> For the complete documentation index, see [llms.txt](https://learn.cypherock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.cypherock.com/design-decision/cypherock-x0-hardware-architecture/how-the-x0-wallet-app-protects-its-shard.md).

# How the X0 wallet app protects its shard

In Cypherock X0, the smartphone takes the place of the X1 Vault as the holder of the fifth shard of every wallet. Since this shard lives on the device the user carries and uses every day, Cypherock X0 protects it with several layers:

{% stepper %}
{% step %}

## Hardware-backed secure storage

The shard is stored in the smartphone's hardware-backed secure storage, the Keychain on iOS and the Keystore on Android, which keeps it isolated from other apps on the phone.
{% endstep %}

{% step %}

## Encrypted with the wallet PIN

The shard is stored encrypted with a key derived from the wallet PIN. The PIN itself is never verified by the phone; only the X0 Card can verify it.
{% endstep %}

{% step %}

## App lock

The X0 Wallet App is protected by the phone's biometrics or an app passcode, which the user must pass before the app releases the shard to an X0 Card.
{% endstep %}

{% step %}

## Never part of a backup

The shard is excluded from iCloud and Android backups, so it never leaves the phone through a cloud backup. It is only ever sent to an X0 Card, over an end-to-end encrypted NFC session, when the card needs it.
{% endstep %}

{% step %}

## Useless on its own

A single shard reveals nothing about the wallet. A second shard from one of the user's X0 Cards, along with the wallet PIN, is always needed to access the wallet.
{% endstep %}
{% endstepper %}

## Using your wallet on a new or second phone

Because the shard never leaves the phone through a backup, a new phone gets the shard from the user's X0 Cards instead. The user installs the X0 Wallet App on the new phone, taps any 2 of their X0 Cards and enters the wallet PIN, and the wallet is restored on that phone. The same steps can be used to add the wallet to a second phone.