PQ ProofQuorum Book Intro

Private Solana Settlement · Policy Roots · Quorum Exceptions

Private settlement,governed by institutional policy.

A privacy and policy-control layer that gives treasury teams a private settlement path on Solana while compliance retains policy roots, quorum-approved exception handling, and hash-linked audit evidence. In pre-production validation on Solana devnet.

Request pilot review Run policy demo Security & readiness

Security Model

Threat model, custody, key boundaries

What ProofQuorum can and cannot move. Devnet attestations available under NDA.

Policy Controls

Quorum, sanctions, credential revocation

Per-tenant policy roots, attestor quorum, epoch monotonicity on-chain.

Audit Evidence

Hash-linked events, DLQ, forensic export

Every lifecycle edge becomes an evidence event suitable for vendor review.

Pilot Package

Devnet runbook, security brief, mapping

4-week structured devnet pilot. One tenant, one policy profile, full lifecycle.

Policy-Bound Private Settlement Quorum-Approved Exception Handling HMAC-Signed Webhooks · DLQ · Retry Per-Tenant Anomaly Alerts Hash-Linked Audit Export

Interactive Demo

See One Transaction, Step by Step

  1. Shield Deposit

    A devnet mock asset is locked and represented as private notes.

    pending

  2. Generate Proof

    Client proves ownership and balance correctness off-chain.

    pending

  3. Policy Check

    Attested policy root validates risk and revocation constraints.

    pending

  4. Settle or Quarantine

    Clean flows settle privately; exceptions enter quorum-controlled quarantine with hash-linked audit export.

    pending

  5. Audit Trail

    Hash-linked event gets exported to compliance systems.

    pending

Result

Settlement approved

Transaction completed under policy threshold. Receiver obtains private balance and can unshield.

Policy POL-2026-A · Epoch 1042 · Amount $100,000

Compliance Console

Tune Policy and See the Decision in Real Time

Decision Engine

Approved for private settlement

All constraints are satisfied. Transaction can proceed through private transfer and audit export.

Decision APPROVED · Path settlement

Risk Score24 / 100Under threshold 40
CredentialValid VCRevocation check passed
SanctionsNo matchScreening signal clear
Quorum2 / 3Bank Ops + Compliance
ActionSettleAudit event exported
  1. Policy loaded with threshold 40/100.
  2. Credential check passed.
  3. No sanctions match detected.
  4. Execution path set to private settlement.

Devnet Live

Verify the devnet trace in a sandbox

Devnet only · mock units · no production funds

Program Status

Loading devnet configuration...

Fetching shielded pool config PDA and asset mint from chain.

Program 4NM1...gVXq · Config pending

  1. RPC: https://api.devnet.solana.com
  2. Program: shielded_pool
  3. Action: deposit(note commitment)

Runtime Health

    Explorer: shielded_pool · quarantine_escrow

    Platform

    Operational Privacy Layer for Regulated Flows

    Private Settlement Execution

    The pilot models private transfer and withdraw paths with policy ID, policy root, epoch, and nullifier semantics — no anonymous flows outside policy scope.

    Compliance-Aware Exceptions

    Mismatched execution moves into quarantine and requires approved human resolution.

    Deterministic Auditability

    Chain-linked forensic export gives deterministic evidence across transaction states.

    Event Reliability by Design

    SSE job stream, signed webhooks, retry/DLQ handling, and persistence-safe recovery.

    Architecture

    Clear Separation of Proof, Policy, and Operations

    1. 01

      Policy Publication

      Tenant policy envelopes are attested, versioned, and checked for epoch monotonicity.

    2. 02

      Private Execution

      Production target: proof payloads domain-bound to policy, transfer outputs, and replay controls. The devnet pilot currently uses fixture circuits for flow validation.

    3. 03

      Governed Resolution

      Suspicious cases enter hold state and resolve via threshold approval policy.

    4. 04

      Audit + Monitoring

      Every lifecycle edge becomes an evidence event for internal and external review.

    Controls

    What the Pilot Delivers Today

    Security

    • Replay-control model with adversarial test coverage; production circuit audit pending.
    • Proof-binding design for policy and transfer outputs; production implementation and audit pending.
    • HMAC-signed outbound event payloads.

    Compliance

    • Policy root + attestation quorum verification.
    • Configurable quarantine approval thresholds.
    • Per-tenant governance and control profile support.

    Operations

    • Idempotent async job lifecycle with retries.
    • State restore after process restart.
    • Rate-limit + anomaly alerting by tenant.

    Security & Readiness

    Exactly Where This Is in the Production Path

    Pre-production · Solana devnet · mock assets · no production funds

    Current Status

    What is real today vs. a production gate

    AssetDevnet mock unitsNo production funds in scope
    ZK circuitsFixture circuitsProduction circuits — gate
    Public-input bindingIn designDomain binding — gate
    External auditsNot yet started2 audits required — gate
    Upgrade authoritySingle operator (devnet)Multisig + timelock — gate
    Key managementDevelopment keysHSM/KMS + rotation — gate
    Audit evidenceHash-linked exportWorking in pilot
    Event reliabilitySSE · webhooks · DLQWorking in pilot
    1. Freeze threat model and public-input schema.
    2. Replace fixture circuits with domain-bound production circuits.
    3. Prove on-chain verifier / public-input alignment under adversarial tests.
    4. Multisig + timelock governance; remove single-operator authority.
    5. HSM/KMS key operations, rotation, break-glass process.
    6. Two external audits (Solana programs · ZK pipeline) + remediation.
    7. HA deployment, SLO/paging, DR drill, capacity tests, legal package.

    Pilot Program

    Launch a Controlled 4-Week Pre-Production Validation

    Start with one tenant, one policy profile, and the devnet lifecycle from private-transfer simulation to governed exception handling.

    Contact

    [email protected]

    Canonical Domain

    www.proofquorum.com