Confidential payout rails · Solana

Every Solana payout
publishes your payroll.
Payhop doesn’t.

Upload a CSV and sign it in your own wallet. Payhop never holds a key. MultiHopper routes every payout through hops, so the explorer never shows your treasury paying a person directly.

Build a batchRead the docs

Opens the batch builder. Phantom or Solflare signs you in, and nothing moves until you approve a quote.

Routing does not hide amounts. It removes the readable link between your treasury and each person you pay. On mainnet, TRM screening runs in the contract before any hop executes, and disclosure to your auditor is a receipts file you hold.

Fig 1 — Example batch, after settlement

October payroll

Completed23 recipients · 2 routes
WalletDeliveredReceipt
Hh66yN…TbKnBi4,000.00126DZW…
3gDnGV…jZZU8u4,000.004RZF6y…
7pBqiz…QyQ2u3,250.009vLmXt…
64CuFE…9kFErF5,500.002qYzLf…

Route 1 of 2 · 5 hops

VHVE-1461-D53B · receipts.csv exported
Signed by G5EARP…NyUEX in-browser

Live on mainnetIntegration 92 · since Oct 2026
Non-custodialYour wallet signs in the browser
Zero markup0.50% protocol fee plus network costs
Open source94 tests · audit the orchestrator

Confidentiality

A public ledger itemizes your payroll.

A standard SPL transfer records the sender, the recipient, the amount and the time in the clear. Companies moved payouts on chain for speed and cost, and published their compensation table along with them.

Salary bands

Each transfer out of the treasury carries an amount and a destination, so per-person compensation is derivable from the explorer alone.

Burn and headcount

The timing and size of outgoing transfers show hiring pace and runway to anyone watching the address.

Vendor relationships

Repeat transfers from a single address map the supplier list and the rate attached to each supplier.

Recipient addresses

A wallet paid by a named entity stays associated with that entity, permanently, including in everything the recipient later pays.

The honest version of the trade-off: Payhop does not make payments secret. Amounts and recipients still exist on chain, and your own records still show exactly who you paid. What routing removes is the trivially readable sender → recipient edge that turns a block explorer into an HR database.

How it works

Four steps from spreadsheet to settled.

The flow is built for a finance operator on payday, not for an engineer with a terminal open.

  1. Fig 2.1

    Upload a CSV

    Drop or paste wallet,amount[,reference]. Payhop validates every address and amount in the browser, flags duplicates and bad rows, and converts amounts to base units with exact integer math, so no float rounding touches someone’s pay.

  2. Fig 2.2

    Review the quote

    Pick hop count and arrival window. Payhop asks MultiHopper for a live estimate: the 0.50% routing fee, the per-hop SOL charge, the SOL you need up front, and the exact amount each recipient receives. Lists longer than 20 recipients split into routes automatically.

  3. Fig 2.3

    Sign in your wallet

    Phantom or Solflare signs the route setup transactions in your browser, one confirmed step at a time. The server orchestrates and records; it never sees a private key and never takes custody.

  4. Fig 2.4

    Recipients get paid

    MultiHopper’s keepers execute the hops on schedule and disperse to every destination. Payhop tracks each payout signature and gives you a receipts CSV for accounting.

3–10 hops per routearrival window from 1 minute to 30 days20 recipients per route, batched automaticallyresumable signing if a blockhash expires

Compliance

Screening in the contract, keys in your wallet.

Compliance screening at the contract level

On mainnet, MultiHopper screens every route through TRM Labs, and the on-chain program will not execute hops without a verification attestation. The screening fee is part of the quote you see before you sign. If a route is flagged, the principal is refunded and the screening fee is kept.

  • Sanctions and risk screening runs before any hop executes.
  • Enforcement lives in the smart contract, not in a dashboard toggle.
  • Every batch keeps an append-only audit trail: who created it, who approved it, what was signed.

Non-custodial by construction

Payhop’s server plans batches, talks to MultiHopper, and records state. It cannot move your money. Every transaction that spends from your treasury is signed by your wallet, in your browser, after you have read the quote.

  • You sign in by signing a message. No passwords, no uploaded keys.
  • Spend policies cap per-batch and rolling 24-hour totals, and hold large runs for approval before they are quoted.
  • Scoped API keys let your accounting system queue payouts without being able to sign one.

