> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aropay.aro.media/llms.txt
> Use this file to discover all available pages before exploring further.

# Confidential transfers

> How cAROUSD keeps amounts private on a public chain: ERC-7984, fully homomorphic encryption, and what observers can and cannot see.

The confidential rail is the reason AroPay exists. It lets you settle on a
public blockchain (with its auditability, finality, and neutrality) without
broadcasting how much money moved.

## The problem with public rails

On a standard ERC-20, every balance and every transfer amount is public,
forever. For enterprise payments that leaks payroll, supplier pricing,
treasury positions, and customer volumes to anyone with a block explorer.

## cAROUSD in one paragraph

**cAROUSD** (Aro Confidential US Dollar) is the value layer of the Aro
Confidential Rails: an ERC-7984 confidential token whose balances and transfer
amounts are stored on-chain as ciphertexts under **fully homomorphic
encryption (FHE)**, built on the Zama Protocol. The contract can *add and
subtract encrypted values without decrypting them* (that's the homomorphic
part), so transfers are verified and executed while the amounts stay opaque.
Decryption requires a key-holder's signature and happens off-chain through the
Zama relayer network. In production, cAROUSD is designed to be backed 1:1 by
liquid USDC and USDT at the Aro Liquidity Commitment; the Sepolia sandbox
substitutes a test stablecoin.

## What an observer sees

|                                | Public transfer (stablecoin) | Private transfer (cAROUSD) |
| ------------------------------ | ---------------------------- | -------------------------- |
| Sender and recipient addresses | Visible                      | Visible                    |
| That a transfer happened       | Visible                      | Visible                    |
| **Amount**                     | **Visible**                  | **Encrypted**              |
| Resulting balances             | Visible                      | Encrypted handles          |

<Note>
  Confidentiality covers **amounts**, not participation. Addresses and the fact
  of a transfer remain public, like a bank statement where every figure is
  redacted but the counterparties are not.
</Note>

## Moving on and off the confidential rail

```mermaid theme={null}
flowchart LR
  stable["Test stablecoin<br/>public ERC-20"]
  carousd["cAROUSD<br/>encrypted ERC-7984"]
  stable -- "POST /mint" --> carousd
  carousd -- "POST /transfer (private)" --> carousd
  carousd -- "POST /redeem" --> stable
  stable -- "POST /transfer (public)" --> stable
```

* **[Mint](/guides/mint-carousd)** converts public stablecoin into cAROUSD at
  1:1.
* **[Private transfers](/guides/send-transfers)** move cAROUSD between
  addresses with encrypted amounts.
* **[Redeem](/guides/redeem-carousd)** burns cAROUSD and pays public
  stablecoin back at 1:1, settling asynchronously.

## Who can decrypt what

FHE ciphertexts are decryptable only by authorized key-holders, via the
relayer:

* **Your custodial wallets**: the sandbox signs the decryption request with
  the wallet's key, which is how the dashboard and `/balances` show plaintext
  confidential amounts.
* **External wallets**: the sandbox has no key, so balances stay encrypted
  (`encrypted: true`, `amount: null`). The owner can decrypt with their own
  tooling.
* **Redeem processing**: burning cAROUSD requires the burned amount to be
  publicly decrypted so the payout can be verified; that value (and only that
  value) becomes public as part of settlement.

## Practical notes

* **All FHE happens server-side.** You send and receive plain decimal strings;
  the sandbox handles encryption, decryption, and relayer interaction.
* **Confidential operations are slower than public ones**: encrypted inputs
  must be produced and proofs verified. The first confidential call after a
  deployment restart is slower still, while FHE keys are fetched.
* **Confidential reads are heavier than gas reads.** Poll
  [`GET /gas`](/api-reference/introduction) freely, but treat `/balances` as a
  read you do when you need it.
* Under the hood, encrypted values are referenced by **handles**: the opaque
  hex strings you see in `confidential.handle` on balance responses.