# Confiroll

> Confidential contractor payroll on Stellar: amounts hidden on-chain, fees sponsored, and keys held by you.

## Docs

- [What is Confiroll?](https://docs.confiroll.com/guide/index.md): Pay global contractors in USDC with each amount kept private on-chain, no gas fees, and you hold your own keys.
- [How Confiroll works](https://docs.confiroll.com/guide/how-it-works.md): Private amounts, no gas fees, and self-custody: the three ideas behind Confiroll, and what actually happens on each.
- [Getting started](https://docs.confiroll.com/guide/getting-started.md): Sign in to Confiroll with a Stellar wallet or with your email, and land in the right app for your role.
- [Employer guide](https://docs.confiroll.com/guide/employer/overview.md): Everything an employer does in Confiroll: fund a balance, add contractors, run confidential payroll, track settlement, prove amounts, and issue payslips.
- [Dashboard](https://docs.confiroll.com/guide/employer/dashboard.md): Your home screen: available balance decrypted on your device, quick stats, recent activity, and the first-run checklist.
- [Contractors](https://docs.confiroll.com/guide/employer/contractors.md): Add and manage the people you pay, one at a time or in bulk by CSV, and track who is ready to be paid.
- [Fund your balance](https://docs.confiroll.com/guide/employer/funding.md): Get USDC into your confidential balance with the test-USDC faucet, a CCTP bridge from Base Sepolia, or a deposit of classic USDC on Stellar.
- [Run a payroll](https://docs.confiroll.com/guide/employer/run-payroll.md): The core wizard: select recipients and amounts, review the batch, run it with one wallet approval per payout, and prove settlement.
- [Activity and history](https://docs.confiroll.com/guide/employer/history.md): Your auditable record of every payout, withdrawal, and funding event, with explorer links, filters, batch grouping, and export, backed by your private ledger.
- [Payslips](https://docs.confiroll.com/guide/employer/payslips.md): Generate encrypted, tamper-evident payslips for each cycle and anchor them on-chain with a single Merkle root.
- [Compliance and disclosure](https://docs.confiroll.com/guide/employer/compliance.md): Reveal and prove a specific payout amount for an audit using a key only you hold, with a disclosure anyone can verify against the chain.
- [Settings, team, and roles](https://docs.confiroll.com/guide/employer/settings.md): Organization details, your connected wallet and on-device keys, teammates and approval roles, defaults, and the testnet transparency panel.
- [Contractor guide](https://docs.confiroll.com/guide/contractor/overview.md): Get paid privately in USDC: accept an invite, set up once, view your pay, and withdraw with no gas fees.
- [Get set up](https://docs.confiroll.com/guide/contractor/onboarding.md): Accept your invite, sign in with a wallet or email, and register your confidential account so companies can pay you.
- [Your dashboard](https://docs.confiroll.com/guide/contractor/dashboard.md): See your private balance and payout history, decrypted on your device and visible only to you.
- [Withdraw to USDC](https://docs.confiroll.com/guide/contractor/withdraw.md): Move your confidential balance out to regular USDC, fee-free, with only the withdrawn amount revealed on exit.
- [Your payslips](https://docs.confiroll.com/guide/contractor/payslips.md): Open your encrypted payslips, decrypt them locally, and verify them against the on-chain anchor.
- [FAQ](https://docs.confiroll.com/guide/faq.md): Answers on privacy, fees, sign-in, funding, payroll, withdrawals, and the network Confiroll runs on.
- [Glossary](https://docs.confiroll.com/guide/glossary.md): Plain-language definitions of the privacy, money, payment, and network terms across Confiroll.
- [Architecture](https://docs.confiroll.com/developers/index.md): How Confiroll fits together: a thin BFF, a headless SDP, Soroban contracts, and a browser that does the confidential heavy lifting.
- [Ecosystem and integrations](https://docs.confiroll.com/developers/ecosystem.md): Every component Confiroll builds on and exactly how each one is used: Stellar, Soroban, Stellar Wallets Kit, OpenZeppelin, Nethermind, Circle CCTP, and the Stellar Disbursement Platform.
- [The non-custodial model (Confiroll-blind)](https://docs.confiroll.com/developers/non-custodial-model.md): Two secrets per user, browser-side proving, Fork B fee-bump, employer-held escrow, and the invariant that Confiroll holds zero user keys.
- [Confidential token flow](https://docs.confiroll.com/developers/confidential-token-flow.md): The register, deposit, confidential_transfer, merge, and withdraw operations, plus auditor disclosure, and exactly what is public vs hidden at each step.
- [Fee sponsorship](https://docs.confiroll.com/developers/fee-sponsorship.md): Fork B plus the CAP-15 fee-bump, and the sponsor guard-rails: contract allow-list, fee cap, per-account quota, and key separation.
- [Funding](https://docs.confiroll.com/developers/funding.md): Three ways USDC enters a confidential balance: the testnet faucet, the CCTP bridge through an employer-owned vault, and a deposit of classic USDC you already hold.
- [Soroban contracts](https://docs.confiroll.com/developers/contracts.md): payslip-anchor, cctp-vault, and passkey-wallet: what each does, its functions, its storage and events, and how it's used. All deployed on testnet.
