Privacy and data minimization
clearproof explores reducing disclosure by separating verification of specific predicates from encrypted exchange of required personal information. This is an architectural objective, not a GDPR exemption or a compliance certification.
Encryption and proofs have different roles
A proof can establish its encoded statement without exposing every private witness value. Encrypted personal information can travel to an authorized recipient. The recipient may still need to obtain, verify and retain information under applicable requirements.
For covered EU crypto transfers, the Transfer of Funds Regulation sets information and missing-information obligations. An amount tier does not define a blanket exemption from those obligations. EU Regulation 2023/1113, Articles 14–17
Encrypted personal data remains personal data. Keeping it off-chain and limiting disclosure must be considered alongside purpose, access, retention and governance. EDPB Guidelines 02/2025, final version 2, July 7, 2026
What remains visible
A current pilot-transfer-v3 proof publishes eight values: a commitment to the transfer and credential, the authorized-issuer and sanctions roots, a nullifier, the evaluation and expiry times, and the chain and registry it is bound to. The amount, tier, wallets, jurisdiction and participants stay private. See circuits.
Commitments, nullifiers and timestamps are still not automatically anonymous. Linking them to other records, on-chain transactions or retained evidence can identify or correlate people. The legacy 16-signal demo circuit publishes more, including an amount tier, jurisdiction and a tier-derived review flag; do not use it where that metadata matters.
Deployment questions
- Which facts actually need a private predicate proof?
- Which recipient is authorized to receive each piece of information?
- How are credentials, source data and recipient keys authenticated?
- What can repeated commitments, timestamps and status checks reveal?
- How are retention, access, deletion, incident handling and evidence export implemented?
Measure disclosure and operational data copying in the intended deployment. Neither encryption, ZK, nor explorer verification independently establishes compliance.
Read current assurance limits.