> For AI agents: the documentation index is at https://docs.umbraprivacy.com/llms.txt, and every page is available as Markdown at its URL with .md appended.

# Zones (/docs/zones)

A zone is a numbered compartment of the pool. Its notes can be spent, and notes can be created in it, only with a signature from the zone's own signing key, and the proof checks that signature without the chain learning which zone a transaction touched.

## What a zone is

Every note carries a zone number. Zone 0 means no zone: its notes move freely, with no zone signature. Any other zone belongs to whoever runs it, through two keys: a zone authority, a Solana key that manages the zone in the zone registry, and a zone signing key, whose signatures the transaction proof checks.

## What a zone controls

A zone signs for its own side of every movement across its boundary, so it controls both what leaves it and what enters it.

- **Within zone 0**, no signature is needed.
- **Within a zone**, spending its notes into notes of the same zone needs that zone's signature.
- **Out of a zone**, into zone 0 or out of the pool through a withdrawal, needs the zone's signature.
- **Into a zone**, whether by deposit or from zone 0, needs the receiving zone's signature.
- **Between two zones**, both sign: each authorises only its own side, so neither can move notes across alone.

Each signature covers exactly one transaction. Every real note a transaction spends must come from one zone.

## What stays private

The zone number, the signing key and the signature are all private inputs to the proof. The chain sees only which version of the registry's list of zone signers the proof was checked against, so it cannot tell which zone a transaction involved, or whether it involved one at all. A zone's signer does recognise the transactions it signed. It learns note contents only when the sender chooses to open them to it; see [disclosure](https://docs.umbraprivacy.com/docs/disclosure).

## Lifecycle

Anyone may apply to run a zone. Governance approves an application through a timelocked proposal, and the zone receives the next number. After that, the zone authority manages its own zone: it can rotate the signing key, hand the zone to a new authority or freeze the zone, and each such change waits a delay the zone chose for itself.

A frozen zone's notes cannot move through a normal transaction until it is unfrozen. If a zone's keys are lost, a recovery can replace them after the zone's own recovery delay, and the current zone authority can veto it. Governance can revoke a zone for good, and its number is never reused.

The notes of a frozen or revoked zone can still leave through the [escape hatch](https://docs.umbraprivacy.com/docs/operations/escape-hatch), which checks no zone signature and publishes the note it takes out.

## Who controls what

Governance approves and revokes zones and sets the registry's parameters, all through timelocked proposals. It cannot sign for a zone, and it cannot freeze one; freezing is the zone's own act. See [governance and upgrades](https://docs.umbraprivacy.com/docs/security/governance).

## Related

- [Screening](https://docs.umbraprivacy.com/docs/screening): The public checks every value transaction passes.
- [Disclosure](https://docs.umbraprivacy.com/docs/disclosure): How a sender opens chosen fields to a zone.
- [Private Send](https://docs.umbraprivacy.com/docs/operations/private-send): Where zone signatures are collected.
- [Governance and upgrades](https://docs.umbraprivacy.com/docs/security/governance): Who approves and revokes zones.


Last updated 12 October 2026