Banknote-style engraving of a postmaster in a peaked cap, holding up an envelope closed with a wax seal.

Sandbox waitlist open

Move money. Show no one.

Aroko is registered mail for money. Every payment is sealed, delivered, and receipted on public rails. Prove it to anyone with the right to ask.

Join the sandbox See the four calls

Built on the confidential-finance stack

ERC-7984
ZAMA
OPENZEPPELIN
INCO
BRIDGE.XYZ

The problem

Your payroll is on a billboard.

A finance team that pays 50 people on-chain publishes 50 salaries. Pay a supplier and every competitor reads the terms. This is not a privacy preference. It is a trade-secret leak, a labor-law exposure, and the reason CFOs say no to the rail.

Public chain · anyone can read

Recipient	Amount
0x7f…3ab2	$8,250.00
0x9c…41e0	$12,400.00
0x21…d90c	$6,100.00
0xe4…77a1	$14,900.00
0x5b…08f3	$9,700.00
0xa0…c2e7	$21,300.00

Aroko · amount sealed

Recipient	Amount
0x7f…3ab2	Sealed
0x9c…41e0	Sealed
0x21…d90c	Sealed
0xe4…77a1	Sealed
0x5b…08f3	Sealed
0xa0…c2e7	Sealed

$9T
settled in stablecoins over the last twelve months
1.5M
workers paid through platforms that now settle in USDC
100%
of those payments are public. To everyone. Forever.
0
of those platforms seal the amount.

Deel, Rise, Bitwage and Request Finance moved payroll on-chain in 2025–26. The rails are ready. The envelope is missing.

How it works

Seal. Deliver. Verify.

Every payment is a sealed envelope. One call opens it, for the right reader only.

Pay supplier

To 0x7f…3ab2

Amount sealed

Sealing, then sending…

Receipt #42

Recipient: 0x7f…3ab2
Amount: sealed
Anchor: tokenId 42
Signature: EIP-712 verified

Delivered Amount sealed

Seal

The amount is encrypted before it touches the chain. Only sender and recipient hold the key.
Deliver

Settlement runs on public Ethereum like any transfer. Anyone can see it landed.
Verify

Anyone confirms delivery with one call. Only an authorized reader opens the amount.

Built on Zama’s fully homomorphic encryption (FHE) and the ERC-7984 confidential-token standard from OpenZeppelin, Zama and Inco. Zama built the code. Aroko built the phone.

The API

Four calls. That’s the whole rail.

Mint sealed dollars 1:1. Move them encrypted. Redeem to stables. Verify any payment by signature or by anchor.

Mint. Deposit stables, receive cAROUSD 1:1. The balance is sealed from the first block.
Transfer and redeem. Encrypted client-side, settled on-chain, redeemed in two phases: burn, then finalize.
Verify. Every payment returns a .nota. Check it by EIP-712 signature with no chain call, or by on-chain anchor with no trust in us.

Get sandbox access

POST /v1/deposits Sandbox

POST /v1/deposits
{
  "recipient": "0x9c…41e0",
  "stable": "USDC",
  "amount": "250000.00"
}
// on-chain today: commitDeposit(recipient, stable, amount) → netAmount

→ 201 { "minted": "cAROUSD", "netAmount": "sealed", "backed": "1:1" }

const sealed = await aroko.encrypt(amount)  // Zama FHE — encrypted client-side
POST /v1/transfers
{
  "to": "0x7f…3ab2",
  "amount": sealed.handle,
  "proof": sealed.inputProof
}
// on-chain today: confidentialTransfer(to, handle, inputProof)

→ 201 { "status": "settled", "nota": "#42" }

POST /v1/redemptions
{
  "stable": "USDC",
  "maxStableOut": "250000.00",
  "amount": sealed.handle,
  "proof": sealed.inputProof
}
// on-chain today: requestRedeem(…) → redeemId — two-phase: burn, then finalize

→ 202 { "redeemId": "0x5d…", "phase": "burning" }

GET /v1/nota/42/verify
// two ways to trust a receipt:
//   by signature — EIP-712, no chain required
//   by anchor    — on-chain tokenId, no trust in Aroko required
// on-chain today: tokenURI(42) + EIP-712 recover

→ 200 { "delivered": true, "phase": "sealed" }

REST + SDK ship with the sandbox · today: Solidity 0.8.27 on Sepolia · 12 contracts · 250 passing tests

The .nota receipt

Prove the payment. Not the amount.

