Confidential banking on Solana, for people and for the AI agents that spend on their behalf. GedQACXHF1ZbjjvVioXgMuSFKXT1Ngiq9eiYTk1Mpump

Every financial product available today asks you to give something up. Banks see your entire history and pass it along to processors and partners. Public blockchains hand the same history to anyone with a block explorer. Privatus takes a third route: payments settle on Solana where anyone can verify they happened, but only you and the person you paid ever learn how much moved.

Addresses stay visible. Amounts do not.

The same account works for a person getting paid in USDG and for an autonomous agent settling a compute bill at three in the morning. Agents hold their own funds under spending policies enforced by the chain rather than by a server, and they show up in your activity feed like any other counterparty.

Solana is the only major chain that ships a confidential transfer primitive inside its token program, so we did not have to invent one. Settlement assets are Token-2022 mints with the confidential transfer extension enabled: balances and amounts live on-chain as twisted ElGamal ciphertexts, and zero knowledge proofs checked by Solana's native proof program confirm each transfer is correct without revealing what it was worth. Validators only ever order ciphertexts.

Encrypted balances on their own are not a bank, though. They cannot tell you that gwen.privatus belongs to a particular wallet, that an agent has already burned through its daily allowance, or that a payment request expired unpaid. That state lives beside the encrypted balance as ordinary program accounts, and the client composes the two at settlement time.

Accounts sit at one of three tiers. Public leaves amounts and counterparties in the clear where compliance calls for it. Confidential encrypts amounts and is the default. Shielded hides both. The tier belongs to the account rather than to an individual transfer, so nothing can quietly downgrade its own privacy mid session.

An agent gets a signing key, a vault only the program can move funds out of, and a policy: a cap per transaction, a rolling daily cap, an optional recipient allowlist and a threshold above which a human has to sign off. Supervised agents queue everything. Semi-autonomous agents settle under the threshold and queue above it. Fully autonomous agents settle whatever the policy permits. Because the limits are program constraints rather than API rules, a compromised server cannot spend past them, and a leaked agent key is handled by pausing the agent or rotating its signer instead of racing to move money first. Revocation is permanent and sweeps the vault back to the owner, and it keeps working even while the protocol is paused, because an exit has to stay open during an incident.

x402 is a first-class citizen here. An HTTP 402 challenge carries its invoice reference straight into the on-chain event stream, which is what your webhook reconciles against.

Keys carry their environment in the prefix. pv_test_ points at devnet and moves nothing real, pv_live_ points at mainnet and does. There is no mode flag to misconfigure.

Full walkthroughs, the API reference and the protocol writeup are at docs.useprivatus.com.

Privatus is in beta. The SDK surface is stable but still moving, so pin a version and read the changelog before you upgrade. On-chain programs are audited by a third party before mainnet opens to everyone, and beta users operate under a published risk disclosure. US persons are excluded during beta.

Issues and pull requests are welcome on any of the repositories above. Protocol changes should come with tests, and anything touching the confidential transfer path or policy enforcement gets a closer read than usual, for reasons we hope are obvious. If you have found a security issue, please do not open a public issue. Email security@useprivatus.com and we will get back to you quickly.

_{Transparent infrastructure, private activity.}