- [SDP integration](https://docs.confiroll.com/developers/sdp-integration.md): How Confiroll uses a vendored, headless Stellar Disbursement Platform (as a channel-account pool, fee-bump, submit, and retry), the queue relay, and the one upstream patch.
- [API reference](https://docs.confiroll.com/developers/api-reference.md): Base URLs, Bearer-JWT authentication, the error shape, and the full endpoint map for the payroll-api BFF.
- [Security & claims](https://docs.confiroll.com/developers/security-and-claims.md): Exactly what Confiroll does and does not guarantee: testnet only, amounts hidden (not the graph), no mainnet privacy claim, and how to verify it yourself.
- [Service health](https://docs.confiroll.com/api-reference/health/service-health.md): Reports configured capabilities. Booleans reflect configuration presence, not live connectivity.
- [Get a SEP-10 challenge](https://docs.confiroll.com/api-reference/auth/get-a-sep-10-challenge.md): Returns a challenge XDR for the given account to sign with its wallet. Single-use, expires in 5 minutes.
- [Verify a signed SEP-10 challenge](https://docs.confiroll.com/api-reference/auth/verify-a-signed-sep-10-challenge.md): Verifies the wallet-signed challenge and issues a session. `sub` is the proven G-address.
- [Exchange a Privy token for a session](https://docs.confiroll.com/api-reference/auth/exchange-a-privy-token-for-a-session.md): Verifies a Privy access token and issues a session. `sub` is the Privy user id.
- [Fee-bump a confidential transfer (the core payout call)](https://docs.confiroll.com/api-reference/transfers/fee-bump-a-confidential-transfer-the-core-payout-call.md): Accepts a browser-built, **employer-sourced** `confidential_transfer` signed with `signTransaction`, binds it to your session account, and fee-bumps it (CAP-15) so you pay 0 XLM. The amount stays inside the proof and is never an argument here. Only Stellar (SEP-10) sessions may call this; the inner…
- [Run a confidential batch](https://docs.confiroll.com/api-reference/batch-runs/run-a-confidential-batch.md): Runs a confidential batch of payouts through the headless SDP relay. The primary, non-custodial payout path is `POST /transfer`. Returns 501 when batch execution is not enabled for the deployment.
- [Poll a batch job](https://docs.confiroll.com/api-reference/batch-runs/poll-a-batch-job.md)
- [Withdraw (currently 501)](https://docs.confiroll.com/api-reference/withdrawals-and-disclosure/withdraw-currently-501.md): Requires a session. Returns 501. The withdraw operation runs in the client tooling, where the contractor holds both keys.
- [Auditor disclosure (currently 501)](https://docs.confiroll.com/api-reference/withdrawals-and-disclosure/auditor-disclosure-currently-501.md): Requires a session. Returns 501. Disclosure runs on the employer's device with the employer-held escrow key, against the public on-chain event data.
- [Resolve the signed-in user's role](https://docs.confiroll.com/api-reference/session-and-role/resolve-the-signed-in-users-role.md): Drives role-based routing: onboarding vs employer app vs contractor portal.
- [List contractors](https://docs.confiroll.com/api-reference/contractors/list-contractors.md): Public directory data only.
- [Add a contractor](https://docs.confiroll.com/api-reference/contractors/add-a-contractor.md): `ready` if the address is already registered on-chain, else `invited`.
- [Bulk-import contractors (CSV rows)](https://docs.confiroll.com/api-reference/contractors/bulk-import-contractors-csv-rows.md): CSV is parsed client-side into rows.
- [Get a contractor](https://docs.confiroll.com/api-reference/contractors/get-a-contractor.md)
- [Update a contractor](https://docs.confiroll.com/api-reference/contractors/update-a-contractor.md): Partial update (e.g. status change to deactivate).
- [Remove a contractor](https://docs.confiroll.com/api-reference/contractors/remove-a-contractor.md)
- [Send/resend an invite link](https://docs.confiroll.com/api-reference/contractors/sendresend-an-invite-link.md)
- [List batches](https://docs.confiroll.com/api-reference/batches/list-batches.md): SDP-aligned (Batch ≈ Disbursement).
- [Create a draft batch](https://docs.confiroll.com/api-reference/batches/create-a-draft-batch.md)
- [Get a batch with its payouts](https://docs.confiroll.com/api-reference/batches/get-a-batch-with-its-payouts.md)
- [Upload batch instructions](https://docs.confiroll.com/api-reference/batches/upload-batch-instructions.md): SDP's "upload instructions" step. `encryptedAmount` is opaque to the server (blind). Validates each contractor exists and is `ready`.
- [Lock a draft batch for running](https://docs.confiroll.com/api-reference/batches/lock-a-draft-batch-for-running.md): Transitions a batch from draft to ready. Starting is client-driven (per-payout `POST /transfer`).
- [Poll batch progress](https://docs.confiroll.com/api-reference/batches/poll-batch-progress.md): Poll while a run is in progress.
- [List payouts (activity feed)](https://docs.confiroll.com/api-reference/payouts/list-payouts-activity-feed.md): Filter by batch, contractor, status, or date range.
- [Mint test USDC and deposit](https://docs.confiroll.com/api-reference/funding/mint-test-usdc-and-deposit.md): Testnet convenience: mint test USDC + deposit into the confidential balance.
- [CCTP vault state](https://docs.confiroll.com/api-reference/funding/cctp-vault-state.md): Reports the CCTP vault balance for the bridge flow.

## OpenAPI Specs

- [openapi](https://docs.confiroll.com/openapi.yaml)