Two levels of iCloud protection
Apple describes two modes in its iCloud data security overview:
- Standard data protection (the default): iCloud Photos is encrypted in transit and at rest, but Apple holds the encryption keys. That lets Apple help you recover data, and means it could technically access it.
- Advanced Data Protection: iCloud Photos joins the end-to-end encrypted categories. Only your trusted devices hold the keys.
Hiding a photo doesn't change which mode applies. Hidden photos are encrypted exactly like the rest of your library.
What a vault adds
A vault that encrypts on your device adds a layer Apple can't open in either mode. VaultBolt encrypts every file with its own key before writing it, so its iCloud backup contains only ciphertext and wrapped keys. Apple can see that encrypted records exist and how big they are. It cannot see what they are.
Should you turn on Advanced Data Protection?
It's a strong privacy upgrade for most people. Before you do, set up a recovery contact or recovery key, because Apple can no longer recover your data for you. Follow Apple's instructions.
Frequently asked questions
Are hidden photos encrypted?
They are protected by iOS data protection on the device and by iCloud encryption in the cloud, like the rest of your library. Hiding does not add a separate encryption key.
Is Advanced Data Protection available everywhere?
No. Availability depends on your country, and turning it on requires a recovery contact or recovery key.
