How Journalists Can Protect Source Photos on iPhone
A source sent you photos, or you photographed documents they showed you. Those images can point back to them through location data, cloud copies or a phone that goes missing. Most of the protection comes from iPhone settings, before any app.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- Photos carry location. Unless you turn it off, the iPhone camera records where each photo was taken.
- iCloud Photos is not end-to-end encrypted by default. Apple says Photos joins end-to-end encryption only with Advanced Data Protection.
- Separate source material from your camera roll. Mixed libraries get shared, synced and shown by accident.
What should I change on my iPhone first?
- Stop the Camera saving location. Settings → Privacy & Security → Location Services → Camera → Never. Apple covers this in its guide to location data in photos.
- Remove location when sharing. In the share sheet, tap Options and turn off Location.
- Consider Advanced Data Protection. Apple's iCloud data security overview lists what it adds to end-to-end encryption, including Photos.
- Use a long passcode. Settings → Face ID & Passcode → Change Passcode, then Passcode Options, lets you choose an alphanumeric code. See Apple's passcode page.
- If you may be targeted by sophisticated spyware, read Apple's page on Lockdown Mode. It is for very few people, and it removes shared albums from Photos.
Where should source photos live?
Keep them out of the main Photos library. That keeps them out of Memories, shared albums and anyone's casual scroll.
- Shoot sensitive material in a separate camera that does not save to Photos, or move it right after.
- Share each image into a locked place, then delete the original.
- Empty Recently Deleted, which otherwise keeps photos for 30 days.
- Keep only what the story needs, and delete the rest when you are done.
What about the people in the photos?
Location is only one clue. Faces, tattoos, reflections, screens and paper in the background can identify a source. Crop or blur before any image leaves your phone. Check the original file is gone too, not only the edited copy.
Where can I get more help?
- The Freedom of the Press Foundation offers digital security guides and training.
- The Committee to Protect Journalists keeps a Digital Safety Kit, updated in 2026.
- Your newsroom's security or legal team, for anything involving subpoenas or travel.
What this doesn't protect against
A vault does not protect copies your source still has, or ones you already sent. It cannot stop spyware on an unlocked phone, or a demand to unlock it. Metadata in edited or forwarded copies can still give things away, so check before you publish.
Do it with Cryptile
Cryptile has its own camera, with GPS on or off, and photos taken in it never enter Camera Roll. They are encrypted with AES-256-GCM under a key from your pattern, with no account and no server. A second pattern can open a separate vault with ordinary photos.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos. Plus removes the limits for $19.99 a year (7-day free trial) or $39.99 once. The price is the same every day.
Cryptile Send, Files access and shared vaults are coming and are not available yet. Search inside the vault is part of Plus.