Short answer: scan with the Files app, save the scans to a folder in iCloud Drive, turn on Advanced Data Protection so iCloud Drive is end-to-end encrypted, and lock the Files app with Require Face ID. Four steps, all built into iOS, all free. Together they cover the two real risks: someone picking up your unlocked phone, and your files sitting readable on a server.

Here's each step, exactly as Apple describes it, plus the parts that are easy to get wrong.

Step 1: scan straight into the Files app

Most people scan into Notes or just take a photo, and the photo ends up between a sunset and a screenshot of a parking spot. Scanning into Files puts the document where it belongs from the start.

  1. In the Files app, tap the More button.
  2. Tap Scan Documents.
  3. Place your document in view of the camera. In Auto mode, it scans on its own; to capture by hand, tap the Shutter button or press one of the volume buttons. In iOS 26 you can also pick options such as flash or an image filter.
  4. When you're done, choose a location, then tap Save.

Step 2: give your scans a home in iCloud Drive

Where you save matters. Save into iCloud Drive and the scan follows you to a new phone and to your other Apple devices. Apple's definition of iCloud Drive covers PDFs "or any other files manually or automatically saved to iCloud Drive," which is what makes the next step count.

Then keep the structure boring on purpose. A handful of folders works better than a clever system you'll abandon by March:

  • IDs (passports, driver's licenses, Social Security cards)
  • Medical (insurance cards, test results, prescriptions)
  • Money (tax returns, statements, pay stubs)
  • Home and car (leases, titles, warranties)

Name files the way you'd search for them later: "Passport, Alex, expires 2031-04" beats "Scan 14."

Step 3: turn on Advanced Data Protection

This is the step that changes who can read your files in iCloud.

By default, iCloud uses standard data protection. In Apple's words, the encryption keys from your trusted devices "are secured in Apple data centers, so Apple can decrypt your data on your behalf whenever you need it."

With Advanced Data Protection turned on, "the majority of your iCloud data -- including iCloud Backup, Photos, Notes, and more -- is protected using end-to-end encryption." The number of end-to-end encrypted categories rises to 25, and Apple's table lists iCloud Drive as end-to-end, with the keys on your trusted devices only. That covers the scans you saved in step 2.

What it does not cover, per the same Apple page: iCloud Mail, Contacts and Calendars stay under standard protection, and so does some metadata, such as file modification dates. So a scan you email to yourself through iCloud Mail isn't covered the way the copy in iCloud Drive is.

Before you switch it on, know the requirements and the tradeoff:

  • You need an Apple Account with two-factor authentication, and an iPhone on iOS 16.2 or later. Managed Apple Accounts and child accounts aren't eligible.
  • Apple can no longer help you recover your data. "With Advanced Data Protection turned on, Apple doesn't have the encryption keys needed to help you recover your end-to-end encrypted data." You'd use one of your account recovery methods: your device passcode or password, your recovery contact, or your recovery key.

The switch lives in your iCloud settings, and Apple's support article (in the sources below) has the exact taps for your iOS version. The pages we read are Apple's US ones; if you're elsewhere, check that article for your country.

Step 4: lock the Files app with Face ID

Encryption protects your files on Apple's servers. It does nothing when your phone is unlocked and in someone else's hand. That's what the app lock is for.

  1. Touch and hold the Files icon until the Quick Actions menu opens.
  2. Tap Require Face ID (or Touch ID, or Passcode).

Apple notes that information inside a locked app won't appear in other places, like notification previews, search or Siri suggestions. Two catches:

  • It's per device. The lock applies only to that iPhone. "The locked or hidden status of an app doesn't sync with iCloud." Lock Files on your iPad separately.
  • It's the whole app. Every file in Files sits behind the same lock. And because Files comes with the iPhone, it can be locked but not hidden; only App Store apps can be hidden.

For every other option, from hiding photos to password-protected PDFs, see ways to lock documents on an iPhone.

Why not just use Notes?

Notes can scan too: tap the Attachment button, then Scan Documents. And locked notes are end-to-end encrypted for iCloud accounts. The catch is what can be locked. Apple's list: "You can't lock notes that have tags, PDFs, audio, video, Keynote, Pages, Numbers documents, or notes that use IMAP to sync with accounts, like Yahoo, Gmail, and Hotmail." Shared notes can't be locked either. So the note where you dropped a PDF of your lease can't be locked at all. And if you forget your notes password, Apple can't help you get in.

Notes is fine for a scan with a few lines of context. For a document you want locked, Files is the more predictable home.

What this setup doesn't do

With these four steps done, your scans are about as private as Apple makes them, and you've paid nothing. If that's all you need, you're finished. It's also a solid base for the rest of your backup plan for important documents.

What it doesn't do is read anything. Every scan is a file you named, in a folder you picked. Files won't tell you that your passport expires in five months, and it can't answer "how much was the car repair?" without you opening the right PDF. That's where a vault app can earn its place, and it's also where you should be choosy: whether a scanner app is safe depends on where it keeps your files and who can read them.

Paperlock is one such app, and we make it, so here's the plain version. It reads each document you save (type, sender, dates, amounts, expiry), titles and files it without folders, and answers questions in plain English with the source document attached. With reminders on, it warns you 30 and 7 days before something expires, and six months ahead for passports and IDs. The app locks with Face ID on open and again after about a minute in the background, and blurs IDs until you confirm it's you. The tradeoff is honest: reading and answering happen partly on Paperlock's servers over an encrypted connection, and documents aren't stored there. If you'd rather nothing ever be read by anyone's server, Files with Advanced Data Protection is the stricter setup. We've put the two side by side if you're deciding.