. The amount is never a
visible argument in the transaction. The settlement is public; the value is not.

<Info>
  This is confidentiality, not anonymity. The payment graph, meaning which accounts paid which
  accounts and when, is public. Confiroll hides amounts, not the existence of a payment, and
  never describes the graph as unlinkable. See
  [Security and claims](/developers/security-and-claims) for exactly what is public and what is
  private.
</Info>

## 2. No gas fees

Every blockchain action normally costs a small network fee, paid in XLM on Stellar. Left
alone, that means a contractor would have to hold XLM just to receive money, an awkward
barrier for someone who simply wants to get paid.

With Confiroll, a fee sponsor covers the network fee for you. You sign your payment, and
Confiroll wraps it in a fee-bump that pays the cost. You send for 0 XLM, your contractor
receives for 0 XLM, and withdrawing costs the contractor 0 XLM as well. Nobody has to top up
on gas.

**What actually happens:** you are the source of your own transaction and you sign it with a
plain wallet signature. Confiroll then submits a fee-bump transaction that names the sponsor
as the fee account. The sponsor pays the fee; your balance moves by the payout only. Confiroll
can pay your fee but cannot alter what you signed.

## 3. You hold your keys

Confiroll is non-custodial. It never takes possession of your funds, and it never holds the
keys that control them.

**What actually happens:** every actor keeps two keys, and both live on your device. Your
balance is decrypted in your browser by reading chain state and applying your viewing key, so
Confiroll never sees the number. Because Confiroll holds zero user keys, it cannot move your
money and cannot read your amounts. Confiroll calls this being Confiroll-blind: amounts are
hidden from the public, from other employers, and from Confiroll itself.

### The two keys

<CardGroup cols={2}>
  <Card title="Wallet signing key" icon="wallet">
    The Stellar key that authorizes transactions. It stays in your wallet, or in an
    email-based embedded wallet, and signs every payout and withdrawal.
  </Card>

  <Card title="Confidential viewing key" icon="eye">
    A separate key that decrypts your own amounts and builds your private proofs. It is
    derived from your wallet on your device, so it follows you across devices and never gets
    uploaded.
  </Card>
</CardGroup>

## What's public and what's private

<table>
  <thead>
    <tr>
      <th>Public on-chain</th>
      <th>Private to you</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>That a payment settled</td>
      <td>The amount of each individual payout</td>
    </tr>

    <tr>
      <td>The accounts involved (payer and payee)</td>
      <td>Ongoing confidential balances</td>
    </tr>

    <tr>
      <td>The total USDC you deposited into a balance</td>
      <td>The mapping of amounts to contractors (your private ledger)</td>
    </tr>

    <tr>
      <td>The specific amount a contractor withdraws on exit</td>
      <td>Everything held inside the confidential balance until it is withdrawn</td>
    </tr>
  </tbody>
</table>

Deposits and withdrawals touch regular USDC, so those figures are visible where funds cross
in or out. Everything that stays inside the confidential balance keeps its amount hidden.

## Frequently asked

<AccordionGroup>
  <Accordion title="Can Confiroll see how much I pay each contractor?">
    No. Amounts are encrypted on your device and Confiroll holds none of the keys that could
    decrypt them. Confiroll relays your already-signed transactions and sponsors the fee, and
    nothing more. That is what being Confiroll-blind means.
  </Accordion>

  <Accordion title="If amounts are hidden, how does anyone audit a payment?">
    The employer holds an escrow key on their own device. To satisfy an audit, you disclose a
    specific payout: your device decrypts the amount and produces a verifiable proof that the
    figure matches the on-chain ciphertext. You can prove any amount you choose to, and
    Confiroll still cannot read it.
  </Accordion>

  <Accordion title="Is this anonymous?">
    No, and Confiroll never claims it is. The payment graph, meaning who paid whom and when,
    is public. What stays private is the amount. This is confidentiality, not anonymity, and
    balances are never described as unlinkable.
  </Accordion>

  <Accordion title="What happens if I switch devices?">
    Your viewing key is derived from your wallet, so signing in with the same wallet on a new
    device reconstructs it locally. Your balance decrypts again from chain state, and nothing
    needs to be exported from Confiroll because Confiroll never had it.
  </Accordion>
</AccordionGroup>

<Note>
  Want the technical version? See [The non-custodial model](/developers/non-custodial-model) in
  the Developers tab. It walks through the two keys, browser-side proving, and the fee-bump in
  detail.
</Note>