Hold a credential
An issuer signs your KYC status, age, investor type and jurisdiction into one Merkle-committed credential while roots commit to sanctions and revocation lists.
BLS12-381 Groth16 · Stellar testnet
Prove you're eligible.
Reveal
no identity.
AnchorShield is a reusable zero-knowledge access layer for Stellar. Holders prove KYC, sanctions and revocation non-membership, age and jurisdiction from a single credential. Payments and real-world assets are gated on-chain without raw identity touching the ledger.
- proof system
- Groth16
- constraints
- 15,866
- on-chain verify fee
- — stroops
Verifier live on testnet
Real Sumsub KYC-backed credential
Live OFAC SDN sanctions screening
Anchor verified live · SEP-10/38
browser
Payment proof accepted · 250
transferred
RWA proof accepted · 100 minted
Replayed nullifier rejected
SDK + CLI published to npm
how it works
One credential, verified three ways
A holder receives a single issuer-signed credential, then proves only what a policy needs — nothing else leaves the browser.
Prove in the browser
snarkjs generates a Groth16 proof over BLS12-381 entirely client-side. The credential and its secrets never leave your device.
Gate moves value
A Soroban contract verifies the proof on-chain, checks the nullifier for replay, and only then releases a payment or mints an asset.
two gates, one primitive
Built for payments and real-world assets
The same circuit and credential root drive two live testnet gates. Try either one in the proof console.
paymentgate 01
Travel-rule payment gate
Proves the sender is KYC-cleared, absent from committed sanctions and revocation roots, and within corridor limits before value moves over a Stellar SAC.
RWAgate 02
Regulated asset gate
Authorizes an exact OpenZeppelin SEP-57 mint with a one-time proof-bound attestation consumed by the compliance adapter.
why it matters
Compliance without surveillance
Private by default
Raw identity never touches the ledger. Proof signals, action data, committed roots and a nullifier are public.
Reusable primitive
One circuit, many policies. Add a gate without re-issuing credentials.
Enforced on-chain
Soroban verifies every proof and rejects replays — eligibility is a hard precondition for value.
Selective disclosure
A regulator with the view key can confirm a payment's disclosure packet — and nothing more.