# Use CoinCover

The following are instructions for backing up an organization's private keys
with CoinCover.

Fordefi partners with CoinCover to give institutions an independent backup and
recovery option for their MPC wallets.

CoinCover provides you with an RSA public key. You upload it in the Fordefi web
console, and Fordefi uses it to encrypt both key shares into a recovery package.
CoinCover stores the matching RSA private key securely in both cloud (hot) and
offline (cold) storage. You can keep the recovery package yourself, or store it
with CoinCover so it is protected by CoinCover's governance controls.

If you need to recover, CoinCover returns the RSA private key to you once your
identity and approval policy have been verified. You then decrypt your recovery
package locally with Fordefi's recovery tool, without depending on Fordefi or
CoinCover to move your funds.

To get started, contact CoinCover through
[their website](https://www.coincover.com/contact) or Fordefi customer support.
You'll need to provide your legal entity name, contact email address(es) and
Fordefi Organization ID (Fordefi support can help you find this).

## Perform backup

1. **Receive your public key:** CoinCover sends you an RSA public key as a
`.pem` file and lets Fordefi know which key you were given.
2. **Start the backup in the Fordefi web console:** Upload the public key and
choose how to receive your recovery package: set a recovery email address, or
download the package from the console.
[Learn more](https://docs.fordefi.com/user-guide/backup-and-recover-private-keys/backup-private-keys-upload#in-the-fordefi-web-console).


Use a dedicated recovery inbox
If you use email, we recommend a dedicated recovery inbox, separate from
everyday mail.

1. **Approve on mobile:** Validate the public key in the Fordefi mobile app. The
rest of your admin quorum then approves the backup on their devices.
2. **Receive your recovery package:** Fordefi encrypts both key shares with the
public key and sends the package to your recovery inbox, or makes it
available to download in the console.
3. **Confirmation:** Fordefi and CoinCover confirm with each other which public
key was used and that you received the package. You don't need to take any
further action.


### Store your recovery package

You can choose how your recovery package is stored:

- **Store it yourself:** Keep the package securely in your own environment.
- **Store it with CoinCover:** Use the CoinCover CLI to upload the package into
CoinCover's system instead of storing it yourself. Access to the package is
then protected by CoinCover's governance controls, including your ACL and
recovery approval policy.
Your recovery package includes your wallet derivation paths. Fordefi generates a
new package each time you add a wallet. Always keep the latest package (or
upload it again if you store it with CoinCover). It will be more difficult to
recover with an older backup.


## Recover private keys

1. **Request recovery in CoinCover Control:** Log in to CoinCover Control,
CoinCover's web portal, and submit a recovery request. Include a public GPG
key, which CoinCover uses to encrypt the key it returns. Before CoinCover
releases the key:
  - **Identity:** The requestor's identity is verified.
  - **Hardware authenticator (if applicable):** The request is confirmed with a
hardware authentication device.
  - **Approval policy:** Your ACL approval policy is met.
You set up an Access Control List (ACL) in CoinCover Control, naming the people
who are authorized to request a recovery. All ACL members have their identity
verified. By default, any member can start a recovery request, and a majority of
members must approve it. If you need stricter controls, CoinCover's recovery
policy engine lets you add further approval criteria, and you can add a hardware
authentication device as an additional layer. CoinCover verifies the requestor's
identity before releasing any key. Changes to the ACL go through the same
approval and verification steps, so no single person can recover keys or change
access on their own.
2. **Receive the RSA private key:** CoinCover returns the RSA private key,
encrypted to your GPG public key. Decrypt it with your GPG private key.
3. **Run the Fordefi recovery tool offline:** On an offline machine, put
Fordefi's recovery tool, the encrypted key material (the `.json` file
extracted from your backup `.zip`) and the RSA private key in one folder. Run
the tool. It produces an `output.csv` file containing the private keys for
each Vault.
[Learn more](https://docs.fordefi.com/user-guide/backup-and-recover-private-keys/recovery/recover-private-keys).
4. **Move your funds:** Use the recovered keys independently of Fordefi. Keys
for ECDSA-based chains can be imported into standard wallets. EdDSA-based
chains (such as Solana, Sui and Aptos) need Fordefi's dedicated recovery-tool
commands.
[Learn more](https://docs.fordefi.com/user-guide/backup-and-recover-private-keys/recovery/recover-funds).


Recovery requests
All recovery requests must be made in CoinCover Control. For help at any stage,
contact the CoinCover help desk at `support@coincover.com`.