> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-waas/description/hinkal-approach.md).

# Hinkal Approach

Hinkal WaaS is a Wallet-as-a-Service API that lets companies programmatically manage their users' wallets and execute private on-chain transactions using Hinkal's privacy protocol. Transactions made through WaaS are not visible on-chain, giving organizations a compliant, programmable way to move assets privately without exposing activity to the public ledger.

WaaS is built for developers and organizations. If your team works outside of TypeScript and cannot integrate the Hinkal SDK directly, WaaS gives you full access to Hinkal's private transaction infrastructure through a standard REST API.

The organization model maps closely to how companies operate. A company administrator creates an organization and has full control over it. The administrator creates users within the organization, assigns them wallets, and defines policies that govern what each user is permitted to do. The administrator can also act on behalf of users — executing transactions or managing wallets directly.

At the core of our security model is one guarantee: **no sensitive wallet data ever leaves the secure enclave in raw form.** Private keys are generated inside the enclave, encrypted inside the enclave, and only decrypted inside the enclave at the moment they are needed. No component outside the enclave — not the API server, not the database, not Hinkal engineers — ever sees a raw private key.

All requests to WaaS are cryptographically authenticated using an Ed25519-based scheme called X-Stamp. Every request carries a signature over its payload, and a unique nonce to prevent replay attacks. This is covered in depth in the [Request Authentication](/hinkal/hinkal-waas/description/request-authentication.md) section.

Alongside WaaS, Hinkal also exposes the [API](/hinkal/hinkal-api/description/overview.md) — a REST API for the privacy protocol where the caller keeps their own wallet and the enclave custodies only the Hinkal shielded key. Both products run on the same secure enclave and share the security model described here.

Read on for deeper dives into each component of the security model.