Vault

What happens if the internet is accidentally enabled while using Coconut Vault?

When a network connection is detected, sensitive data currently in memory is cleared and the app stops immediately.

Vault stores keys using the phone's secure hardware. The app cannot arbitrarily extract or erase those keys. Deleting them merely because connectivity was enabled would create a greater risk of permanent user loss.

Can I use the Vault phone for other purposes?

It is possible, but not recommended. Vault is designed for a dedicated offline signer, and general phone use weakens that security model.

• Accidental connectivity: another app may cause Wi-Fi or Bluetooth to be enabled.
• Apps and file transfers: normal use increases exposure to malware and vulnerabilities.
• Purpose of Vault: it is safest as a dedicated signer with networking fully disabled.

What are Coconut Vault's security strengths?

Modern phones include mature hardware-backed protections such as Secure Enclave, StrongBox, TEE, app sandboxing, and full-device encryption. Coconut Vault builds on this stack and performs sensitive key operations with the device's hardware-backed security facilities.

How can I verify that Bluetooth and Wi-Fi are disabled?

The phone's operating system directly manages the real Bluetooth and Wi-Fi state. On a device that has not been jailbroken or rooted, the state reported by the OS can be trusted.

Are Galaxy phones secure enough for Vault?

Galaxy devices since the S4 include Knox, and flagship S, Z, and Note models add hardware-backed protection through TEE and Knox Vault. These layers cover chip-level security and operating-system integrity, providing a strong environment for Coconut Vault.

Does a factory reset really remove all Vault data?

A factory reset may leave fragments of ordinary storage, but Vault's mnemonic is never written there.

• Sensitive data is stored and processed inside a hardware security module such as TEE or StrongBox.
• It is not written to the normal app area or general storage.
• Security events such as app deletion, reinstallation, or credential changes invalidate the internal key, making recovery impossible.
• Hardware-module keys are not backed up to external storage and cannot be restored once invalidated.

If Vault stores my mnemonic, can the Coconut team obtain my keys?

No. The design prevents it.

• Vault runs only while the internet is fully disconnected and contains no code for sending data to a server.
• Its data is excluded from iCloud and Google cloud backups.
• Key data remains inside TEE or Secure Enclave and cannot be inspected by the app or ordinary operating-system processes.

Vault is open source, so its communication and migration behavior can be independently reviewed.

iOS does not let me disable NFC. Is that a security problem?

iOS and Android security policies prevent apps from directly disabling or controlling NFC. Coconut Vault does not request NFC permission, so it cannot perform NFC operations. NFC is also short-range and governed by the OS.

For additional isolation, disable NFC manually on Android. On iOS, consider a radio-shielding pouch if you require the strictest air gap.

Are mnemonics generated by Coconut Vault secure?

Vault uses Dart's Random.secure(), a cryptographically secure random number generator rather than a general-purpose PRNG. Its output is designed to be unpredictable and non-reproducible, making it suitable for cryptographic seeds and mnemonics.

final secureRandom = Random.secure();
final token = List.generate(32, (_) => secureRandom.nextInt(256));

Review the implementation on GitHub.

Do I need to buy Coconut Vault again when changing phones?

With the same store account on the same operating system, you can reinstall it without paying again.

• iPhone → iPhone: redownload with the same Apple ID.
• Galaxy/Android → Galaxy/Android: purchase history is restored with the same Google account.
• iPhone ↔ Android: the stores are separate, so a new purchase is required.