# Mobile Co-signer

The signature that lives in your pocket — not a push-approve button, a full MPC signing party.

Most custody apps send a push notification: you tap approve, and a server somewhere produces the
signature. The Vaultody app embeds a real MPC node. It takes part in distributed key generation,
holds one of the committee's shares in the phone's hardware keystore, and computes signature
rounds on the device. Without the phone, there is no signature.

## A signing party, not a button

- **The share sits in hardware** — Keychain on iOS, Keystore on Android, behind biometrics and a
  PIN. The share does not leave the device.
- **The app is the client party the protocol requires** — it participates in keygen and in every
  signing round, alongside Vaultody's two server nodes.
- **Approval and signature are different acts** — approving is organisational, signing is
  cryptographic, and the app performs both in the right order.

## Losing the phone is a ceremony, not a catastrophe

A reshare rotates every share onto a new device while keeping the public key — and therefore every
address — unchanged. It is the lost-phone path, the employee-departure path and the
threshold-change path, with no on-chain footprint and nothing to move.

## FAQ

**What happens if the phone is offline?**
The vault does not sign. That is the guarantee working rather than an outage — run a server
co-signer alongside the app when you need hands-off flows.

**Can Vaultody sign without us?**
No. A vault runs two Vaultody nodes plus a party you hold, so our nodes cannot reach a signing
quorum on their own.

## Related

- [Server Co-Signer](/features/server-co-signer)
- [Key Shards & Recovery](/features/key-shards-and-recovery)
- [Policy Engine](/features/policy-engine)
- [Vaultody MPC](/multi-party-computation)