Payroll-grade privacy
Umbra + Cloak + MagicBlock
Encrypt / IKA + REFHE
Confidential payments
Encrypted payment coordination for Solana-native organizations

This route packages the full confidential payment stack as an operational product surface: encrypted planning, private payout rails, intelligence-assisted risk review, and proof-linked execution continuity.

Route summary

Use PrivateDAO like infrastructure, not like a static brochure

This services route explains hosted reads, privacy policies, payout corridors, and the integration starter needed to plug the product into real organizations.

PrivateDAO Stack

Most DAOs expose everything. Votes. Payroll. Treasury activity. Internal operations.

We think that is broken. PrivateDAO enables organizations to operate privately while remaining cryptographically verifiable on Solana. Each layer below has a live route, a proof route, and when available a one-click API exercise.

route proof

1. Private Governance

Confidential decisions for Solana-native organizations.

Create or review DAO state, prepare proposals, commit/reveal private votes, inspect PDAO context, then verify the Testnet action.

SolanaAnchorcommit-revealZK proof anchorsreviewer proofs
one-click API

2. Encrypted Treasury Coordination

Private budget and execution coordination before funds move.

Review treasury risk, preview Jupiter routing, keep encrypted payment metadata bounded, and route approved actions to proof.

JupiterstablecoinsSquads-style authorityencrypted metadataread-node telemetry
TryVerify
one-click API

3. Private Payments

Confidential payouts from organizations to contributors, operators, and task executors.

Generate a private settlement intent, preserve a receipt reference, and route the visitor to the matching proof lane.

CloakUmbraIkaencrypted receiptsSolana memo/hash anchoring
TryVerify
route proof

4. Confidential Payroll

Payroll integrity without exposing every contributor detail.

Use REFHE payroll proof, encrypted manifests, stablecoin payout context, and proof continuity for auditor-safe payroll review.

REFHEencrypted metadatastablecoin payoutsproof receiptsselective disclosure
route proof

5. Intelligence Layer

Decision support before governance or treasury authorization.

Summarize proposals, score risk, inspect wallet and treasury context, and detect abnormal governance or payment posture before signing.

QVACGoldRushCovalentZerionQuickNodeSupabase receipts
one-click API

6. Agent / MCP Layer

Execution lineage for intent -> approval -> execution -> outcome.

Forward an approved operational event to the agent/growth rail while keeping the approval and outcome tied to verifiable receipts.

Torque MCPMagicBlock skillscustom MCP toolsexecution lineageread-node APIs
TryVerify
Private payments explainer

Payments need privacy for the reason, and proof for the outcome.

The confidential payments lane turns sensitive payout intent into encrypted metadata, wallet review, settlement receipt, and a verifier-visible proof path.

Pain
Public payment reasons leak operations
Path
Encrypt intent -> Sign -> Settle -> Verify
Rails
Cloak, Umbra, MagicBlock, Solana memo anchoring
Execution boundaries

This section combines multiple rails. Some cards execute live flows, others expose health or receipt continuity. The boundaries stay explicit so visitors know what has already moved on-chain and what is still a review or readiness step.

Live execution
A route actually prepares or submits a real runtime action on its current rail.
Health / status
A route checks vendor availability, relayer readiness, or runtime state without moving funds.
Intent receipt
A route records a review-safe intent or receipt so operators and judges can inspect continuity.
Full private settlement
A route reaches the actual payout rail and finishes the confidential transfer lifecycle.
Confidential payments system

Encrypted payment coordination built as product infrastructure

This lane is not a trading flow. It is operational infrastructure for confidential payroll, encrypted treasury coordination, secure payout routing, and AI-assisted pre-sign controls, with each rail connected to review and proof surfaces on Solana Testnet.

IKA key control guardrails

UserShareEncryptionKeys activation rules

`UserShareEncryptionKeys` must be created before dWallet creation, and the selected curve must match the dWallet signature path. Any mismatch breaks authorization and decryption flows.

