How Shield Works: a Programmable Privacy Bridge on Aztec, Built on Clean SDK

Shield is human.tech's programmable privacy bridge on Aztec. It gives you transparent accountability without sacrificing privacy. It moves tokens between Ethereum and Aztec while letting you choose how visible each transaction is.

Shield is the first app built on Clean SDK, human.tech's programmable privacy toolkit. Clean SDK packages the personhood checks, sanctions screening, and zero-knowledge circuits behind Shield. Any app, anywhere, can integrate it. An Arbitrum app, or an app on any chain, can use Clean SDK to give its users private, accountable transactions by routing funds through Aztec. Aztec is what makes this possible, and builders do not have to build any of it from scratch.

This post walks through what happens under the hood. How the bridge works, how the two privacy modes differ, and how Shield stays accountable without ever storing plaintext identity data.

Shield is the first programmable-privacy solution that balances privacy and accountability at the same time. Nothing quite like it exists yet.

What is Aztec?

Aztec is a privacy-focused Ethereum Layer 2. Developers write smart contracts in Noir, a zero-knowledge language that gives fine-grained control over what data stays private and what stays public.

• Client-side execution: transactions run locally on your device. You generate the proof, then submit it. Your transaction logic executes privately before anything touches the chain.
• Hybrid state: private state lives in encrypted note commitments that only you can read. Public state works like Ethereum, transparent and shared. Both can exist in the same contract.
• Rollup model: Aztec batches transactions and posts compressed proofs to Ethereum, so nodes verify proofs instead of re-executing every transaction.

Shield is an implementation of the Aztec Portal, a message-passing interface that moves funds between Ethereum and Aztec and handles the cross-chain messaging and asset custody underneath.

How a transfer works

Ethereum to Aztec (deposit). You send tokens to a Portal contract on Ethereum. The Portal locks your assets and sends a message to Aztec, where equivalent tokens are created and claimed by your wallet. They arrive as standard tokens in public mode, or as "Clean" assets such as cUSDC in private mode. Your originals stay locked in the Portal as collateral.

Aztec to Ethereum (withdrawal). You burn your Aztec assets. Aztec generates a cryptographic proof of the burn, that proof is verified on Ethereum, and the Portal releases your original tokens.

Every asset on Aztec is backed 1:1 by real funds in the Portal. Withdrawals happen only after a verified burn. Nothing is created from thin air.

Public and private mode

Shield runs in two modes: public and private.

Public mode keeps transactions transparent on both Ethereum and Aztec. It suits users who want lower fees and programmable contracts without privacy, or organizations that need transaction visibility for accounting or regulatory reasons.

Private mode moves tokens into Aztec's private layer. While your assets are on Aztec, your balance and transaction history stay confidential. Exits are verified and screened again before funds leave the private layer.

Private mode does not change what happens on Ethereum. The deposit and withdrawal are public on-chain in both modes, with the address and amount visible on Etherscan. What private mode shields is your activity on Aztec.

Every transaction is screened regardless of mode, at both entry and exit. Choosing a mode changes what is visible. It never changes whether the rules apply.

Choosing a mode

• A business paying salaries can bridge privately and identity-verified, so individual payroll amounts stay confidential while on Aztec, then exit publicly when it needs an auditable record for accounting.
• A DeFi user can keep their balances on Aztec confidential from front-runners and competitors.
• An organization with reporting obligations can stay in public mode end to end and keep a fully transparent trail.

Why accountability, and why it makes privacy durable

Open blockchains are traceable and transparent by default. Once your transactions are public, it is difficult to close your exposure, especially while keeping the option to be transparent when you choose to be. Shield gives you programmable privacy, so you can transact on your own terms while signaling accountability that deters bad actors.

That accountability is not a tax on privacy. It is what makes the privacy durable. A private pool that anyone can abuse becomes a target for regulators and a magnet for illicit funds. A private pool where every participant is screened and unique stays trustworthy for everyone in it. Shield delivers this by screening every transaction, public or private, at both entry and exit.

How the checks work

Every transfer clears two kinds of check. One runs on the wallet. One proves a unique person is behind the transfer, and the amount decides which proof applies.

Proof of Innocence

Proof of Innocence screens the wallet against sanctions, PEP, and watchlist sources through sanctions.io. Shield screens against 23 data sources including OFAC, FATF, FinCEN, Interpol, and PEP lists, to confirm the wallet does not appear on any of them. This runs on every transaction, on the way in and on the way out. A wallet clean at entry can appear on an updated list later, so re-screening at exit is what keeps the check meaningful over time.

Proof of uniqueness and Proof of Clean Hands: the $1,000 line

Proof of Innocence confirms the wallet is clean. Personhood confirms a real, unique human is behind it. The amount decides which personhood proof is required.

Under $1,000: no KYC. A user can transact up to $1,000 with a clean wallet (Proof of Innocence) plus a proof of uniqueness. The uniqueness proof is a Human Passport score above 20, checked from api.passport.xyz. It ensures a single user can never move more than $1,000 over a rolling period, even by splitting the amount into many small transactions. No government ID is involved at this level.

Over $1,000: ZK KYC, which is Proof of Clean Hands. This is a client-side zero-knowledge proof that the user holds a valid government ID and does not appear on sanctions lists. During that verification the user also proves their data is available for decryption if the observer (Holonym Foundation) receives a valid court order and the Human Network accepts the request. The proof reveals none of the underlying personal data. It only proves the facts: a valid ID, a clean record, a unique person.

