How do you protect sensitive data on iOS?

Direct answer

What a strong answer covers

How it works

Protection starts with collecting less and keeping it for less time. Credentials and tokens go in the Keychain with an accessibility class that matches their use, such as whenUnlockedThisDeviceOnly; keys that must never leave the device use the Secure Enclave. Files get NSFileProtectionComplete or CompleteUntilFirstUserAuthentication so they are encrypted while the device is locked. All traffic uses TLS with App Transport Security left on, and pinning only where the threat model justifies its operational cost. Authorisation decisions happen on the server; a secret embedded in the binary is public, and obfuscation only delays extraction.

Example

A health app stores the session token in the Keychain with whenUnlockedThisDeviceOnly, writes exported reports with complete file protection, and blurs the app switcher snapshot so the last screen is not visible. The API key for the analytics vendor is not treated as secret because it is in the binary; instead the vendor restricts it to the bundle ID and the server rate-limits it.

Common mistakes

• Putting a signing secret in the app and trusting obfuscation.
• Disabling App Transport Security to talk to an HTTP endpoint.
• Storing PII in UserDefaults, which is unencrypted and included in backups.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.