Compliance
This page describes what protocol evidence a LinethLineth (Formerly the Linea Stack) The open-source ZK-rollup stack, codebase, and technical protocol that's the foundation of Linea Mainnet. Operators can deploy this stack to launch their own Ethereum-compatible L2 or L3 networks. deployment produces that operators can use in their own compliance program, and what Lineth does not claim.
This page does not include:
- Mapping to specific regulatory frameworks.
- A certification or attestation that a deployment is compliant.
- Data retention or deletion product features. Operators implement retention and disclosure against their own policy using the deployment's data availability and access controls.
zk-SNARK proofs are not a compliance program
zk-SNARKzk-SNARK (Zero-Knowledge Succinct Non-interactive Argument of Knowledge) A type of ZK proof where the prover and verifier don't have to interact. With zk-SNARKs, you can verify 1 transaction or 1 billion transactions in the same amount of time. proofs verify state-transition correctness. They do not by themselves provide a complete compliance program. A compliance program needs controls, evidence, retention, disclosure, and ownership that go beyond proof verification.
Protocol evidence a deployment produces
A Lineth deployment produces the following evidence that operators can use in a compliance design:
- State commitments posted to the finalization layerFinalization layer The blockchain where a Lineth deployment submits proofs and state commitments for verification and hard finality. If the finalization layer is Ethereum (an L1), the deployment is an L2. If the finalization layer is Linea (an L2), the deployment is an L3.
- zk-SNARK proof verification records on the finalization layer
- Finalization records on the finalization layer
- Transaction history retained by the deployment's data availability model
What participants can verify depends on the deployment model. For the trust and verification boundaries, see Trust and responsibilities. For where data is stored and who can see it, see Privacy and data visibility.
Operator-owned compliance controls
OperatorsOperator The entity or consortium responsible for deploying, administering, and running the network infrastructure, contracts, keys, access controls, and operational procedures for a network built on Lineth. are responsible for the controls a compliance program requires. Lineth provides mechanisms operators can configure, but does not own the program:
- Access policy: RBAC on RPC endpoints and API surfaces controls who can read or submit
- Data availability arrangement: operators choose where transaction data is stored and who can reconstruct it; see Data availability and finalization
- Key management: remote signing backed by HSM or KMS via Web3Signer
- Governance and upgrade authority: multisig, governance contract, or timelock for privileged roles; see Security and assurance
- External integrations: operators connect external compliance, monitoring, and logging systems to their deployment
What Lineth does not claim
- Lineth does not certify a deployment as compliant with any specific regulation.
- Lineth does not publish a control-to-framework mapping.
- Private validiumValidium A deployment model in which a Lineth network proves state transitions with zk-SNARKs but keeps transaction data in a private data availability layer instead of publishing it to the finalization layer. Only state commitments and proofs are posted onchain, so participants without access to the offchain data can't independently reconstruct or verify the full transaction history. and RBAC are access and data-visibility mechanisms, not cryptographic private execution or ZK privacy. Do not infer regulatory compliance from them.
- Lineth does not own data retention or disclosure policy. Operators implement it.
Where to go next
| Question | Page |
|---|---|
| Who operates what, and what can each component do? | Trust and responsibilities |
| Who can see what data? | Privacy and data visibility |
| What is protocol versus operator, and what evidence exists? | Security and assurance |
| How is access to RPC and APIs controlled? | Access control |
| How do data availability and finalization choices interact? | Data availability and finalization |