If a device is lost or stolen

Your notes are still on your other devices and sync targets. What matters now is whether someone else could read or change them.

What a finder can read

• A locked device (passcode set): the device’s key for the vault is in its Keychain, usable only once the device is unlocked. Your notes stay encrypted. Attachments cached on the device are protected by the system’s data protection.
• An unlocked device, or a known passcode: assume they can read whatever that device could read, and that it can still write to your vault until you remove it.

Anyone holding the locked device could still record a quick voice note into your vault, if quick voice notes were on. They cannot listen to your notes.

What to do

1. Lock or erase the device with Find My (iCloud.com/find or another of your devices).
2. Cut its access to your storage: remove it from your Apple Account (for an iCloud Drive target), or change the password of a WebDAV server or file share it used. Sempere cannot do this part for you.
3. Remove it from the vault, on the device that manages devices: Settings ▸ Sync & Devices ▸ Devices, touch and hold the lost device, Remove…, turn on Lost or Stolen, Remove. The vault gets a new key at once; nothing written afterward reaches the lost device. With Lost or Stolen, devices it approved while it managed devices are removed too.
4. If the lost device was the one that managed devices, you cannot remove it from another device directly. Take over first: on a device you still have, Settings ▸ Sync & Devices ▸ Devices ▸ Take Over with Recovery Kit…, scan or type the kit, and uncheck the lost device under Keep these devices. That device then manages devices, and the lost one is off the list.
5. Replace the recovery kit if the lost device made the current kit (the removal sheet says so), or if the kit itself may be in the wrong hands. If you want old files to stop opening with the lost device’s key as well, use Re-encrypt Everything… instead.

The tutorial Replace a lost or broken device walks through each case, including losing your only device.

What removal does not undo

• Whatever the lost device already decrypted, exported or copied stays readable to whoever has it. So do older copies of the vault’s files (backups, a provider’s version history), which still open with the keys of the time; Re-encrypt Everything… covers the vault and its targets, never those copies.
• While it can still reach your storage, a removed device could upload files. Your devices set them aside and never read them as notes; cutting its storage access (step 2) stops that.
• A device that was offline during the removal learns of it when it next syncs.