Local encrypted storage vs cloud backup: what each protects
People often ask which is safer, a vault on the phone or a backup in the cloud. They are not rivals. One keeps a photo private from other people, and the other keeps it from being lost, and a photo you care about usually needs both.
Quick answer
Local encrypted storage protects privacy, and cloud backup protects against loss. Encrypted storage on the device keeps a photo unreadable to anyone who gets hold of the phone or a copy of its files. A cloud backup keeps a copy alive if the phone is lost, broken or stolen. Neither does the other’s job well, so the best setup uses both and keeps the backup encrypted too.
- To keep out a nosy person or a thief, you need encryption and a lock you control.
- To survive a lost or broken phone, you need a second copy in a different place.
- The weak spot of one is the strength of the other: a vault with no backup can vanish, and a backup with no lock can leak.
Key takeaways
- Encryption on the device answers “who can read this?”. A backup answers “can I get it back?”.
- A cloud service that holds your readable files is a second place to defend, and access follows your account. Apple’s Advanced Data Protection is an optional setting that extends end-to-end encryption to more iCloud data, including photos.
- A backup you have never opened is a guess. Test the restore before you need it.
- Vaultumi keeps its vault on the iPhone with no account and no cloud. It relies on backups you make, so a tested backup file matters.
What does local encrypted storage protect?
Local encrypted storage means your files sit on the device in encrypted form, and the key is not stored beside them. In a well-built vault each file is scrambled before it is saved, and unlocking needs a secret that you know or that your biometrics release.
It protects well against a curious friend who borrows the phone, against someone who finds a copy of the vault files, and against a company or server that you never had to trust, because none holds your photos. In Vaultumi, for example, the PIN is stretched with scrypt and combined with a secret kept only in that iPhone’s Keychain, so a copy of the files alone cannot be used to test PIN guesses.
It does not protect against losing the only copy. A device that breaks or is wiped takes the vault with it unless you made a backup.
What does a cloud backup protect?
A cloud backup stores a copy of your data on a company’s servers so you can restore it after a loss. Apple’s iCloud Backup, for example, can back up your iPhone so you can restore it onto a new device, and Apple describes it as separate from iCloud Photos, which keeps your photo library in step across devices.
It protects well against a lost, stolen or broken phone, a failed update and an accidental wipe. It does not by itself keep photos private. Access follows the account, so someone who takes over your Apple Account, or who is handed an unlocked device signed in to it, may reach what is in it. By default Apple holds the keys for most iCloud data, which allows account recovery. Advanced Data Protection changes that for more categories if you turn it on, at the price of losing Apple’s help if you lock yourself out.
Syncing is not backing up: deleting a photo on one device deletes it on the others, after a short grace period in Recently Deleted.
How do they compare risk by risk?
| Risk | Local encrypted storage | Cloud backup |
|---|---|---|
| Phone lost or broken | Gone, unless you made a backup | Restorable |
| Someone borrows your unlocked phone | Still behind its own lock | No help |
| Account taken over | Not involved, as there is no account | The backup may be reachable |
| Service breach or legal request | No server holds your files | Depends on who holds the keys |
| Accidental deletion | Gone, unless a backup exists | May be recoverable |
| Forgotten lock or password | Only a recovery code or a backup file helps | Account recovery may help |
No row is a clear win for one side, which is why you use both.
How do you use both without undoing the privacy?
- Back up the vault, not the readable photo. A backup file made inside the vault app is already encrypted with its own passphrase before it goes anywhere. Where you store it is up to you.
- Keep the passphrase and the file apart. A file and its passphrase in the same note defeat the point.
- Keep a copy in a different place. A second drive or a cloud folder protects against the loss of the phone and the loss of one location.
- Delete the readable original after import. If a private photo also sits in your synced library, the cloud copy is the weak link. Empty Recently Deleted too.
- Test the restore. Open the backup on purpose, once, before you need it.
Vaultumi has a free Backup safety check that proves a backup file opens. The guide to backing up a photo vault walks through the steps, and the comparison with iCloud Photos covers the sync side.
What does this look like in Vaultumi?
Vaultumi is local by design: no account, no server and no network requests of its own, with the encrypted vault stored in the app. There are three different copies to understand.
- The vault on your iPhone. It disappears if you delete the app or erase the phone with no other copy.
- Your normal iPhone backup. It includes the encrypted vault files, but not the device-bound key your PIN needs. After a restore, you open the vault with your recovery code and set a new PIN.
- A Vaultumi backup file. It restores on any iPhone with just its passphrase, wherever you saved it.
Vaultumi cannot reset a lost PIN for you, and there is no back door. Write the recovery code on paper and store it away from the phone.
Honest limits
- Encrypted storage and backups cannot protect a jailbroken or infected iPhone, or someone watching you enter your PIN.
- Strong encryption is only as good as its secret. A weak passphrase on a backup file is a weak lock.
- Cloud services differ in who holds the keys and what is covered. Read the provider’s own description rather than relying on a summary like this one.
- Vaultumi has not been independently audited, so treat it as one layer next to a strong device passcode, current iOS and Find My.
Sources
Primary sources behind the statements about iOS and cryptography on this page. The linked pages are in English.
- Apple Support: How to back up your iPhone or iPad with iCloud
- Apple Support: Set up and use iCloud Photos
- Apple Support: iCloud data security overview
- Apple Support: How to turn on Advanced Data Protection for iCloud
- Apple Support: How to back up your iPhone, iPad, and iPod touch
- Apple Platform Security: Keychain data protection
More guides
iCloud Photos vs local vault
Sync and rescue on one side, separation and no account on the other.
Back up a photo vault
Encrypted backup files, iPhone backups and a recovery code that works.
If you lose your iPhone
Find My first, then what a vault adds and how to restore it.