NullKey 
Secure your accounts first
Start with the things that connect to the phone. If you set up a remote lock or locate feature earlier, use it now, and sign out remotely from accounts that were logged in on the device, where your provider allows it.
Change the password for your email before anything else, because email can reset many other accounts. Then contact your mobile carrier to block the SIM. The app has no account of its own, so there is nothing to sign out of inside it.
Also check whether your phone keeps copies of photos or files in an online account, since that copy may be reachable from another device. If it does, secure that account straight after your email.
What the vault still protects
The vault is encrypted on the phone, but an open vault is a different case. If the vault was open on screen when the phone went missing, or someone can satisfy an enabled unlock method, the vault can be opened. With phone screen-lock unlock switched on, the phone's own lock code is enough to open the app.
Otherwise the vault stays locked and asks for your passphrase or another method you enabled. Even then, file counts, approximate sizes and filesystem times are not hidden from someone with access to the storage.
Steps for the first day
Work through these in order of risk, and note each one as you finish it.
- Use the remote lock or locate feature, if you set one up before the loss.
- Change the email password first, then the passwords for accounts that email can reset.
- Sign out of accounts remotely where the provider allows it.
- Ask your carrier to block the SIM and report the handset as lost.
- Secure any cloud or sync account where you saved a backup file.
- List which backups exist and which passphrase or recovery key opens each one.
How NullKey handles this
The NullKey vault stays on the phone, and NullKey sends nothing from it to Alvento. The current app has no account, no server and no internet permission. Android cloud backup and device-transfer backup are disabled for its data, so Android's own backup and transfer routes do not copy the vault elsewhere.
Alvento cannot access or erase a local vault remotely, so a lost phone cannot be wiped from our side. The honest limit is that the vault cannot protect itself while it is open, or any readable export you made. Only a backup kept elsewhere, with its own secret, can rebuild the vault on a new phone.
Plan for a phone that never comes back
Assume the phone and everything on its storage may be gone for good. Keep an encrypted backup away from the phone, with its passphrase or recovery key stored separately. Uninstalling or losing the phone may otherwise lose the only copy of your vault.
Remember too that a remote erase of the phone also deletes the vault, so weigh that before you use one if no backup exists.
