> For the complete documentation index, see [llms.txt](https://whitepaper.zodor.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.zodor.io/system-architecture/overview-of-the-protocol/masque-id.md). # Masque ID **Masque ID** is the decentralized protocol that manages on-chain identities for compliant digital assets. It integrates on-chain identity verification with off-chain document storage to satisfy KYC requirements while preserving user privacy. **Key Features** * **Hybrid Storage** sensitive documents (passports, PAN, Aadhaar) live with trusted KYC providers; only encrypted proofs and tamper-proof attestations appear on-chain * **Cryptographic Validation** claims are signed by the registered claim issuer (`ZodorClaimIssuer`) and verifiable on-chain without revealing the underlying data * **Claims-Based Access** seven claim topics (`KYC_INDIA`, `KYC_GLOBAL`, `ACCREDITED`, `JURISDICTION`, `AML_CLEAR`, `RISK_SCORE`, `ESG_VERIFIED`) gate every transfer through `ZodorComplianceModule` * **Dynamic Risk Scoring** risk assessments update continuously based on user behavior, jurisdiction, and provider data * **One ID, all verticals** the same Masque ID grants access to Capital, Infra, Energy, and Infinity according to which claims it carries **Core Workflow** 1. **Creation** user submits documents to a KYC provider (Sumsub or Digitap); provider issues an encrypted proof 2. **Anchoring** `ZKKYCGate.verifyAndMark()` checks the Groth16 proof, records the nullifier, and triggers `ZodorClaimIssuer.issueClaimFromGate()` issuing `KYC_INDIA(1)` for jurisdiction code 356 or `KYC_GLOBAL(2)` otherwise 3. **Validation** the compliance module checks Identity and Claim Registries on every transfer 4. **Maintenance** non-compliant identities and expired claims are revoked or updated; root history is preserved so previously-generated proofs continue to verify