Data Protection

iOS Data Protection Overview

iOS provides four data protection classes that determine when encrypted data is accessible:

.complete Protection

Data is encrypted and only accessible when the device is unlocked:

let fileURL = documentsDirectory.appendingPathComponent("sensitive.dat")
let options: [FileAttributeKey: Any] = [
    .protectionKey: FileProtectionType.complete
]

FileManager.default.createFile(
    atPath: fileURL.path,
    contents: sensitiveData,
    attributes: options
)

.completeUnlessOpen Protection

Data remains accessible if the file is already open when the device locks. Useful for background downloads that need to continue:

let options: [FileAttributeKey: Any] = [
    .protectionKey: FileProtectionType.completeUnlessOpen
]

FileManager.default.createFile(
    atPath: fileURL.path,
    contents: data,
    attributes: options
)

.completeAfterFirstUserAuthentication

Data becomes accessible after the user unlocks the device for the first time after a restart. This is the most common protection level for most apps:

let options: [FileAttributeKey: Any] = [
    .protectionKey: FileProtectionType.completeAfterFirstUserAuthentication
]

Choosing the Right Level

• .complete: Banking credentials, health data, payment information
• .completeUnlessOpen: Email attachments being downloaded, media downloads
• .completeAfterFirstUserAuthentication: User preferences, cached data, most app data
• .completeUntilFirstUserAuthentication: Authentication tokens, session data

Applying Protection to Files

When you create or modify a file, specify the protection level in the attributes:

func saveSecureFile(_ data: Data, named filename: String) throws {
    let fileURL = documentsDirectory.appendingPathComponent(filename)
    
    let attributes: [FileAttributeKey: Any] = [
        .protectionKey: FileProtectionType.completeAfterFirstUserAuthentication
    ]
    
    try data.write(to: fileURL, options: [.completeFileProtection])
}

Modifying Existing File Protection

Change the protection level of an existing file:

func changeProtectionLevel(for url: URL, to level: FileProtectionType) throws {
    try FileManager.default.setAttributes(
        [.protectionKey: level],
        ofItemAtPath: url.path
    )
}

Encryption with CryptoKit

For additional encryption beyond file protection, use CryptoKit:

import CryptoKit

class EncryptionService {
    private let key: SymmetricKey
    
    init() {
        // In production, store key in Keychain
        self.key = SymmetricKey(size: .bits256)
    }
    
    func encrypt(_ data: Data) throws -> Data {
        let sealed = try AES.GCM.seal(data, using: key)
        return sealed.combined!
    }
    
    func decrypt(_ data: Data) throws -> Data {
        let sealedBox = try AES.GCM.SealedBox(combined: data)
        return try AES.GCM.open(sealedBox, using: key)
    }
}

Secure Deletion

Overwrite data before deletion to prevent forensic recovery:

func secureDelete(at url: URL) throws {
    let attributes = try FileManager.default.attributesOfItem(atPath: url.path)
    guard let fileSize = attributes[.size] as? Int else { return }
    
    // Overwrite with random data
    let randomData = Data((0..<fileSize).map { _ in UInt8.random(in: 0...255) })
    try randomData.write(to: url, options: .atomic)
    
    // Then delete
    try FileManager.default.removeItem(at: url)
}

Keychain Access Control

The Keychain stores sensitive data with hardware-backed encryption. Set access control to require biometrics or passcode:

import Security

class KeychainService {
    func save(_ data: Data, for key: String, requiresBiometric: Bool) throws {
        let access: SecAccessControl?
        if requiresBiometric {
            access = SecAccessControlCreateWithFlags(
                kCFAllocatorDefault,
                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
                [.biometryCurrentSet, .or, .devicePasscode],
                nil
            )
        } else {
            access = nil
        }
        
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        SecItemDelete(query as CFDictionary)
        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw KeychainError.saveFailed(status)
        }
    }
}

Keychain Accessibility Levels

Best Practices

• Use ThisDeviceOnly variants to prevent keychain data from transferring to new devices via backup
• Store encryption keys, tokens, and credentials in Keychain
• Set appropriate access control flags for biometric protection
• Handle Keychain errors gracefully and provide fallback authentication
• Never store large data in Keychain, use encrypted files instead