Built on Solana

Private Payroll.
On Solana. Today.

Civitas delivers production-grade payroll privacy on Solana through a 4-layer stack: Nillion nilDB + nilCC, circom Groth16 ZK proofs verified by Solana’s native alt-bn128 syscalls, and MagicBlock Private Payments. Settling natively on Solana L1.

Launch Portal

Privacy Stack

Nillion nilDB

%allot secret shares

Nillion nilCC TEE

Enclave computation

Groth16 ZK

circom + snarkjs claim

MagicBlock Private

TEE split + delay routing

100%

Shielded

< 1s

Settlement

The Proof Is in the Execution

Actual builders. Working product.

Watch Rythme execute a fully shielded zero-knowledge payroll on Solana devnet. Not a whitepaper. Production infrastructure today.

civitas-platform-demo.mp4

Dual-Party Architecture

NODE-01

Enterprise Node

Manage global treasuries, register cryptographic employee tags, and initiate private payroll runs sealed inside Nillion nilCC TEE + MagicBlock Permissioned ER.

Treasury
ZK
Execution
L1
Settlement
  • Treasury Custody & Escrow
  • ZK Payroll Execution
  • Merkle Set Commitments
NODE-02

Recipient Client

Generate client-side cryptographic credentials, retrieve encrypted salary packets, and execute sovereign withdrawals on Layer 2.

SK
Private Key
ZK
Proof
L2
Withdrawal
  • Local Key Generation
  • Shielded Routing
  • Anonymous Settlement

The Solana Privacy Stack

Settled on Solana L1 · Powered by the Solana ecosystem

Data Privacy

Nillion nilDB + nilCC

Salary data stored as %allot secret shares across Nillion nodes. Payroll computation runs inside a Trusted Execution Environment. Amounts never leave the enclave.

ZK Proving

Groth16 (circom + snarkjs)

256-byte Groth16 proofs generated client-side via snarkjs from the voucher.circom circuit. Verified by Solana's native alt-bn128 syscalls, fitting inside the Solana CU budget. Nullifier PDA blocks double-spend.

Payment Privacy

MagicBlock Private Pay

Claim settlement is routed employer-ER → employee-ER through MagicBlock Permissioned Ephemeral Rollups, with split transfers and randomized 500 to 30,000 ms delays. The base layer sees a transfer happened. Never the amount or pairing.