KalypsotestnetTest

Private payroll on Stellar

Pay your team in USDC. Nobody else can read the salaries.

Every payment is public proof that it happened. The amount is sealed, and only each worker and your accountant hold a key that opens it.

USDC is a digital dollar: one USDC is worth one US dollar.

Pay your team See it work

Test network: no real money moves yet.

Confidential USDCZero-knowledge proofsStellar testnetOpen source, MIT

Live from Stellar testnet

Try to read the salaries.

This is Andes Studio's real payroll, paid through Kalypso on Stellar testnet. Anyone can see each payment happened. Nobody can see how much. Drag the accountant's key over it.

Accountant's keyA stranger's key

Opened in your browser with the demo accountant key we published on purpose. Nothing leaves this page.

Run the same attack from your terminal

Andes Studio (demo)

Company 0 · Payroll CBUIUW…7XVZ

Reading sealed payments from Stellar testnet

Run	Worker	Payment	Amount

Accountant's key

How it works

One salary, start to finish.

Step 1

You approve the run.

Upload a spreadsheet of who gets what. Kalypso checks every address and amount, then asks you to approve the whole run once.

Worker

Amount

Payment

not sent yet

Readable by

You

Step 2

Your browser seals it.

The amount is encrypted on your machine, and a zero-knowledge proof shows it is a valid payment your treasury can afford, without showing the number.

Worker

Amount

Zero-knowledge proof attached

Payment

being sealed

Readable by

Nobody yet

Step 3

The ledger records that it happened.

Stellar stores the payment and marks the worker paid for this run. The amount stays sealed for everyone who looks.

Worker

Amount

Zero-knowledge proof attached

Payment

Readable by

Nobody without a key

Paid

Step 4

The worker opens their own line.

Each worker holds a key that opens their pay and nothing else. Sign in with Face ID or a wallet, read the payslip, cash out.

Worker

Amount

Zero-knowledge proof attached

Payment

Readable by

You · the worker

Paid

Accountant's key

Step 5

The accountant opens the books.

Your accountant's key opens every amount the company paid, so audits, payroll tax and year-end still work. Nobody else ever can.

Worker

Amount

Zero-knowledge proof attached

Payment

Readable by

You · the worker · your accountant

Paid

Who sees what

Three people. Three keys.

Each key opens exactly what its holder should see, and the chain enforces it, not a server.

The employer

Pays the team

Uploads a spreadsheet, approves the run once, and pays everyone in USDC from a treasury that only their own signature can move. Kalypso pays at most once per worker per run, enforced by the contract.

Open the employer console

The worker

Reads their own pay

Joins with an invite, holds a key only they control, and reads their own payslips. Nobody else on the payroll, and nobody on the internet, can see what they earn.

Open your pay

The accountant

Reads the company's books

Registers their own key and gives the company its id. That key opens every amount the company paid and nothing a worker received from anyone else.

Open the books

Don't trust us

Check it yourself.

Everything Kalypso claims can be checked from a terminal against the live testnet contracts.

Nobody can change the rules.

The verifier that checks every proof has no admin left, and neither of our contracts has an admin or an upgrade path. The check reads it from the chain.

The code on chain is this code.

GitHub builds each release and signs a build attestation. The payroll contract running on testnet traces back to release v0.1.1 of the public repository.

CBUIUW…7XVZ

Attack it.

One command attacks the live showcase company the ways the threat model names, and prints what stopped each attack.

testnet

$ npm run check:testnet

$ npm run prove:testnet

$ stellar contract info build \
    --id CBUIUWF6PLCQHTLYUCYIKB34DCFXJG722N2JWE44LVICRCEY34KK7XVZ \
    --network testnet

Last full run: docs/security/attack-run.md