The answer, step by step
- 01Encrypt before sync
Content becomes authenticated ciphertext before it enters CloudKit.
- 02Cloud is not the key store
The user retains the recovery phrase; the published design does not write it to CloudKit.
- 03Account access still matters
The Apple Account controls access to CloudKit records; application encryption controls whether retrieved records are intelligible.
- 04Integrity must be verified
AES-GCM authentication tags can detect altered ciphertext or associated data, but verification requires the correct key.
How to check this claim
In the Security Center, inspect the latest direct CloudKit read-back receipt, ciphertext count, and local authentication-tag result. Also verify that the phrase is absent from cloud records. A generic 'synced' label is not enough evidence.
See the full verification protocol →What this answer does not claim
Direct answers
Can Apple directly read Vault plaintext?
Under the published design, CloudKit receives content already encrypted by the app plus necessary metadata. The exact assurance depends on the shipped implementation and verifiable evidence.
Does an iCloud breach decrypt the vault?
Ciphertext alone is not the key, but obtaining the correct phrase as well changes the outcome.
Why protect my Apple Account too?
Account access controls record retrieval, sync, and sharing. It is a separate boundary from application-level encryption.