ECDSASecp256k1 / Taproot
Curve.SECP256K1
ECDSASecp256r1
Curve.SECP256R1
EdDSA
Curve.ED25519
SchnorrkelSubstrate
Curve.RISTRETTO
  1. 1. Generate root seed securely, then derive `UserShareEncryptionKeys` with matching curve.
  2. 2. Register encryption key and keep serialized key bytes in secure storage only.
  3. 3. For dWallet activation: sign user public output and verify state before submit.
  4. 4. For decrypt flow: verify active dWallet state, validate share signature, then decrypt and verify output consistency.
MagicBlock on-chain corridor

Private payments are tied to explorer-visible Testnet receipts

PrivateDAO exposes the MagicBlock corridor as a live proof lane: the read-node verifies the corridor PDA and the deposit, private transfer, withdraw, settle, and execute signatures directly against Solana RPC. Private balance reads still require MagicBlock challenge/login, so sensitive state remains wallet-authorized.

Receipts
reading
finalized on Testnet
Corridor
reading
MagicBlock PDA
Runtime
reading
Solana Testnet proof
Execution shape
1base-layer corridor account
2MagicBlock private deposit
3private transfer receipt
4withdraw receipt
5corridor settlement
6governed execute receipt
7wallet-signed private reads through challenge/login
Cloak SDK contract

UTXO-first devnet lane, verified without exposing secrets

This route now distinguishes the hosted PrivateDAO intent receipt from the official Cloak devnet SDK surface. Reviewers can see the exact SDK package, program, relay, and probe command used for live validation.

SDK
@cloak.dev/sdk-devnet
0.1.5-devnet.1 installed in the web app.
Devnet relay
https://api.devnet.cloak.ag
Checked by the generated live probe packet.
Secret handling

The live probe records only public program IDs, public relay status, and public transaction or receipt references. It does not print private keys, viewing keys, UTXO private keys, raw notes, or seed material.

Capability matrix
UTXO API
Primary
transact, createUtxo, createZeroUtxo, transfer, withdraw, and swap helpers are the active integration contract.
Viewing keys
Ready
The SDK path derives nk for scan/decrypt readiness, and the product boundary forbids logging private key material.
Relay / Merkle
Live checked
The repo probe checks Cloak devnet relay health and the executable devnet program account.
Compliance history
Available
Scanner and CSV exports are present in the SDK surface; full history requires a funded wallet and persisted UTXOs.
Read-node receipt
Live
The hosted PrivateDAO API returns a Cloak-labelled testnet intent receipt for reviewer-visible continuity.
Umbra SDK runtime

Umbra relayer boundary, SDK contract, and claim lifecycle are exposed for review

The live lane reaches Umbra's public relayer endpoint through the PrivateDAO read-node and keeps the exact claim boundary visible: browser clients still need wallet signing, SDK-generated proof account data, UTXO slot data, and relayer polling before a real claim is submitted. The upstream hostname is preserved as evidence; the PrivateDAO operating surface remains routed through the Testnet read-node.

Verified public fields
Relayer
https://relayer.api-devnet.umbraprivacy.com
Supported mints
So11111111111111111111111111111111111111112
DXQwBNGgyQ2BzGWxEriJPVmXYFQBsQbXvfvfSNTaJkL6
4oG4sjmopf5MzvTHLE8rpVJ2uyczxfsw2K84SUTpNDx7
Claim lifecycle
receivedvalidatingoffsets_reservedbuilding_txtx_builtsubmittingsubmittedawaiting_callbackcallback_receivedfinalizingcompleted
Operational flow
  1. 1. Prepare confidential policy and payroll intent through local-first intelligence.
  2. 2. Encrypt sensitive payloads client-side with Encrypt / IKA envelope before execution lanes.
  3. 3. Route settlement through Cloak/Umbra/MagicBlock rails based on confidentiality and speed requirements.
  4. 4. Publish commitment-safe receipts to proof and judge surfaces for verifiable operational continuity.
Chain verification stays simple here: first inspect the rail status, then generate the encrypted intent or receipt, then open Proof for the explorer link, transaction anchor, or relayer reference that belongs to that exact flow.
IKA protocol economics context

For payment-lane planning, IKA economics matters at runtime: operation pricing, validator incentives, and governance adjustments can affect dWallet lifecycle costs (generation, presign, signing, resharing). This route keeps those economics visible to treasury operators before finalizing confidential execution policies.