A system including instructions recorded on a non-transitory computer-readable medium, and executable by at least one processor, the system comprising: an encryption manager configured to cause the at least one processor to encrypt mobile data associated with a mobile application (112; 304) executing on a mobile device and configured to interact with a remote application executing on a remote server, the mobile data being encrypted, and stored within a data vault (122; 308) of the mobile device, using a data vault password, the data vault password being derived from a mobile password provided by the user of the mobile device and used to access the mobile application (112; 304) on the mobile device; and a mobile password recovery manager configured to cause the at least one processor to encrypt the data vault password derived from the mobile password, using a mobile password recovery key derived from a remote password used to access the remote application executing on the remote server, and recover the mobile data, in case of loss of the mobile password, including: - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is stored locally; or - authenticating at the remote server using the provided remote password, to thereby obtain the encrypted data vault password from the remote server; and - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is not stored locally. an encryption manager configured to cause the at least one processor to encrypt mobile data associated with a mobile application (112; 304) executing on a mobile device and configured to interact with a remote application executing on a remote server, the mobile data being encrypted, and stored within a data vault (122; 308) of the mobile device, using a data vault password, the data vault password being derived from a mobile password provided by the user of the mobile device and used to access the mobile application (112; 304) on the mobile device; and a mobile password recovery manager configured to cause the at least one processor to encrypt the data vault password derived from the mobile password, using a mobile password recovery key derived from a remote password used to access the remote application executing on the remote server, and recover the mobile data, in case of loss of the mobile password, including: - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is stored locally; or - authenticating at the remote server using the provided remote password, to thereby obtain the encrypted data vault password from the remote server; and - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is not stored locally. - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is stored locally; or - authenticating at the remote server using the provided remote password, to thereby obtain the encrypted data vault password from the remote server; and - decrypting the encrypted data vault password derived from the mobile password using the mobile password recovery key derived from the remote password, when the encrypted data vault password is not stored locally.