---
title: "Encrypt local data that holds personal · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/encrypted-local-data
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Encrypt local data that holds personal data

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: MOB-24
- Level: Recommended
- Chapter: [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device)
- Rule: Keep personal data only in the app's private storage, with the platform's file protection on. Encrypt databases of health, money or messages with a key from the Keystore or Keychain.
- How: On iOS, give files the `complete` file protection class, so they cannot be read while the phone is locked. Rooted phones and backups can still read plain app storage. For sensitive data, encrypt the database file with a key kept as [keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore) says. Never write personal data to shared folders such as Downloads. Delete local copies on the schedule in [delete old data automatically](https://agentwranglers.se/playbook/data/personal-data/retention-jobs).
- Check: On a test device, list the files the app wrote outside its private folder. There are none. Each database holding sensitive data fails to open without its key.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```swift
try data.write(to: workoutsURL, options: .completeFileProtection)
```

### Kotlin example

```kotlin
val file = File(context.filesDir, "workouts.json")
file.writeBytes(encryptWithKeystoreKey(workouts.toByteArray()))
```

## Sources

- [OWASP MASVS-STORAGE-1](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)
- [Apple, FileProtectionType.complete](https://developer.apple.com/documentation/foundation/fileprotectiontype/complete)

## Related rules

- [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore) in Mobile apps
- [Delete old data automatically](https://agentwranglers.se/playbook/data/personal-data/retention-jobs) in Data

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/encrypted-local-data">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep personal data out of device logs](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-personal-data-in-device-logs)
- Next: [Wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out)
- [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device)