Your keys. Your server.
Password reset. Your old recovery key is retired. Here is your new one — store it offline.
Encrypted on the server with your vault key before it is stored.