This mirrors international anti-money-laundering standards, where you can transact without KYC up to a threshold as long as the wallet is clean and unique. Below the line, a uniqueness check with no ID. Above it, a government-ID zero-knowledge proof.

Why verify identity for large transfers

Address screening alone is reactive. A fresh wallet sidesteps a denylist the moment it is created, and off-chain realities like a court order cannot be enforced against funds already inside a pool by address filtering alone.

Enterprises operate across jurisdictions and have to meet legal requirements, including Travel-Rule-style thresholds on larger transfers. For them, screening the address is necessary but not sufficient. Binding a verified identity to large transfers is what lets an institution use a private layer while meeting its obligations. Shield keeps small, clean, unique transfers frictionless, and attaches identity to the transfers where regulators expect it.

How disclosure works

Proof of Clean Hands proves your identity data is available for lawful disclosure. It does not give that data to anyone at the time of the transaction. Disclosure is condition-gated, and it takes cooperation from more than one party to happen at all.

Here is the flow:

1. A legal authority serves a legally binding request.
2. Holonym Foundation, the v1 observer, assesses it.
3. If the request is valid, Holonym asks the Human Network for a decryption through a smart contract.
4. The smart contract judges the request. If it is valid, the Human Network permits decryption of that one specific record, and nothing else.
5. Decryption releases only that one record, and only after the on-chain conditions contract approves the request.

At launch, the network side of that flow is a single decryptor authorized by the on-chain conditions contract: the contract must approve a request before that decryptor can act, so disclosure is never automatic and never something the observer can force on its own. Where the Human Network is decentralizing to is a threshold of independent nodes, where no single node holds the full key and several must agree before any data is revealed. The design goal is the same at every stage: fewer things any single party can do alone.

The trust model, stated plainly:

• Your data stays protected as long as the conditions contract holds and Holonym does not collude to request an improper decryption. As the network decentralizes, that protection spreads across a node threshold that would also have to collude.
• Holonym can never decrypt anyone's data on its own, because it needs the network to act and the conditions contract to approve.
• No plaintext PII sits at rest; identity data is threshold-encrypted at issuance, so there is no plaintext honeypot to breach or subpoena.

This is the starting point, and the roadmap goes further in one direction: reducing how much you have to trust any single party, and adding deliberate friction to the disclosure path itself.

The observer role decentralizes. In v2 the single foundation becomes a redundant layer of independent legal fiduciaries, each bound to defend the user, each judging a request on its own merit. A valid disclosure then requires several independent bodies to agree, not one. That bureaucracy is the point. Every added party and every added step is friction against an improper request. It raises the cost of forcing a disclosure and lowers the cost of refusing an overreaching one. Replacing one legal body with several is what turns a trusted observer into a checked-and-balanced one, and the goal is always fewer things any single party can do alone.

What sets Shield apart

Most on-chain privacy tools either have no screening path at all, or screen at the token and address level, checking deposits against lists of known-illicit addresses. That approach is reactive, and it only ever sees the address, never the person behind it.

Shield screens people, not just tokens and addresses. The differences add up:

• It screens both sides. Entry and exit, not just entry.
• It combines two kinds of check. A sanctions screen plus a government-ID zero-knowledge proof for large transfers.
• Disclosure is condition-gated. It requires the observer and the network to move together, gated by an on-chain conditions contract, rather than being automatic or enforceable on-chain by any single party.
• It is programmable and portable. Clean SDK makes the same private, accountable transactions usable from any app on any chain.

Shield's combination of two-sided screening, personhood proofs, and condition-gated disclosure is what sets it apart. Privacy stays the default for everyone who follows the rules.

Security

Shield is designed so there is no plaintext honeypot for an attacker to go after.

• No plaintext personal data at rest. Identity data is protected with threshold cryptography during verification. Nothing readable in plaintext is stored on a server.
• Disclosure needs more than one party. It requires the observer (Holonym Foundation) and the Human Network to move together under an on-chain conditions contract, so there is no single key to steal or subpoena.
• Collateralized custody. Portal contracts physically hold your Ethereum assets, so every Aztec asset is backed 1:1 by real funds.
• Cryptographic verification. All cross-chain messages use zero-knowledge proofs, and withdrawals release funds only after a verified burn.
• Independently audited. Shield's smart contracts, its zero-knowledge circuits, and the Human Network have all been independently audited. The Nethermind Security review of the contracts (NM-0756) and Halborn's review of the Human Network's threshold cryptography are both public. All code is open source.

Shield is live on Aztec v5 as an Aztec launch partner.

Getting started

Prefer to try without real funds? Everything below also works on the public testnet.

1. Read the user guide if you want the full walkthrough first.
2. Visit shield.human.tech.
3. Connect your Ethereum wallet and an Aztec wallet (Azguard), then choose your asset (starting with USDC) and amount.
4. Pick public or private mode for entry and exit.
5. Complete verification. Every transfer requires it, in any mode. A Human Passport check (no KYC) lets you bridge up to $1,000; full Proof of Clean Hands lets you bridge larger amounts.
6. Confirm, and Shield handles the cross-chain messaging end to end.

If you are building an app, on Aztec or anywhere else, Clean SDK is how you bring the same private, accountable transactions to your own users. Install @human.tech/clean.sdk and start with the docs.