Confiroll pays contractors in USDC and keeps every individual amount hidden on the public ledger. No gas fees for anyone. You hold your own keys.
Every payout amount is encrypted on-chain by the OpenZeppelin Confidential Token. Anyone can verify a payment settled. Nobody can read what it was.
RATES · RAISES · TOTALS, ALL SEALEDEvery action is fee-sponsored. You run payroll holding zero XLM, and the people you pay never buy a second token just to get paid.
SPONSORED SETUP · PAYOUT · WITHDRAWALSigning, proving and decryption all happen in your browser. Confiroll holds zero funds and zero user keys, so it cannot move your money or read your amounts.
YOUR WALLET · YOUR DECRYPTION KEYThe same shape as any payroll tool you have used. The cryptography stays out of your way, and out of your ledger.
Pay from USDC you already hold on Stellar, or bring the batch total over from another chain with one Circle CCTP transfer.
One at a time or by CSV. Each person connects a wallet once, anyone with a Stellar address can be paid.
Set the amounts, review, sign once. A proof is built for each payout and settles on-chain with no amount in the transaction.
Keep a private record of who got what, and hand an auditor a verifiable disclosure when they ask for one.
Your balance is decrypted locally and a zero-knowledge proof is built per amount. The number never leaves the tab.
Freighter, any of the 16 Stellar Wallets Kit wallets, or a passkey. Nothing custodial, no seed phrase required.
The signed transaction is relayed and fee-bumped under guard-rails: allow-listed contract, fee cap, per-account quota.
The contract verifies the proof on-chain and the payout settles publicly, no amount in the transaction, 0 XLM spent by you.
Privacy that hides everything from everyone is useless to a company with a finance function. Confiroll hides the numbers and leaves everything that makes a payment legitimate in the open.
Confiroll composes what Stellar already ships: the same confidential token, wallets, disbursement engine and fee rails the network uses.
Amount-hiding comes from OpenZeppelin's Confidential Token with Nethermind's on-chain proof verifier, over canonical USDC.
A self-hosted SDP instance is the payout engine. It submits every confidential payout and sponsors the fees, so you never need XLM.
Treasury on another chain? Burn, attest and mint the batch total onto Stellar, into an account you control, then fund your balance.
Sign in and sign payouts with the wallet you already use, all 16 kit wallets work, verified live with Freighter. Or sign in by email.
A fee sponsor wraps every transaction and sponsored reserves cover account setup. Measured on-chain: employer balance delta 0 XLM.
Optional keyless sign-in for teams that would rather not manage a wallet: a Soroban contract account authorized by a passkey.
Contractors keep their own wallet, their pay stays private, and nothing is deducted for network costs.
Connect a Stellar wallet or a passkey once. Account setup is sponsored too.
Pay arrives as a confidential balance only you can read. Your rate is not public record.
Move it out to standard USDC on Stellar whenever you like, paying 0 XLM.
Every claim below is enforced by a contract or by a key you hold, and the scope is stated as precisely as your compliance team would state it.
Every amount is encrypted on the ledger. Unreadable to the public, to other employers, and to Confiroll.
Your keys never leave your browser. Signing, proving and decryption run on your device. Zero user keys and zero funds ever touch our infrastructure.
Audit access is escrowed at setup. The auditor key is fixed when you onboard and cannot be swapped silently, so every disclosure stands up to review.
A contract decides, not a server. An on-chain verifier accepts or rejects every payout, so trusting Confiroll is never part of the flow.
Confidentiality covers the amounts. Senders, recipients and settlement stay public by design, and that is exactly what keeps payroll auditable.
Running today on Stellar testnet. A complete payroll cycle, funded, paid, disclosed and withdrawn, with public beta opening 16 August.
Mainnet follows the audit, not the hype. The confidential token underneath is in security review ahead of its mainnet release, and Confiroll ships when it does.
USDC end to end. Funding and withdrawal stay in canonical USDC, with no wrapped assets and no fiat detours to reconcile.
Your address, each recipient's address, and that a payment settled. Not how much any one person was paid, and not your total for the cycle.
No, and deliberately not. Hiding who paid whom would make payroll unauditable. Confiroll hides the numbers and leaves the parties and the settlement public, which is what a finance function needs.
You, the person you paid, and whoever holds the auditor key escrowed at setup. Not Confiroll, the key never touches our servers, and it cannot be swapped silently.
Nothing, and they never need to buy XLM. Account setup, receiving, and withdrawing to standard USDC are all fee-sponsored.
Yes. Payslips are encrypted in your browser and each cycle is anchored on-chain as a Merkle root the contract verifies, so one payslip can be proven authentic without publishing the rest.
A full cycle runs on Stellar testnet today with test-only USDC, in an invite-only closed beta. Mainnet waits on the confidential token's security audit completing upstream.
The closed beta is invite-only on Stellar testnet today, and public beta opens on 16 August. Reviewers and teams paying global contractors can reach out for access any time.
We will get back to you with an invite. If you are reviewing Confiroll and need access sooner, reply to the confirmation email.