Stablecoin payment privacy: Tempo Zones now hide payroll and treasury — a merchant's sales on a public chain are still an open book

What Tempo shipped on October 14, 2026

On Wednesday, October 14, 2026, Tempo published “Privacy is live on Tempo”. Tempo is the payments-focused blockchain incubated by Stripe and Paradigm, on mainnet since March 2026. The announcement opens with one sentence: “Tempo Zones let enterprises keep customer stablecoin balances and payments private, with built-in compliance controls and full access to Tempo's global liquidity.”

The audience is explicit. Zones “are now available for enterprises running payroll, contractor payouts, B2B payments, and treasury on stablecoins.” Wallet providers Privy and Bridge support them natively, so a business can add a Zone through APIs it may already use.

The first production user is Deel, the payroll platform for 40,000+ businesses in 150 countries. Deel launched a stablecoin wallet on Tempo in June 2026, starting with contractors in Argentina, and expanded it to 80+ countries in August. With a Zone, Deel's treasury deposit is visible on Tempo. Which contractors get paid, how much each receives and what they hold are not. “Workers' financial data should be private by default,” said Thierry Edde, Head of Crypto at Deel. “Sensitive information such as salaries, balances, and payout history doesn't belong on a public ledger.”

How a Zone works

Tempo first described Zones on April 16, 2026, in “Introducing Tempo Zones”. The design has four parts worth knowing:

• A private chain beside the public one. A Zone is “an EVM-compatible private chain that runs in parallel to Tempo Mainnet.” Each Zone has an operator that builds blocks and confirms transactions.
• No custody by the operator. Funds sit in a Zone contract on mainnet. “The operator cannot transfer a user's funds to another party.”
• Full visibility for the operator. “The operator can see all activity within the zone between addresses.” It “can also suspend a user's ability to transfer or withdraw funds based on its own compliance rules.”
• Edges stay public. On a deposit, “the token, amount and sender are visible on Tempo Mainnet”; the recipient is encrypted. On a withdrawal, the amount and destination are visible; the sender inside the Zone is hidden.

Issuer controls travel too. As Bitcoin.com News reported from the April launch: “When an issuer updates a blocklist or freezes a token on Mainnet, every zone enforces the change without a separate configuration step.” A Zone is private from the public. It is not private from the operator, and it is not outside the issuer's reach.

The leak Tempo named: merchant volume

In its companion post, “Privacy on Tempo”, Tempo explains why it built Zones. Two examples carry the argument: “A company running payroll would publish every salary,” and “A payment processor settling with merchants would leak confidential volume data on every onchain transaction.” The same post dismisses pseudonymity as a fix, because transaction patterns let observers link addresses to identities.

None of this is new. Section 10 of the Bitcoin whitepaper said it in 2008. Public chains keep privacy only “by keeping public keys anonymous”: “The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone.” Then comes the caveat: “The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner.”

A merchant is the one participant whose key owner is revealed by design. You show your receiving address to every customer, because that is how they pay you. Anyone who pays you once — a regular, a competitor buying a single coffee, a supplier settling a refund — learns the address. From there, a free block explorer shows the rest.

What a stablecoin receipt reveals about your business

Here is what anyone who knows your receiving address can read, today, on Ethereum, Base, Solana, Polygon or any other public chain:

1. The address and the network you get paid on.
2. Every incoming payment: amount, token, timestamp and the payer's address.
3. Your balance in that wallet, at any moment, and how long you leave money there.
4. Everything that leaves the wallet: sweeps to other wallets, supplier payments, payouts and payroll — with amounts and destinations.

From those four lines, a patient observer can estimate your daily revenue, average ticket, busiest hours, share of repeat customers (the same payer address coming back) and who you pay. That is the confidential volume data Tempo was writing about.

What stays off the chain is everything you don't write onto it: the customer's name, what they bought, the invoice number, which cashier rang the sale. As we noted when SAP started paying invoices in USDC, a plain stablecoin transfer carries no invoice reference at all. That is a headache for reconciliation and a small mercy for privacy.

Who actually reads it — and when it costs you

Be honest about the stakes first. For a café or a hair salon, the fact that a stranger could tally your weekly takings is mostly harmless. Your street already knows how busy you are.

It gets more expensive in other shapes of business:

• A B2B supplier with a few large clients. If one client knows another client's wallet, it can see what that client pays you. Pricing confidentiality ends at the explorer.
• A marketplace or agency paying sellers and freelancers. Payouts from one wallet show every recipient what the others earn.
• An employer paying staff on-chain. Salaries become public to anyone who links the payroll wallet. That is exactly the problem Deel paid to solve.
• A business with a visible balance. A wallet that publicly accumulates is a target. In the Ledger CryptoBilis case, the attacker watched compromised wallets and waited for balances to grow before striking.
• A company in a negotiation. Suppliers, landlords, buyers and would-be acquirers can do part of their diligence from your address before you share a single statement.

Stablecoin payment privacy has always been bought with an intermediary

The Bitcoin whitepaper describes the old model plainly: banks achieve privacy “by limiting access to information to the parties involved and the trusted third party.” Card payments work this way. The public sees nothing; your acquirer, the card network and the issuer see everything, and the acquirer holds your money for days.

Custodial crypto processors follow the same pattern. Your customers pay into the processor's wallets, so your receipts disappear into its pooled flows. The public loses track of you. The processor doesn't, and it holds the balance until you withdraw.

