Overview
A compliant privacy layer that takes money from any SEP-24 anchor straight into a private pool.
The problem
Stellar has privacy tools, but privacy breaks at the fiat edge. A ramp deposit pays the user's own address, with an amount and a time, and anyone can follow it into a privacy pool and out. A compliant pool also needs someone to run KYC, maintain the allow-list (the ASP), keep the auditor's view key and pay fees.
How Shield works
- The user's wallet derives their pool keys. Shield receives only public keys, signed by the account.
- Shield runs KYC and, as the pool's ASP, adds the user to the allow-list on-chain.
- Shield opens a standard SEP-24 deposit with the anchor, paid to Shield's omnibus account with a memo.
- When the anchor confirms its payment, Shield deposits into the pool from its own account.
- Shield transfers the amount privately to the user's keys.
On the explorer you only see "the anchor paid Shield" and "Shield used the pool". The user's address appears nowhere. The auditor, with the view key, sees who received what.
Two modes
| Ramp | Direct | |
|---|---|---|
| Money comes from | Local currency through a SEP-24 anchor | USDC in the user's wallet |
| User address on-chain | Never | When depositing, and as the signer of their transfers |
| Needs an anchor | Yes, any SEP-24 anchor | No |
Who it is for
- Wallets and apps that want private balances for their users: integrate the API (see Quickstart).
- Anchors that want to offer private deposits: they need no change for level 1, and can adopt the Shield Protocol natively.
- Auditors and regulators: every note is visible with the pool's view key (see Security).