Payroll
Payroll pays many payees from your confidential balance in one run. Everything about the run, from the CSV to the amounts and memos, stays in your browser: the service receives only the opaque envelopes and public references to the notes it creates.
The CSV
A payroll file is a CSV with a header row. Two columns are required and two are optional, in any order:
| Column | Required | What it holds |
|---|---|---|
payee | yes | The payee's wallet address |
amount | yes | The amount in USDC, with up to six decimal places |
row_id | no | Your own reference for the row; missing ones become row_1, row_2, … |
memo | no | Up to 32 bytes, sealed with the amount |
payee,amount,memo
7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU,4200.00,October salary
3mPtzR1qkZz9c8yYJ5w3QfVqDw2n6HhJmS9yRkU2c21D,1850.50,Invoice 2026-118
Quoted fields, commas inside quotes and multi-line quoted memos are accepted. The app rejects the whole file, row by row with a reason, if a header is unknown or repeated, an address is invalid, an amount has more than six decimals, or a memo is longer than 32 bytes. A file can hold up to 10,000 rows.
Running a batch
- Upload the CSV on the Payroll page. The app parses it in the browser and shows the rows, their total, and any issues.
- Check the plan. Before anything is sealed, the app reads from the chain the pool, your account and every payee's account and key record, and checks that every payee has an account and a registered key and that your balance covers the total. A payee without an account is named so you can ask them to set up first.
- Seal and send. The app commits to every amount with a fresh blinding, seals every envelope, computes each intermediate balance ahead, and then sends the transfers in order. Your wallet signs each transfer. The plan and its progress are encrypted on this device, so a run that is interrupted resumes from where it stopped, with the same notes and amounts, never a new draw.
- Watch it settle. The Payroll page shows each row as sent, attested and accepted, from the chain. A row a payee returns is shown as returned; its note comes back to your Inbox.
After the run
Each payee sees a note in their Inbox like any other payment, opens it with their own key and accepts it. The auditor attests every note as it does any other.
A run that completes means every transfer was sent and landed. Acceptance is each payee's step; the Payroll page tracks it.