← Back to Home

How Zero-Knowledge Proofs Work

A simple explanation of how we verify CRM data without exposing it

What We Prove About Your CRM

Our system proves statements about your CRM data without revealing the data itself:

Demo: "Account is older than 30 days"

Verifier learns: Yes/No
Verifier does NOT learn: Exact account age, creation date, or any other data

Future: Any CRM metric: deals, revenue, contacts...

Examples: "total deal value > $10K", "closed deals > 5", "contacts > 100", etc.

How The Process Works

1

You Connect to CRM

Enter your CRM credentials (Salesforce, Autotask, etc.)

Complete isolation — this app will run in an iframe. Your credentials and data live only in this isolated context, never stored in the parent application or browser storage.
↓
2

Browser Establishes Encrypted Connection

When you click "Connect", your browser uses a Rust TLS client (compiled to WebAssembly) to establish a secure connection to the CRM API. Your credentials are encrypted inside the browser before being sent.

Our server is a "blind relay" — it only forwards already-encrypted bytes. It never sees your credentials, API requests, or responses. The TLS handshake happens entirely in your browser.
↓
3

Data Decrypted & Extracted (In Browser)

CRM response is decrypted in your browser. The specific value needed for proof (e.g., account creation date) is extracted.

Data never leaves your browser — decryption happens locally, raw CRM data is never sent anywhere.
↓
4

ZK Proof Generated (WASM)

Barretenberg prover (compiled to WebAssembly) runs the Noir circuit and generates a cryptographic proof — all in your browser.

Proof proves the statement without revealing data— e.g., proves "account age > 30 days" without revealing the actual age (45 days).
↓
5

Proof Sent to Parent App

Only the proof (~2KB) and verification result are sent to the parent app via postMessage.

Fully transparent — you can inspect exactly what is sent: proof bytes, public inputs (threshold, operator), and verified: true/false. No private data included.
↓
6

Session Ends — Data Destroyed

When the iframe closes, all data is destroyed. Credentials, tokens, CRM responses — everything is gone.

No persistence — nothing is saved to disk, localStorage, or cookies. Each session starts fresh.

Why No Secret Keys?

Traditional cryptography needs keys to encrypt/decrypt. But ZK proofs are different — they use mathematical constraints, not encryption.

How it works without keys:

1. Circuit = Rules

We define a "circuit" — a set of mathematical rules. Our circuit says: "Check if value > threshold". This circuit is public — anyone can see it.

2. Proof = Solution

When you generate a proof, you're solving a complex math puzzle that can only be solved if your statement is true. The puzzle is designed so the solution doesn't reveal your input.

3. Verification = Check

Anyone can verify the proof by checking if the solution fits the puzzle. This is fast and doesn't require knowing your private input.

What about the "Trusted Setup"?

Some ZK systems need a one-time ceremony to generate secret parameters. If those secrets leak, proofs can be forged.

We use UltraHonk— a modern proving system with a "universal and updatable" setup. The setup was done by Aztec Protocol with contributions from many parties. The result is embedded in our prover (Barretenberg WASM) — no ceremony needed on your end.

Security Guarantees

Zero-Knowledge

Verifier learns only that your statement is true. They cannot extract the private value, account details, or any other data.

Soundness

You cannotcreate a valid proof for a false statement. If account age is 25 days, you cannot prove it's > 30 days.

Succinctness

Proof is tiny (~2KB) regardless of how complex the computation is. Verification is instant.

Browser-side TLS

Your CRM credentials are encrypted in your browser using Rust/WASM. Our server only sees encrypted bytes — never plaintext.

Technical Stack

Noir

Domain-specific language for ZK circuits. We write the comparison logic in Noir.

noir-lang.org →

Barretenberg

SNARK prover from Aztec Protocol. Runs in browser via WASM. Uses UltraHonk.

GitHub →

Rust TLS (WASM)

Browser-side TLS using rustls compiled to WebAssembly. Server never sees plaintext.

apps/zk/tls-client/

Circuit: "comparison"

Our Noir circuit supports 5 operators: >, <, ≥, ≤, =. Compiled to ~50KB JSON.

apps/zk/circuit/src/main.nr

Frequently Asked Questions

Can you see my CRM data?

No. All CRM connections happen through encrypted tunnel where our server is a blind relay. TLS encryption happens in your browser using Rust/WASM — we never see the plaintext.

Can you extract my data from the proof?

No. This is mathematically impossible. The proof only contains enough information to verify the statement is true — not to reconstruct the input.

What if someone intercepts the proof?

The proof itself doesn't contain the result— it's just cryptographic data (~2KB). Anyone who receives the proof must run verification to know if it's valid. We send both proof + pre-verified result for convenience (so Platform doesn't re-verify each time), but the proof can always be independently verified.

Why is there no key I need to manage?

ZK proofs use public circuits (rules) and mathematical puzzles, not encryption keys. The "setup" needed for UltraHonk was done by Aztec Protocol and is embedded in Barretenberg — you get the security without managing keys.

Is this production-ready?

This is a Proof of Concept demonstrating the technology. The cryptographic primitives (Noir, Barretenberg) are production-grade and used by Aztec Protocol for real financial applications.

Ready to Try It?

Generate a zero-knowledge proof of your CRM data

Try with Autotask Try with Salesforce