> For the complete documentation index, see [llms.txt](https://cryptic-documentation.gitbook.io/cryptic-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cryptic-documentation.gitbook.io/cryptic-documentation/technology/2.-technology-overview/2.5-secure-key-management-and-recovery.md).

# 2.5 Secure Key Management & Recovery

#### **Key Management Architecture**

Cryptic’s key management architecture is designed to protect user identity, communication, and wallet-related key material across mobile, desktop, and future SDK-based integrations.

The goal is simple: keep sensitive cryptographic material under user control while making recovery and everyday use practical.

#### **Hardware-Anchored Key Storage**

Private keys are generated and stored on-device using OS-native secure storage mechanisms, with optional biometric gating where supported.

* Keys are stored using hardware-backed secure storage where supported by the device
* Keys are protected by OS-level access controls
* Keys are protected against direct extraction through platform-native security mechanisms
* Cryptic does not have access to user private keys

{% hint style="info" %}
**Important clarification:**\
Hardware backing, including Secure Enclave, TEE, or StrongBox protections, depends on device capabilities and key attributes. Cryptic uses the strongest protection available per platform where supported.
{% endhint %}

#### **Encrypted Backups**

For users who opt in, Cryptic supports encrypted backup and recovery flows designed to preserve user control.

* Backup data is encrypted before upload
* Cryptic cannot access backup contents
* Storage providers cannot decrypt the data
* Restoration requires the appropriate user-controlled credentials and cryptographic material

This enables account recovery while preserving non-custodial control and user sovereignty.

#### **Device-Bound Identity Protection**

Account recovery and key restoration are protected through device-bound identity and local authentication controls.

* Device binding mechanisms
* Biometric or OS-level authentication where supported
* Cryptographic verification during restore flows

These measures reduce the risk of unauthorized restoration, even if backup data or cloud credentials are compromised.

#### **Anti-Fraud Defense Layer**

Cryptic incorporates defensive signals and verification steps to mitigate common account takeover risks, including:

* SIM swap attacks
* Unauthorized device restoration
* Cloud credential compromise
* Social-engineering-based recovery attempts

These protections combine OS security, cryptographic verification, and user-controlled authentication rather than relying only on centralized trust.

> *Cryptic’s key management approach is built around device-level security, encrypted recovery options, and non-custodial control. The objective is to protect sensitive communication, identity, and wallet-related key material without making the user experience unnecessarily complex.*