> For AI agents: the documentation index is at https://docs.umbraprivacy.com/llms.txt, and every page is available as Markdown at its URL with .md appended.

# Trust assumptions (/docs/security/assumptions)

Umbra is built so that no single party can take your funds, and so that the parties who could stop you or read you are few and named. This page sets out what you rely on, who holds which power, and what no one can do.

## For your funds to be safe

- **The circuits are correct.** A note can be spent only with a valid zero-knowledge proof, and the circuits decide what such a proof shows. Their key properties are proven over hand-written models; see [audits and verification](https://docs.umbraprivacy.com/docs/security/audits).
- **The cryptography holds.** The hash functions, the proof system and the signatures rest on standard assumptions; see [security levels](https://docs.umbraprivacy.com/docs/cryptography/security-levels).
- **The program upgrade authority acts in good faith.** Whoever holds a program's Solana upgrade authority can replace its code at once, with no delay. This is the one power above everything else on this page; see [governance and upgrades](https://docs.umbraprivacy.com/docs/security/governance).
- **Your keys stay yours.** Your device holds your keys and makes your proofs. Whoever controls it, or obtains your keys, controls your account.

## For your activity to stay private

- **The enclaves run what they claim.** The guardian nodes and the fee enclave run in AWS Nitro enclaves, whose attestations the chain checks. AWS's hardware and root of trust are assumed, and so is the enclave code doing what it should.
- **The indexer's operator does not misuse what it sees.** When you spend, the indexer learns which notes you are spending and your identity commitment.
- **Note encryption holds.** Your notes are encrypted with ML-KEM-768, which is post-quantum.

## For the protocol to keep working

- **Every attester is online.** Each value transaction needs all six attesters: the three guardian nodes, the screener, the fee enclave and the data endorser.
- **A forester runs**, moving spent-note records into their tree so spending can continue.
- **The note archive is available**, so recipients can find their notes.
- **Solana is live.**

When an attester is unavailable, the [escape hatch](https://docs.umbraprivacy.com/docs/operations/escape-hatch) lets you take a note out without the attesters. It still needs room in the staging buffer, the tree data and Solana itself; [liveness](https://docs.umbraprivacy.com/docs/security/liveness) explains what stops and what does not.

## Who holds which power

- **Guardian nodes** co-sign every transaction. Any one can stop transactions. None can move funds.
- **The screener** checks the public parties of each transaction and can refuse to sign. It never sees inside the pool.
- **The fee enclave and the data endorser** co-sign every value transaction and can stop them by not signing.
- **The indexer** serves the data your client needs to build a spend, and sees which notes you spend.
- **A relayer** submits your transaction. It cannot change it, and you can submit it yourself instead.
- **A zone authority** signs for notes entering and leaving its zone, and can freeze its own zone. Zone 0 needs no signature.
- **Protocol governance** changes settings through public, timelocked proposals. It cannot move a note or pooled tokens, change which proofs the pool accepts, or read anything.
- **The program upgrade authority** can replace a program's code at once, and with it any rule.

## What no one can do

- **Spend your notes without your keys.** Every spend needs a proof made with keys only your account has.
- **Recover a lost account for you.** In Umbra's clients your keys come from your wallet; without it, nobody, Umbra included, can rebuild them.
- **Make the public side of a deposit or withdrawal private.** Tokens cross between a public account and the pool there, so that side is on the public record.
- **Spend a note after its validity window closes**, by any path.
- **Hide your network address.** The relayer, Umbra's gateway and your RPC provider see where your requests come from.
- **Make a small pool large.** Privacy depends on how many other notes yours cannot be told apart from, and early on there are few.

## Related

- [Governance and upgrades](https://docs.umbraprivacy.com/docs/security/governance): What governance can and cannot change.
- [Liveness](https://docs.umbraprivacy.com/docs/security/liveness): What stops when a part is down.
- [Known risks](https://docs.umbraprivacy.com/docs/security/risks): The risks the code carries today.
- [Guardian nodes](https://docs.umbraprivacy.com/docs/guardian-nodes): What the guardians can and cannot do.


Last updated 12 October 2026