Notarion — Zero-knowledge attestation on Stellar

The thesis

Two truths the AI economy can no longer dodge.

You must prove records have not been tampered with. You must not reveal the records themselves. These goals appear contradictory — until you replace "trust the vendor's database" with cryptographic proofs anchored to a public ledger.

Selective disclosure

Prove that a record contains a property — was signed by an authorized party, falls within a regulatory range, references a consented patient — without revealing the record itself. Powered by zk-SNARKs in v2.

Public, independent verification

Anyone — auditor, regulator, opposing counsel — verifies a proof against the on-chain root using only the public Horizon API. No Notarion software. No vendor cooperation. No trust.

GDPR-safe by construction

Only opaque 32-byte proofs ever touch the chain — no PII, no record content, no metadata. Right-to-erasure preserved: deleting the off-chain artifact renders the on-chain commitment informationally meaningless.

Protocol

From statement to verifier — in four steps.

The same primitive serves the v1 commitment scheme and the v2 zk-SNARK rollout. Your application code never changes.

Statement

Your service declares what it wants to prove about a record — existence, integrity, range, set membership, or signature validity.

S : "record ∈ R"

Witness

The record itself, plus any private inputs (consent token, signing key, patient ID), are kept off-chain and fed into the prover.

W = (record, secrets)

Proof

A SHA-256 + Merkle commitment (v1) or a zk-SNARK (v2) compresses the truth of S given W into a 32-byte proof π. The witness is discarded.

π ← Prove(S, W)

Anchor & verify

π is batched and anchored to a Stellar transaction memo. Any party can later verify Verify(S, π) → true using only public data.

Verify(S, π) → ✓

Where it matters

Built for any record that must be defended — without being exposed.

Legal & contracts

Prove a contract was signed by an authorized party — without revealing the contract.

eIDAS · UETA

Healthcare

Prove patient consent existed at time T — without revealing patient identity.

HIPAA · GDPR Art.9

Finance audit

Prove a transaction was within the regulatory threshold — without revealing the amount.

SOX · MiFID II

Supply chain

Prove origin certifications without exposing supplier relationships.

EUDR · CSRD

ESG & climate

Prove emissions or labor standards without revealing operational data.

SEC Climate · CSRD

AI/ML provenance

Prove training data was consented and licensed — without exposing the dataset.

EU AI Act Art.50

Identity & KYC

Prove a user is over 18 / accredited / non-sanctioned — without revealing their identity.

eIDAS 2.0 · BSA

Software supply chain

Prove a build came from a specific source commit — without disclosing the source.

SLSA · SBOM

Why Stellar

A public ledger with the economics for ZK at scale.

Anchoring on mainnet, day one. Each hourly batch posts a single Stellar transaction with the Merkle/proof root in MEMO_HASH. Scales to 25k–100k mainnet txns/year per region.
Sub-cent settlement. Stellar's fee model makes high-frequency proof anchoring economically rational where every other public chain cannot.
Soroban as on-chain verifier. v2 deploys zk-SNARK verifiers as Soroban contracts, enabling other on-chain protocols to gate logic on Notarion-attested facts.
Standard authoring. Drafting SEP-XX: Generalized ZK Attestation — Notarion as the reference implementation for a category that does not yet exist on Stellar.
Anchor adjacency. Enterprise customers settle service fees in local fiat through the existing Stellar anchor network (Cowrie, Settle, Vibrant, MoneyGram Access).

stellar://horizon/transactions/{hash}

// What lives on chain — nothing else.
{
  "source_account": "GA…NOTARION",
  "fee_charged":    "100",        // 100 stroops · ~$0.000003
  "operations": [{
    "type":        "payment",
    "amount":      "0.0000001", // 1 stroop self-payment
    "asset_type":  "native"
  }],
  "memo_type":     "hash",
  "memo":          "4f3a9c2e8d1b…b8210f" // proof root
}

// Off chain — your data, your control.
S = "record ∈ R ∧ signed_by(authorized)"
W = (record, signing_key, witness_data)
π ← Prove(S, W)              // 32-byte proof
batch.append(π)
root  = merkleRoot(batch)

Live in your browser

A real privacy-preserving inclusion proof — right now.

Drop a file. Your browser hashes it locally with WebCrypto, places it into a simulated Merkle tree alongside seven other records, and produces a proof that your file is in the tree — without revealing the other records. Nothing leaves your device.

Drop a file here, or click to choose

Files never leave your device. Max ~50 MB recommended.

File —

Size —

Your hash (witness) —

Proof π (siblings) —

Merkle root (on-chain) —

Verify(file, π, root) —

Other records leaked —

This is what selective disclosure looks like. The verifier sees only your hash, three sibling hashes, and the on-chain root — yet they can prove your file is in the tree. Six other records remain perfectly private. In v2, the same primitive becomes a true zk-SNARK: the verifier doesn't even see your hash — only that some record matching a public statement exists in the set.

Prove what's true.
Reveal nothing private.