Per OWASP MASVS v2 MASVS-STORAGE: secure storage of sensitive data on mobile devices. Requirements include (a) identify + classify sensitive data handled by the app (credentials + tokens + personal data + financial + health + behavioural data) + (b) use the platform-provided secure storage facilities (Android Keystore + iOS Keychain + secure enclaves) for sensitive data + (c) avoid storing sensitive data in shared storage + logs + screenshots + clipboard + keyboard cache + backups + (d) implement encryption at rest with keys protected by hardware-backed storage where available + (e) clear sensitive data from memory + UI + caches when no longer needed + (f) implement secure backup handling preventing sensitive data inclusion + (g) restrict permission justification for storage access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.