Methods and systems for protecting sensitive data on a mobile device. In an embodiment, a mobile device processor of a mobile device downloads, from a provider computer, an application including a white box software development kit (SDK). The mobile device processor utilizes a code protection process of the application to obfuscate sensitive user data, stores the obfuscated user data in a regular memory, runs the white box SDK to monitor and protect sensitive applications which execute when conducting transactions, and receives instructions from a trusted application manager computer to at least one of re-obfuscate the sensitive user data and reset a user root key.