For teams that need audit-ready proof without revealing customer data, internal rules, or sensitive policy inputs.
Blind Verification lets an organization run a private policy over sensitive inputs, issue a decision, and publish a proof receipt that shows the process was followed. The verifier sees proof, not private data.
Auditors, partners, and customers need confidence that a decision was made correctly. But exposing raw data and internal rules creates privacy, compliance, and competitive risk.
Keep the decision process private. Publish a proof receipt that can be checked independently.
The values below represent sensitive customer or case data. PrivateDAO uses them to decide whether the private policy is satisfied, then returns a public receipt that hides the values.
The API generates a witness, runs snarkjs Groth16 prove, then verifies the proof before issuing a receipt.
The receipt includes proof, public signals, verification key, verification key hash, policy commitment, and input commitment.
A verified proof package can be anchored as a Solana PDA receipt with Explorer links for the receipt account and transaction.
REFHE, Ika / Encrypt, and MagicBlock are commitment lanes here unless a separate provider receipt is attached.
`private_dao_blind_policy_overlay.circom` is the current Circom/Groth16 circuit.
The circuit proves membership is true, three private records are positive, the average capacity threshold is satisfied, liabilities stay within the policy envelope, risk score meets the floor, and Poseidon commitments bind the policy and inputs.
The API writes private inputs to a temporary witness input, runs `generate_witness.js` with the compiled WASM, then runs `snarkjs groth16 prove`.
The proving key is the server-side `private_dao_blind_policy_overlay_final.zkey`; it is not sent to the browser or verifier.
The verification key is fixed for circuit version groth16-v1. verificationKeyHash: 05aeb7e27479d7f1551b0c2e18134c58f760de43f2ff085a8ea2e82f212209eb.
The public package binds `proofId`, `nonce`, `issuedAt`, `expiresAt`, `circuitVersion`, `policyVersion`, `policyCommitment`, and `inputCommitment` into the original proof hash.
A policy cannot be changed after proof issuance. Changing `policyVersion` changes the policy salt and produces a new `policyCommitment`.
The current public version pair is `circuitId=private_dao_blind_policy_overlay` and `circuitVersion=groth16-v1`.
After Groth16 verification passes, the API attempts an Anchor PDA receipt and falls back to a Solana Memo receipt transaction if the Anchor program path is unavailable. The response labels the storage mode.
Full Groth16 pairing verification on Solana, PLONK, STARK, and recursive proofs are future work, not current production claims.
Customer or case data is entered by the organization.
Sensitive inputs stay out of the public proof.
The policy is applied without revealing thresholds or formulas.
A ZK proof confirms the private policy was satisfied.
The public package contains commitments, checks, and a hash.
Anyone can recompute the hash and verify the package was not changed.
Measured locally with the checked-in Groth16 blind-policy proof fixture. This measures package creation, hash recomputation, receipt verification, and Groth16 verification, not full witness generation.
Used as the PrivateDAO proof workflow reference path for customer-ready verification.
Mapped as a reusable proof trail for approvals, decisions, and audit-ready receipts.
Prepared for fintech, grant, treasury, compliance, and review workflow pilots.
Connected to the checked-in Groth16 circuit and verification artifacts for reviewer inspection.
Prove underwriting or credit-limit checks happened without exposing earnings or thresholds.
Prove required checks were completed without exposing documents or review notes.
Prove eligibility and review policy were followed without exposing reviewer scoring.