Who it’s for

Anyone who pays more than one wallet at a time.

Payroll

Run payday on schedule without leaving a treasury-to-person trail that reads as a comp table.

Vendor payments

Settle supplier invoices without publishing your supplier list. Invoice references stay in Payhop, off chain.

Creator & affiliate payouts

Pay thousands of small recipients in one run. Payhop splits the list across routes and gives finance one receipts file at the end.

Grant programs

Announce grants when you choose. The disbursement does not break the news for you.

OTC settlement

Settle a negotiated position without the leg being readable on the explorer while it is still in flight.

Agents and back offices

Queue payouts from your accounting system or a bookkeeping agent through a scoped API key or the MCP server. Only a wallet signature from a person can move the money.

Pricing

One subscription. No cut of your payroll.

Payhop charges a flat monthly fee and takes no percentage of what you send. Everything else on this page is MultiHopper’s published pricing or a Solana network cost, quoted line by line for your specific batch before you sign.

Self-hosted

$0

The whole application is AGPL-3.0 and always will be. Run it on your own server with your own MultiHopper key. You pay for your infrastructure and nothing to us, forever.

Hosted at payhop.app

$49 /month

Unlimited batches, unlimited recipients, unlimited volume. No server, no RPC endpoint, no MultiHopper registration to maintain.

Waived for founding workspaces. Every workspace created before 31 December 2026 keeps the hosted app free for as long as that workspace exists. No card, no trial clock, no later invoice.

Routing fee

0.50%

50 basis points of the amount sent, taken in the token you are paying. It comes out of the amount in flight, so the quote shows exactly what lands in each recipient’s wallet.

Hop charge

SOL

A flat SOL charge for every hop, priced from the USD value of the route. More hops break the trail further and cost more SOL. You pick the hop count, and the quote prices it before you commit.

Network costs

At cost

Route, orchestrator, dispersion and token-account rent are posted up front and come back when the route closes. Transaction and priority fees do not. The estimate separates refundable rent from net cost.

What the quote itemizes for every batch

LineCharged inWho gets it
Routing fee, 0.50% of the amount sentPayout tokenMultiHopper protocol
Hop charge × number of hopsSOLMultiHopper protocol
Compliance screening fee (mainnet routes)SOLScreening provider
Account rent: route, orchestrator, dispersion, token accountSOLRefunded when the route closes
Network and priority feesSOLSolana validators
Payhop subscriptionUSD / month$49 hosted · $0 self-hosted · free for founding workspaces

Questions

The things finance teams ask first.

Will I be charged later?

Not if you start now. The hosted app is $49 a month, and that fee is waived for the life of any workspace created before 31 December 2026. The waiver is not a trial: it does not expire, and it does not need a card. Self-hosting is free regardless, under AGPL-3.0.

Does Payhop ever hold my funds?

No. The payment leaves your wallet only inside transactions you sign in your browser. The server plans the batch, calls MultiHopper, and records what happened; it has no key and no custody.

What happens if I close the tab mid-signing?

Signing is resumable. Payhop re-asks MultiHopper what is already on chain and replays only the missing steps, so you never fund a keeper twice or pay a route twice.

How private is it, exactly?

It is unlinkability at the transfer-graph level, not anonymity and not zero-knowledge. Funds move through protocol-owned hop accounts on a schedule rather than straight from your treasury to each person, which is the edge an explorer reads. Everything else about the chain stays as public as it was.

Can I still prove who I paid?

Yes. Payhop keeps every recipient, reference, delivered amount and payout signature, and exports them as a receipts CSV for your accountant or auditor.

What tokens can I pay in?

SOL and any SPL token that MultiHopper can price, including USDC. You pick the mint and decimals in the batch builder.

How many people can one batch pay?

As many as you like. A MultiHopper route carries up to 20 destinations, so Payhop splits a larger list into as many routes as it needs and tracks them as one batch.

Get started

Your next payroll run doesn’t have to be public.

Connect a wallet, upload a CSV, read the quote, sign once. MultiHopper routes the hops and Payhop hands you the receipts.

Build a batchRead the docs