Send a payment. Aroko returns a .nota: a signed, sealed receipt. The chain proves it settled. The amount stays sealed. Disclose only to a party with the right to ask.

Engraved illustration of a sealed envelope with a wax seal, floating on a violet-to-pink gradient.

.nota

Receipt #42

Recipient: 0x7f…3ab2
Amount: sealed
Anchor: tokenId 42
Signature: EIP-712 verified

Delivered Amount sealed

Sample notas · sandbox

#45 · Payroll 50 recipients · delivered Amount: sealed just now
#44 · Supplier settlement delivered Amount: sealed 4 min ago
#43 · Contractor payout delivered Amount: sealed 11 min ago
#42 · B2B invoice delivered Amount: sealed 26 min ago

Verify a .nota Sandbox

GET /v1/nota/42/verify
→returns 200 { "delivered": true, "phase": "sealed" }
// on-chain today: tokenURI(42) + EIP-712 recover

Who sees what

Regulators get a cleaner ledger than they have ever had.

Aroko is not privacy from the system. It is privacy from everyone who is not the system. Every sender and receiver holds a KYC passport. Every amount opens on lawful request.

Confidential, not anonymous
Soulbound KYC passport
Travel Rule–ready

Envelope access
Who	What they see	What they keep
The business	Its own books	Trade secrets, margins, salaries
Regulators and auditors	Any amount, on lawful request	A named, identified ledger
Employees	Their own pay	Their salary off the feed
Competitors and scrapers	Delivery only	Nothing

Amounts public, identified: Deel, Rise, Bitwage, Request Finance
Amounts sealed, identified: Aroko
Amounts public, anonymous: none listed.
Amounts sealed, anonymous: Privacy coins, Mixers

The only quadrant a CFO can sign.

Why the name

The post office solved this in 1840. West Africa solved it earlier.

Aroko is a Yoruba word for a message sent as an object. A string of cowries, a folded leaf, a knotted cord, carried by a courier in the open. Everyone on the road saw the package. Only the person it was addressed to could read it.

Aroko · Yoruba, n.: A coded message sent as an object. Everyone sees the package. Only the recipient can read it.

The cord of cowries

Carried in the open.
The sealed letter

Protected by law since the 1840s.
The .nota

Sealed by Aroko. Receipted on-chain.

The category · Zama, Bron, OpenZeppelin, Inco

Jan 2026 First confidential payroll on Ethereum mainnet, executed live by Zama and Bron.
ERC-7984 The confidential-token standard, jointly authored by OpenZeppelin, Zama and Inco.
$57M Series B Zama’s institutional round, led by Pantera Capital.
OTC trade First confidential institutional OTC trade settled on Ethereum, on the same rail.

Proof, not a pitch

The hard part is already on mainnet.

The rail Aroko builds on has settled real payroll on Ethereum mainnet. Our contracts are deployed, verified, and under internal review on Sepolia today. REST and SDK ship with the sandbox.

Aroko · shipped

12 contracts deployed on Sepolia
250 passing tests, incl. encrypted mint, transfer, redeem
4 API calls. Mint, transfer, redeem, verify.

Where this goes

Every business ledger, sealed by default.

Today
Sealed B2B settlement and payroll.
Next
Sealed invoices, sealed balances, sealed treasury reporting.
Then
The confidential layer for every payment on every public chain. A rail a business uses without thinking about it.

Sandbox access

Seal your first payment.

Join the sandbox waitlist. We are onboarding finance and treasury teams that run recurring on-chain payouts, B2B settlement first.

Move money. Show no one.

Seal

Deliver

Verify

Four calls. That’s the whole rail.

The post office solved this in 1840. West Africa solved it earlier.

The cord of cowries

The sealed letter

The .nota

The hard part is already on mainnet.

Every business ledger, sealed by default.

Seal your first payment.

Sealed and sent.