Where to Store Sensitive Documents on Your iPhone

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

You signed a tenancy agreement and scanned it so you wouldn’t lose it. Then your tax return, an insurance policy, a letter from a lawyer. Some are in Files, one is a photo, one is in a note. You couldn’t say which phone, tablet or account holds which copy, and neither could most people.

This guide is for any private paper. It looks at the places an iPhone offers, what each one protects, and how to end up with one safe copy. It covers storage and privacy, not legal or tax advice. For passports and IDs and for medical papers there are separate articles, because their risks differ.

Three ways to scan, three destinations

Apple’s own steps are short. In Files, tap the More button, tap Scan Documents, frame the page, tap Keep Scan, tap Done, then choose a location and tap Save. In Notes, open a note, tap the Attachment button, then Scan Documents. You can also tap the More button in a note and tap Scan.

Where the scan goes depends on the app:

What each option protects

Files and iCloud Drive. Apple says you turn on iCloud Drive in Settings, then your name, then iCloud, then Drive, and your files show up in the Files app. The files then sync to every device signed in with the same Apple Account. Apple’s iCloud page says that under the default Standard data protection, iCloud Drive is encrypted but Apple holds the keys. With Advanced Data Protection, which you can turn on, iCloud Drive and Photos become end-to-end encrypted, and Apple then can’t help you if you lose access.

Notes. Apple says a locked note uses your iPhone passcode or a separate Notes password. To lock one, open it, tap More, then Lock. Apple says notes with tags, PDFs, audio or video can’t be locked, and neither can shared notes or notes in IMAP accounts. Also, if you use a separate password and forget it, Apple says there is no way to open your locked notes. Check that the lock icon appears before you trust it.

Photos. The simplest option, and the loosest. Scans and screenshots mix with your pictures, and with iCloud Photos on, a deleted photo is deleted everywhere. Hidden photos also stay in the same library, and the Hidden album opens with Face ID, Touch ID or the passcode, as covered in Is the iPhone Hidden Album Encrypted?.

None of these is bad. They are built for convenience. The catch is how many copies you end up with.

One safe copy, not five

1. Scan once. Pick one place for each paper. Don’t scan it into Notes and also screenshot it.
2. Check what syncs. Open Settings, tap your name, tap iCloud, and look at Photos and Drive. Anything saved there reaches your other devices, as the family iPad and Mac article explains.
3. Lock the notes that hold text. Use the iPhone passcode option if you don’t want another password, as Apple notes you need iCloud Keychain on for that.
4. Delete the extras. Remove loose scans from Photos, then clear them from Recently Deleted too, as the medical photos article describes.
5. Back up on purpose. The FTC says to back up your phone regularly to the cloud or your computer, so you can still reach your information if the phone is lost.
6. Shred paper you no longer need. The FTC says to shred papers with personal information before you throw them away.

Where a vault fits

Use a vault for the papers that you want out of every other place: not in your photo library, not in a synced folder, not in a note. Hidlet keeps photos, videos and files in encrypted vaults. It is available on the App Store. You draw a pattern to open a vault, you can import from Photos or Files, and there are no accounts. After importing from Photos, Hidlet offers to delete the originals there; files from Files stay until you delete them yourself.

You can keep one vault for papers and another for photos, and nothing in the app lists them. A vault’s encrypted backup is optional, off until you turn it on, and goes to your own iCloud. On a new iPhone, your pattern restores a backed-up vault if iCloud Keychain is on, and the 9-word recovery phrase restores it otherwise.

What Hidlet can and can’t protect

It protects what is inside a vault: encrypted before it is stored, locked as soon as you leave the app, and blank in screenshots. It can’t protect a copy you left in Photos, Files or Notes, a file you sent to someone, or a loss you caused by losing both the pattern and the recovery phrase. It is storage, not an archive that proves a document is genuine, and it doesn’t tell you which papers you must keep.