Edge screening
Shield and unshield can be checked so sanctioned flow stays out of the pool.
Compliance
Built in, not bolted on
Privacy inside the pool. Checks at its boundary. Disclosure you issue, scope, and revoke — never a permanent back door.
Checks at the edge. Privacy inside the pool.
Screened on the way in and on the way out
Identity-separated ramps
Licensed partners hold KYC. That record is not supposed to sit next to on-chain activity.
Time-decorrelated exits
Withdrawals can be split and staggered so an unshield is harder to match to a shield by clock.
Show exactly what's needed, to exactly who needs it, for exactly as long
Scoped viewing keys
Read-only access to a date range for an accountant, auditor, or lender. Revoke whenever you like.
Programmable expiry
Set an end date and the key revokes itself. No key is meant to live forever.
Encrypted memos
Private bookkeeping labels, readable only by you or a viewing-key holder.
Local export
CSV or PDF generated on your machine from a key you issued.
Prove it without revealing it
Proof of funds
Answer yes-or-no questions — balance above X, held for N months — without opening the account.
Collateral attestation
A lender can accept a proof of shielded holdings instead of watching a public wallet.
Corporate actions
Dividends and splits reach shielded holders without publishing who they are.
Every party that used to need your whole wallet gets a narrower answer
| Party | Public wallet | XEROPAY |
|---|---|---|
| Accountant | Screenshots and a shared sheet | A key scoped to the filing window |
| Auditor | Full history, forever | A read-only key that expires |
| Lender | A public balance they can watch | A proof of balance above X |
| Issuer / bank | Nothing to show but a mixer-shaped address | Edge screening plus association-set proofs |
| Counterparty | Your whole balance from one payment | A one-time stealth address |
Self-custodial from the first note
No master viewing key
Every disclosure is scoped, time-boxed, and issued by you.
Client-side portfolio
Notes decrypt in the browser. The server is not the source of positions.
Device controls
Per-device limits, freeze, and an instant kill switch.
Treasury multi-sig
Co-signers for companies that cannot put funds behind one key.
Note consolidation
Background defragmentation so proofs stay fast and fees stay low.
Gas sponsorship
A paymaster can cover fees so you do not hold a gas token beside private funds.