How ShieldCard Enforces
Confidential Policy
Three stages. One policy. No plaintext.
Encrypted Policy Evaluation
When an employee submits a spend request, their browser encrypts the amount using Fhenix CoFHE before the transaction is signed. The plaintext never leaves their device.
ShieldCardControlPlane evaluates the request entirely on ciphertext: FHE.add accumulates the running budget, FHE.lte compares against limits, FHE.and combines conditions, and FHE.select routes to auto-approve, review, or deny. The contract never sees a plaintext number.
Request flow
Request lifecycle
Settlement and Audit Trail
Approved requests move to ShieldCardSettlement. High-risk or high-value requests require multi-approver sign-off before settlement executes. Settlement transfers testnet MockUSDC to the recipient.
Each settlement commits the previous receipt hash, forming a tamper-evident chain. Anyone can verify any receipt at /verify — no wallet required.
Scoped Auditor Access
The admin grants an auditor FHE.allow permission on specific request ciphertexts. The auditor can decrypt only those requests using their own wallet permit — nothing outside their granted scope is accessible.
Budget compliance can be proven without revealing any amount. The ShieldCardBudgetAttestor computes a boolean comparison over encrypted budget usage and reveals only YES or NO.
Observer View
Auditor View
Ready to deploy for your team?
Three contracts. One-click deployment on Arbitrum Sepolia.