Encryption: one key per file
Not a folder marked private. Every file is encrypted on your iPhone before it is written to storage.
In short
Latent encrypts each file with its own AES-256-GCM key. That key is wrapped by your vault key, which is itself bound to the Secure Enclave of your iPhone and unlocked by your pattern or password. Nothing is ever written to storage unencrypted.
Key takeaways
- AES-256-GCM, one key per file.
- Keys and caches are wiped from memory as soon as the vault locks.
- The app preview in the app switcher is hidden.
What “one key per file” means
Most vault apps encrypt everything with one key, or simply put files in a folder the app refuses to show. Latent gives every file its own random key. Each of those keys is then encrypted — “wrapped” — by the key of the vault the file belongs to.
The practical consequence is containment. A key exposed in memory while one photo is open gives access to that photo, not to the rest of the vault.
Where the vault key lives
The vault key never exists on disk in a usable form. It is protected by a key held in the Secure Enclave, the isolated security chip of your iPhone, and it can only be unlocked with your pattern or password. Copying the app’s files off the phone yields encrypted data and nothing else.
Each file
its own AES-256-GCM key
Vault key
wraps every file key
Secure Enclave
opened by your pattern
What happens when the vault locks
- Decryption keys are erased from memory.
- Temporary decrypted previews and thumbnails are erased.
- The search index, which only ever lives in memory, is discarded.
You choose when this happens: immediately, after 30 seconds, after one minute, or when you leave the app.
What encryption does not protect against
Encryption protects files at rest. It cannot protect what is on screen while the vault is open, and it cannot protect a pattern someone watched you draw. Latent narrows that window with automatic locking and a hidden app-switcher preview, but the vault is only as private as the moment you open it.