Zones are new because they split the two jobs. The operator sees without holding. But it keeps a pause button, and that is the honest price of this kind of privacy.

Read across the rows and the choice becomes clear. No column gives you privacy from everyone, custody of your own money and nobody able to pause it. You pick which two matter most.

Why privacy reached payroll before the checkout

Deel's case fits a Zone neatly. There is one payer with one treasury. Deel deposits once — a visible event — and fans the money out to thousands of contractors inside the Zone, privately. The enterprise controls the setup at both ends.

A checkout is the opposite shape. Thousands of customers arrive from their own wallets, on whichever network they happen to hold dollars: Base, Solana, Polygon, Ethereum, BNB Chain. For a sale to be private end to end, the customer's money would already need to be inside a Zone on the same chain. A customer depositing into one to pay you would still show their address and the amount on mainnet. Your side would be hidden; theirs would not.

That makes Zones a treasury and payroll product first. We saw the same pattern when Solana scheduled Confidential Balances alongside Transaction V1: amounts can be hidden, but token account addresses stay public. Privacy keeps arriving for the institution paying out, and only later — if at all — for the business being paid.

A stablecoin payment privacy checklist for merchants

You don't need to wait for a privacy layer to reduce what strangers can read. Six practical steps work on any public chain today:

1. Assume your receiving address is public. Every customer sees it. Plan on that basis instead of hoping nobody looks.
2. Separate wallets by role. One wallet receives customer payments, a different one holds treasury, a third one pays out. A leak or a curious observer then reaches one slice of your business, not all of it.
3. Sweep on a schedule. Move receipts out of the receiving wallet regularly so its visible balance stays small. Sweeps are traceable, so treat this as friction for casual observers, not secrecy from a determined one.
4. Keep business data off-chain. Order numbers, customer details and invoice references belong in your systems, not in transaction memos. Let the payment processor carry them to you through signed webhooks.
5. Think before paying staff from a known wallet. Contractor payouts in stablecoins are fast and cheap, but amounts and recipients are public. Use a dedicated payout wallet, and tell recipients what is visible.
6. Decide which numbers matter. Your café's daily total may not be worth hiding. Your supplier prices or your team's pay may be. Put the effort where the exposure hurts.

Where Payzum fits — and where it doesn't

Payzum is a non-custodial crypto payment processor. Customer payments settle directly into wallets you control, on public networks: Bitcoin, Ethereum, Solana, Polygon, Base, Arbitrum, Optimism, BNB Chain and Avalanche. Typical confirmation takes about 0.4 seconds on Solana and about 2 seconds on Base or Polygon.

That also means Payzum does not make your receipts private. Nothing that settles straight into your own address on those chains can. What Payzum gives you is control over the parts you can control:

• No balance in the middle. There is no Payzum account that pools, holds or freezes your money. You decide which wallet receives.
• Order data stays off-chain. Hosted checkout, payment links, invoices and plugins send the order reference to your systems through signed webhooks. The chain only sees a transfer.
• In-store detail stays in your dashboard. The Payzum POS generates a new QR per sale, with PIN-protected cashiers and analytics per cashier and terminal — none of which is written on-chain.
• Optional auto-conversion to USDC or USDT if you'd rather not hold volatile assets.
• Payouts from your own wallet. Mass payouts by CSV (BTC, LTC, DOGE) and stablecoin payouts on Polygon, Arbitrum, Optimism, Base, BNB Chain and Avalanche. Because they leave your wallet, they are public too — which is why step 5 above recommends a dedicated payout wallet.

Tempo is not one of the networks Payzum settles on today, and we don't claim otherwise. We'll keep watching privacy layers as they move closer to where customers actually pay.

How it works, step by step

1. Set up your wallets by role: a receiving wallet for customer payments, a treasury wallet and, if you pay people, a payout wallet.
2. Connect your checkout: a drop-in plugin for your store, hosted checkout, payment links, invoices or the POS at the counter.
3. Get paid: the customer pays, the payment confirms in seconds into your receiving wallet, and Payzum sends a signed webhook with the order reference to your system.
4. Move money on your schedule: sweep receipts to treasury, and pay suppliers or contractors from the payout wallet.

Fair objections

“Nobody is looking at my wallet.”

For most small businesses, probably true. But looking costs nothing, and you won't know when someone starts. The useful question is not whether anyone is watching. It's whether what they'd find would hurt you. For a café, rarely. For a B2B supplier or a team paid on-chain, more often.

“Then isn't a custodial processor more private?”

From the public, yes: your receipts vanish into the processor's pooled wallets. In exchange, the processor sees everything and holds your money — the same deal card acquirers offer, with the same exposure to freezes, holds and insolvency. Self-custody trades public visibility for control.

“Should we wait for Zones or another privacy layer?”

Wait if what you need is enterprise payroll or treasury on Tempo; that product exists now. For taking customer payments, no privacy layer today covers payers who arrive from other chains and other wallets. Design for visibility now, and adopt privacy when it reaches your payers.

“What about a fresh address for every payment?”

That is the whitepaper's own advice: “a new key pair should be used for each transaction.” It does raise the cost of linking. But every fresh address eventually has to be consolidated, and consolidation re-links them. Treat it as friction for observers, not as secrecy.