1. Import
You pick photos, or a scan finds them. The app reads each one from Photos. iOS never lets an app silently remove photos, so at this point it is a copy.
2. Encrypt
In VaultBolt, each item gets a random 256-bit file key and is sealed in chunks with AES-256-GCM. The file key is wrapped by the vault key, which is itself wrapped by a key derived from your unlock.
3. Index
Names, folders, dates and thumbnails go into an encrypted index, so even the list of what you stored is unreadable without your key.
4. Clean up
The app asks iOS to delete the originals, which you confirm. VaultBolt then guides you through Recently Deleted and iCloud Photos.
5. Unlock
When you open the app, your pattern, PIN or passphrase is run through Argon2id with a Secure Enclave secret to re-create the key that unwraps the vault key. Lock the app and the keys are dropped from memory.
6. Back up and recover
Encrypted records go to your private iCloud. On a new phone, your recovery phrase re-creates a recovery key that unwraps the vault key, and the vault restores.
Frequently asked questions
Do vault apps move or copy photos?
iOS only lets apps copy photos and ask you to confirm deletion of the originals. Good vaults then help you delete the originals and empty Recently Deleted.
Where does a vault store files?
In the app's private container on the device, which other apps can't read. Encrypting vaults store only ciphertext there.
