Kept confidential
Transaction amounts and account balances are encrypted on-chain, so the figures behind a settlement are never exposed on the public ledger.
Technical architecture
The confidential settlement layer, in depth
USDC moves across borders on Stellar with transaction amounts and account balances kept confidential on-chain, while an auditor viewing key preserves full regulatory visibility.
- Network
- Stellar
- Proofs
- Protocol 25/26 ZK
- Standard
- Confidential transfer
USDCSettlement asset
StellarSettlement network
Zero-knowledgeOn-chain proofs
Auditor keysRegulatory visibility
What is confidential
Amounts and balances are hidden; validity never is.
The confidential layer encrypts what a transfer is worth and what an account holds, while leaving every transfer independently verifiable by the network and fully reviewable by an authorized auditor.
Still verifiable
A zero-knowledge proof lets the network confirm each transfer is well-formed — balances stay solvent and every amount reconciles — without ever seeing the numbers.
Always auditable
An authorized reviewer holds the viewing key needed to decrypt activity within their mandate, so confidentiality never turns into opacity.
On-chain contract stack
Three contracts hold the confidential layer together.
The stack is built on Stellar's Protocol 25/26 zero-knowledge host functions and the emerging confidential-transfer contract standard for Soroban, composed into three cooperating contracts.
Confidential wrapper contract
Wraps the underlying asset and records each account's holdings as ciphertext rather than a public figure, keeping balances confidential while they remain fully accounted for.
Verifier contract
Examines the zero-knowledge proof attached to every operation and rejects anything that does not prove valid, so no unverified state change is ever committed.
Auditor-key registry
Records the compliance viewing key associated with each account, making auditor visibility a verifiable, on-chain property of the system rather than an external promise.
How a confidential transfer works
Four operations, each proven on-chain.
A settlement moves from public USDC into the confidential layer and back out again. Every step carries a zero-knowledge proof, so the network confirms the arithmetic without ever seeing the amounts involved.
1
01 Deposit
Public USDC enters the confidential layer and becomes an encrypted balance. The amount is committed as ciphertext the moment it crosses the boundary.
2
02 Merge
Incoming funds are combined into a single spendable balance, making newly received value available for the account to transfer onward.
3
03 Confidential transfer
Value moves from one account to another with the amount and both balances hidden. A zero-knowledge proof shows the transfer is valid — the paying balance covers it and nothing is created or destroyed.
4
04 Withdraw
An encrypted balance is converted back to public USDC, exiting the confidential layer for settlement or onward payout in local currency.
Real USDC, no issuer permission
It wraps the real asset, not a stand-in.
Compliance model
Compliance is a precondition, not an add-on.
Regulatory visibility is enforced by the protocol itself. An account cannot exist in the confidential layer without first granting the auditor a way to see it.
Viewing key escrowed at registration
Every account escrows an auditor viewing key when it is created, and a zero-knowledge proof enforces that escrow on-chain. Without it, registration cannot complete — there is no path to an unmonitored account.
Selective disclosure, one transaction at a time
An authorized reviewer can decrypt one specific transaction without exposing unrelated activity, so a lawful review reveals exactly what it needs to and nothing more.
Sponsored transactions
Nothing to hold, nothing to manage.
The people using the network never have to acquire or manage a network asset to move money. Fees are covered on their behalf, so the experience is fee-free at the edge.
Fees covered by sponsored transactions
Fee-bump combined with sponsored reserves lets an operator pay the network fees and cover account reserves, so senders and recipients never need to hold or manage XLM.
No holding requirement gates a transfer
Because reserves and fees are sponsored, no minimum balance stands between a user and a confidential transfer. The requirement to fund an account never reaches the person sending or receiving value.
Product surfaces
Dashboards and APIs over the same core.
Every surface reads from one confidential settlement core, each scoped to a distinct audience and a distinct set of permissions.
| Surface | Audience | What it does |
|---|---|---|
| Admin dashboard | Operator | Operational control over accounts, sponsorship, corridors and system health. |
| Banking / Partner dashboard | Partner bank & PSP | Originate and monitor confidential settlements, balances and payout status. |
| Auditor / Compliance dashboard | Auditor & compliance | Selective-disclosure review, audit-trail access and oversight of flagged activity. |
| Partner API | Integrators | REST endpoints, signed webhooks and a full sandbox for building against the network. |
| Compliance API | Compliance systems | Screening hooks, selective-disclosure endpoints and audit-trail queries. |
Regulated last-mile
Anchor Platform bridges chain and cash.
Integration with Stellar's Anchor Platform links on-chain confidential transfers to regulated cash-in and cash-out in local currency, using the established SEP interfaces.
Deposit and withdraw
Interactive cash-in and cash-out that connects a bank or PSP's fiat rails to the confidential layer's deposit and withdraw operations.
Cross-border payments
Regulated transfers between anchors that carry the compliance metadata a corridor requires from origin to payout.
KYC exchange
Structured customer-information exchange, so identity and screening data travel with the transfer instead of being re-collected at each hop.
SECURITY POSTUREUNAUDITED PREVIEW · MAINNET GATED
An honest gate before any real value moves.
The confidential-transfer stack this architecture builds on is an unaudited ecosystem preview today. It is suitable for demonstration and evaluation, not for holding real value. A mainnet launch is explicitly gated on the outcome of an independent security review.
No real value moves on mainnet until an independent audit clears the gate.Launch precondition