Where data lives

Umbra's data is split between the chain, off-chain archives and your device. Only the chain is replicated by Solana; everything else depends on whoever operates it.

The chart below shows where a value transaction's data goes once it lands. The chain keeps the state a proof checks against. The data endorser's archive keeps the encrypted notes, which never touch the chain. The indexer joins the two and serves them to devices. The relays in front of the guardian nodes and the fee enclave keep the escrow copies those enclaves return.

flowchart LR
T["Transaction"] --> A["Pool accounts"]
T --> L["Program logs"]
E["Endorser archive"] --> I["Indexer"]
L --> I
I --> D["Your device"]
R["Enclave relays"] --> W["Escrow archives"]

What this meansCopy Anchor Link

The chain is enough to check, not enough to receive. A tree account keeps only its frontier and its 512 most recent roots, and the program writes each new leaf to its logs. Everything a proof needs can therefore be rebuilt from Solana's history. Encrypted notes are different: the chain holds only the memo digest that binds them, and the notes themselves live in the data endorser's archive. If the archive lost a note's encrypted copy, its recipient could not find or spend it. That is why the data endorser must sign every value transaction: its signature says it has archived the notes the transaction commits to.

Your device holds a cache. In Umbra's clients your keys derive from your account signature, and your notes and history can be found again by rescanning the published notes. Losing your device loses nothing a rescan cannot rebuild, as long as the archive is available. See recovery.

The escrows are written once. The relays in front of the guardian nodes and the fee enclave store each escrow copy in an archive that cannot be overwritten. Each escrow is sealed under a key derived from the sealing enclave's own secrets, so only that enclave service can open it. The fee openings are what lets the treasury collect fees.

RelatedCopy Anchor Link