● Start · How it fits
Architecture
four apps, one card format, no server.
What runs where, what is stored where, and what talks to what. Read this before you change the card format or add a backend.
01The kit in one picture
02What is stored where
| Data | Where it lives | Who can read it |
|---|---|---|
| Wallet keys (NFC Crypto) | The phone, in the platform keystore | Only the app, after Face ID, the passcode or the card check |
| Card id and link | The card, plain text | Anyone who holds the card |
| Recovery backup | The card, encrypted with the card PIN (Argon2id, AES-256-GCM) | Anyone with the card and the PIN |
| Public receive addresses | The card, plain text, optional | Anyone who holds the card |
| Card roles, limits, approval history | The phone (app preferences) | The app on that phone |
| Card inventory and customers | The Card Studio computer (SQLite file) | Whoever uses that computer |
There is no MIKODES server and no server of yours in this picture. The only thing you host is the card-link domain with two static files (Card host).
03The three flows
- Open. A tap makes the phone read the link on the card and open your app. The app checks that the card id is one it paired.
- Confirm. When "Require the card for payments" is on, the app asks for a tap before it signs. The card proves presence only; the key that signs stays on the phone (Card roles and limits).
- Recover. A card with a backup plus its PIN gives the recovery phrase back, in NFC Crypto or in NFC Recovery (Card format).
In CryptoCard Wallet the second flow differs: the phrase is on the card, so every signature needs the card and its PIN.