Disclosure policy

Disclosure sets which attributes appear in the public, on-chain portion of a private operation. Auditors still receive encrypted audit payloads. Disclosure decides what is also visible as plaintext.

​

What disclosure controls

Each operation intent includes a disclosure object with four fields: Each field is either 'public' or 'private'.

​

Public vs private

Set disclosure on the intent. Each route only accepts some combinations.

​

”Both” in route reference tables

Some reference tables in this documentation show both for a field (for example withdraw sender). Both is not a third API value — it means the route accepts either public or private for that field. Private sender is valid only with Protocol Relay (zero public deposit). Public sender uses Direct Submission (operation.execute()). Deposit sender cannot be private. The Stellar policy adapter rejects invalid combinations with unsupported_disclosure during prepare.

​

Route constraints

Set a valid disclosure before you call prepare. Execute does not fix an invalid combination.

​

Per-operation reference

​

Deposit

Sender, asset, and amount are public. Recipient stays private because the deposit creates a private pool note.

​

Withdraw

Sender may be public or private. Payout to a public wallet requires recipient, asset, and amount to be public. Private sender requires Protocol Relay.

​

Transfer to registered recipient

Sender may be public or private. Recipient, asset, and amount stay private for fully private transfers between registered users. Private sender requires Protocol Relay.

​

Transfer to unregistered recipient

Transfers to an unregistered recipient use the same private disclosure as a registered transfer (the documented product path). The escrow note owner is derived from a nonce and the recipient G-address; nothing about the recipient is published on-chain. Escrow sends require Protocol Relay. Private sender also requires Protocol Relay. Policy also accepts a fully public disclosure for a public G… recipient; demos and how-tos use the private escrow path.

​

Choosing disclosure in your product

• More public fields — simpler reconciliation, clearer compliance signals, less privacy on those attributes.
• More private fields — stronger privacy; ensure your audit and KYT configuration supports the route.

Read Security and privacy for where disclosed fields appear relative to encrypted audit data.

​

Related