Why Stellar — and how the trust actually works.
The rail, the escrow, and the on-chain proof behind Transparency Seal — with real transactions you can watch settle, live.
The right rail for moving relief money.
Escrow without smart-contract risk
Stellar has claimable balances as a native primitive — a protocol-level escrow. No custom Solidity to audit, no re-entrancy bugs. The rails are the guarantee.
Seconds, and sub-cent fees
A donation settles in 3–5s for a fraction of a centavo — so 100% of a ₱50 gift arrives, unlike remittance/platform cuts that eat 5–10%.
Stablecoin now, pesos next
Donations settle in USDC today (dollar-stable). Once a BSP-licensed peso stablecoin (PHPC) is live on Stellar, path payments convert PHP↔USDC atomically — donors never touch "crypto".
Non-custodial by construction
The donor signs locally; funds go to a protocol escrow only the org can claim. We never hold a key or a balance.
Proven humanitarian rails
The same Stellar disbursement stack is used by UNHCR and IRC to move aid to beneficiaries — this is a paved road, not an experiment.
Public, permanent proof
Every donation and payout is a transaction anyone can verify on a block explorer, forever — the receipt is the ledger.
How does a gov org claim — securely?
Two separate proofs are needed: (1) the escrow guarantees only the org's key can claim — that's cryptographic. (2) Proving that key truly belongs to the accredited org — that's the real work. Email starts it; cryptography closes it.
A donation creates a Stellar claimable balance with two claimants: the org (claim anytime) and the donor (reclaim only after 30 days). The platform is not a claimant — we mathematically cannot take it. So “only the org can claim” is a protocol guarantee, not a promise.
new Claimant(orgWallet, predicateUnconditional()) // org: claim anytime
new Claimant(donor, not(beforeRelativeTime(30 days))) // donor: reclaim after 30d…but that only means something if the wallet is really the org’s. Here’s how we bind a wallet to an accredited org — strongest to weakest:
DSWD attests the wallet
The accreditor itself signs / publishes the mapping "accreditation SB-A-00013 → wallet G…". Ties the wallet to the government source of truth. (This is "Ask 1" of our ask.)
Domain proof (SEP-0001 stellar.toml)
The org publishes its Stellar address at https://their-official-domain/.well-known/stellar.toml. Only they control that domain — so it binds domain → wallet.
Wallet-signed challenge
The org signs a one-time nonce with the wallet’s private key. This proves they hold the key — not just that they can send an email.
Official email — the start, not the proof
We reach out via the org’s DSWD-registered contact to begin onboarding. But email alone is spoofable — it is never the proof. It must be paired with a domain or signed-key check above.
How does DSWD attest — and does it co-sign every payout?
DSWD attests by signing the mapping once — a signed record (or an on-chain entry) that says “accreditation SB-A-00013 → wallet G…”. That’s an attestation, not a signature on every transaction. Two models sit on top of it:
The org self-custodies and signs its own claims. DSWD signs once (the accreditation mapping) and is not a signer on payouts. Maximum org autonomy; DSWD vouches for identity only.
The org account is 2-of-3 multisig (org + DSWD + platform). Here DSWD is a required signer — best applied as a threshold: small claims org-only, large disbursements need DSWD to co-sign. Stronger oversight, at the cost of DSWD being online to sign.
Either way, the platform is never a sufficient signer — so we can’t move a single peso. That’s the whole point.
Honest status: in this demo the org wallets are assigned by us. The domain + signed-key + DSWD-attestation flow above is the production design — it’s what turns the seal from “trust us” into proof.
Real transactions, right now.
On-chain activity for the demo's funded accredited-org accounts, streamed from Stellar Horizon. Not a mock — click any row to verify it on the public explorer.
Reading the ledger…
Polled live from Horizon every 6s · click any row to verify it on stellar.expert.