> For AI agents: the documentation index is at https://docs.umbraprivacy.com/llms.txt, and every page is available as Markdown at its URL with .md appended.

# Trusted setup (/docs/security/trusted-setup)

The six Groth16 verifying keys compiled into the shielded pool, one each for the transaction, nullifier-freshness, registration, batch-append, fee-collection and escape-hatch circuits, were produced by a multi-party trusted-setup ceremony. As with any Groth16 setup, their soundness depends on at least one participant in each phase acting honestly and destroying their secret contribution. If every participant in either phase colluded or kept their contribution, they could make proofs that verify without a witness. The escape hatch needs nothing but such a proof, so a compromised escape-hatch key could withdraw from the pool token accounts with no attester involved.

## Related

- [Governance and upgrades](https://docs.umbraprivacy.com/docs/security/governance): Who can upgrade the program, and with it the verifying keys.
- [Zero-knowledge proofs](https://docs.umbraprivacy.com/docs/cryptography/zero-knowledge-proofs): Groth16 and what its keys do.


Last updated 12 October 2026