Your money should move.Your identity shouldn't.
Apps publish a financial policy. Users prove they satisfy it privately. Soroban executes the exact permitted action — without identifying or tracking the user.
Private finance without messy compromises
Nullis keeps the useful parts visible: policy status, action intent, receipts, and failure paths. The person stays out of the operational trail.
Private by default
Users prove eligibility without handing your app a reusable identity trail.
Action-bound proofs
Every proof is tied to one permitted action, amount, recipient, asset, and network.
Inspectable receipts
Successful and blocked attempts both leave a clear on-chain artifact teams can trust.
Sharper controls for faster private launches
One atomic primitive, honest receipts, and measured numbers — everything here runs on Stellar testnet today.
Every decision leaves a receipt
Success and rejection both emit a Privacy Receipt — policy, version, action, nullifier status — with no identity inside. Fully inspectable for the app. Nothing to correlate for anyone else.
See it live- policy
- remittance-ng-uk · v3
- nullifier
- 0x8f31c2…a29c
- executed
- 100 USDC → recipient
- policy
- remittance-ng-uk · v3
- nullifier
- 0x8f31c2…a29c
- reason
- REPLAY · nullifier spent
Real ZK, verified on-chain
A 1,540-gate Noir circuit proves membership and nullifier derivation; Soroban verifies the UltraHonk proof inside the same transaction that executes the payment.
Fast enough to feel invisible
One SDK and one contract path support remittance, RWA access, and future private workflows — proofs generate client-side in under a second.
Revocation that actually shows up
Rotate roots, block stale proofs, and demonstrate the failure path without hiding the hard parts. The negative suite proves it.
Built for exact action control
Policy, proof, and action resolve in one atomic call instead of ending at proof valid. Recipient, amount, asset, and network are all bound in.