FAQ
Straight answers to the questions companies and visitors ask first about Kalypso.
Who can see salaries?
Three parties. The employer, whose browser holds the spreadsheet; each worker, for their own pay only; and the company's accountant, whose key opens every amount the company paid and the treasury's balance after each payment. The accountant opens a company's books at /accountant and can export them as a CSV, but only once they are complete. Nobody else can, including Kalypso's server, which only ever sees encrypted amounts. On testnet, a stranger who searches all 72 showcase transactions for the 12 salaries, in 15 encodings each, finds none (attack P1).
What is public?
Who pays whom, when, how many workers a company has, and who is on its roster. Deposit and withdraw amounts are public too, so the deposit that funds a treasury shows about what the payroll costs, and a worker who withdraws exactly their pay reveals it. Only the amounts of payments and balances are private.
What if the accountant's key leaks?
Whoever holds it can read every amount ever encrypted to it, forever, along with the treasury's balance after each of those payments. It still cannot move any money. The accountant can rotate the key, and only they can, so payments from then on are encrypted to the new key, while earlier ones stay readable with the leaked one. Rotation is a rotate_key call on Kalypso's auditor registry, signed by the accountant; the accountant view does not offer it. A rotation in the middle of a run makes proofs built against the old key fail, so the run engine re-reads the keys from chain and builds them again.
What if a worker loses their key?
A worker's key is not a file they can lose. With Freighter it is made from the wallet signing Kalypso's key message, so the same wallet rebuilds the same key on any device. With Face ID it is made from the passkey, so any device that holds the same passkey rebuilds it. If the worker loses the wallet or the passkey itself, nobody can recover the money, because Kalypso has no admin who could move or reissue it. The pay stays on chain, bound to that account.
Can Kalypso freeze or move money?
No. Neither the payroll contract nor the auditor registry has an admin or an upgrade path, the verifier's admin and manager roles were renounced, and a company's money moves only with its treasury's own signature (attack P5). Kalypso could stop sponsoring fees. Nothing would move or freeze, but the worker portal, which sends workers' transactions only through the sponsor, would stop sending them until it came back. The employer console and the accountant view pay their own fees and would carry on. Circle, as the USDC issuer, can freeze or claw back the USDC pooled in the token contract, and Kalypso cannot defend against that.
Why Stellar?
OpenZeppelin's confidential token, which hides balances and amounts behind zero-knowledge proofs while letting an auditor read them, is built for Stellar, and the Stellar Development Foundation lists payroll as a use for it. USDC is issued natively on Stellar, a payment costs a fraction of an XLM, and anchors (companies that turn USDC into local money) let people cash it out. Kalypso's payroll contract is built around that token: without it, the pay call has nothing to keep private.
Why testnet only?
The confidential token, its circuits and its verifier come from a new OpenZeppelin revision that has not been audited, and Kalypso itself is self-audited, not audited by a security firm. Kalypso runs on Stellar's test network today. Real salaries wait for the main network and an outside security audit. Everything on testnet is otherwise real: real contracts, real proofs and real encrypted payments, in test USDC.
How much does a run cost?
Measured on testnet, network fee included: one pay transaction pays two workers for a median 0.51 XLM, and opening the run costs 0.40 XLM. A 10-person run is therefore 5 pay transactions and one open, about 2.95 XLM. Setup is one-off: 0.68 XLM to create a company, and 0.30 XLM to invite plus 0.42 XLM to accept for each worker, mostly storage rent prepaid for about 180 days. The employer pays the company's side. Kalypso's fee sponsor pays the worker's side of joining, including about 1.79 XLM to create a Face ID wallet. Every figure is on Contracts and addresses.
What happens if a payment fails halfway?
Nobody is paid twice and nothing is lost. The contract keeps a paid flag per worker per run, so a run that stops resumes from those flags, and a second pay to the same worker is refused. A batch that cannot be built, for example after a worker rotated their key, fails only its own rows, and the rest of the run goes on. If the network refuses a transaction, the run stops, and running it again picks up from the chain. A pay the device sent but did not see land is never forgotten: the engine waits for the chain to settle it before it builds anything new.
How do workers cash out?
In two steps on the worker portal. First the worker moves pay from their sealed balance to their cash-out account as plain USDC. Then they cash out at Stellar's test anchor, a practice bank where any made-up details work, on its own page opened in a popup. Kalypso builds the anchor's USDC payment only from the anchor's own record, and shows the amount, the destination and the memo before the worker approves it. The withdraw amount is public, so a worker who withdraws exactly one payslip reveals that payslip, and the anchor sees what is cashed out. On testnet no real money moves. Cash-out to a real bank would need a mainnet anchor, and Kalypso runs on testnet only.
Do workers need a crypto wallet?
No. A worker can sign in with Face ID, a fingerprint or the device PIN. Kalypso makes a passkey smart wallet for them, and the fee sponsor pays to create it and every fee of joining, so the wallet never needs XLM. If a worker's passkey cannot make their key, they should save it in Google Password Manager or iCloud Keychain, use their phone, or use Freighter instead. Kalypso refuses a passkey like that rather than weakening it (the missing ability is called PRF). Support differs between phones, laptops and passkey providers. Kalypso has run the passkey path end to end in Chrome with a virtual authenticator that has the ability, and has not been checked on every device brand.
Can I check any of this myself?
Yes, with three commands and no Kalypso key: one shows which release built the code on chain, one reads chain state to confirm nobody can change the rules, and one attacks the live showcase and prints what stopped each attack. They are on Developers, and the security overview maps each claim to the check that proves it.