Vouch

Inspiration

Every one of us has applied for something and felt the same thing: to prove you deserve a spot, you have to hand a stranger everything about yourself. For rentals it is brutal. You send a landlord your pay stubs, your bank statements, your ID, your references, and you do it before you know if you even have a shot. Then that pile of documents sits on someone's laptop, and you have no idea where it goes next.

The numbers back up how broken this is:

93.3% of rental housing providers said they hit application fraud in the past year, and forged income documents were the number one form (NMHC, 2024). Today's application shows everything and proves nothing, so a photoshopped pay stub sails right through.
Newcomers face on average 11 times the discrimination when applying for a rental, with document demands landing hardest on racialized applicants and women (Canadian Centre for Housing Rights). The moment your name and background are visible, bias has something to grab onto.
Canadian organizations paid an average of CA$6.98 million per data breach in 2025 (IBM). Every landlord holding a stack of applicant documents is a breach waiting to happen.

Same root cause underneath all three. So we flipped it.

What it does

Vouch turns the rental application into a proof instead of a document dump.

Applicants prove, they do not show. Your credentials stay on your device. When you apply, only a zero knowledge proof leaves: that your income clears the threshold, that you have a real rental record. Never the actual numbers, never your name.
The landlord sees a pool of ghosts. Every entry is already qualified by construction. The landlord filters on neutral facts, the pool narrows live, and nobody gets unmasked in the process.
Only the chosen one reveals. The single applicant the landlord commits to reveals their identity and pays the legal deposit in one on chain transaction. Everyone else who applied stays anonymous, forever. They applied, and nobody ever knew it was them.

The mechanic is reusable. Rentals are the beachhead, but the same primitive fits jobs, loans, grants, any place you have to apply and prove yourself to a stranger.

How we built it

The whole thing runs on one Compact contract on Midnight. The core is the apply circuit, which does three things:

proves the applicant's income clears the threshold without revealing the amount
locks the application to an identity commitment, so whoever applied is the only one who can be unmasked later
spends a nullifier unique to the listing, so nobody can apply to the same place twice

That commitment plus nullifier pattern is what makes the anonymous pool sound: qualified, unique, and bound to a later reveal, all without exposing anyone.

The frontend is where an applicant manages credentials and generates proofs, and where a landlord filters the pool and commits. Wallet flow runs through Lace, and proofs run against the Midnight proof server in Docker.

Challenges we ran into

Most of our time went into the design being actually correct, not just demoable.

The deposit was illegal at first. Our original reveal and pay mechanic amounted to a security deposit, which is not allowed under Ontario's Residential Tenancies Act. We reworked it to the last month's rent deposit, which is legal, so the on chain payment maps to something a real landlord can actually collect.
Issuers had to be real, not imaginary. We first assumed a landlord could act as a credential issuer, but a mom and pop landlord cannot run a verifiable registry. We switched issuers to rent payment platforms, which already hold a verifiable payment history and can sign a credential.
The reveal had a soundness hole. Early on, nothing stopped one person from applying and a different person stepping in at reveal. Binding everything to the identity commitment closed that.
We could break our own anti discrimination promise. A landlord could repeatedly pick and unmask applicants to fish for identities. We added a reveal cap and a listing bond that pays out any applicant who gets unfairly doxxed.

Accomplishments that we're proud of

We got a real Compact contract on Midnight doing the full loop: a zero knowledge income proof, an identity commitment, and a per listing nullifier that stops double applications, all working together to keep an anonymous pool sound.
We designed the privacy to hold under a motivated adversary, not just in a happy path demo. Every hole we found, the reveal swap, the discrimination fishing attack, we closed with a real mechanism.
We grounded the whole thing in real law. The deposit maps to something an actual Ontario landlord can legally collect, which most privacy demos never bother to check.
We stayed honest about what's mocked, with a concrete fix for every gap, because we would rather a judge trust the parts that are real than oversell the whole.

What we learned

The hard part of a privacy system is not the cryptography, it is designing the mechanism so the privacy actually holds under a motivated adversary. Almost every problem we hit was a design hole, not a code bug, and the fix was usually a small change to what gets bound to what. We also learned to keep the honest gaps visible: it is more credible to show exactly where the edges are than to pretend everything is finished.

What's still mocked, and the fix for each:

Issuers are simulated. The contract already expects a registry, so a real issuer just registers a public key.
Income is the only live circuit. The reference checks reuse the exact same pattern, so it is wiring, not new crypto.
Escrow records status. Shielded custody through zswap replaces it.
The proof runs through a mocked proof server for demo speed. Pointing it at the real one is the fix, and the contract does not change for that.

What's next for Vouch

Wire up the remaining reference circuits, register real issuers, and move the deposit into shielded custody through zswap. Then take the primitive beyond rentals, into jobs, loans, grants, and the other places people are forced to over share just to apply. This is a problem we have all lived through, and we want Vouch to be a lasting fix for it.