Sotto is a beta on Solana devnet. This page says what holds today, and what does not yet.
Your organization's confidential wUSDC account belongs to your owner wallet. Sotto has no signing authority over any token account: every payment, deposit and withdrawal is a transaction your wallet signs.
The USDC issuer's freeze controls still apply.
Balances and transfer amounts are encrypted onchain with Solana's Token-2022 Confidential Balances. Addresses, times and the fact that a payment happened stay public.
Amounts are decrypted only in the browser of someone you authorize, with keys their own wallet derives. Sotto's servers store sealed records they cannot open.
Access is granted per person and scope. Revoking stops access from then on.
Revoking cannot erase what a person already viewed, so grant only what each person needs.
Wrapped USDC keeps the freeze authority of the USDC it wraps, so the USDC issuer can freeze it as it can freeze USDC. Sotto holds no freeze authority.
During the beta, Sotto runs on Solana devnet with devnet USDC, which has no value. It is wrapped one to one by a test deployment of Solana's Token Wrap program whose only change is its program ID, and the app labels it devnet test wrap.
Mainnet assets are not decided yet.
sotto_proofs checks proofs of funds and writes their records. It holds no funds, has no authority over any token account and never moves tokens.
It has not been audited externally yet. An external audit comes before any public mainnet launch; until then the worst it can do is write an invalid proof record.
None of these ever reaches Sotto's servers, logs or analytics. They stay in your wallet and in your browser tab.
Sotto does keep what is public onchain anyway, such as deposit and withdrawal amounts, and the sealed records it cannot open.
Your confidential keys come from your wallet, not from Sotto. With standard Solana tools you can read your confidential balance and withdraw it without Sotto.