[xnyhps]

To add to this: there are two different types of Data Vaults. For locations such as ~/Pictures, ~/Documents, Calendars, Contacts, etc. a permission prompt is triggered if an app tries to access it. Other locations, such as where Mail and Safari keep their data, can not be allowed from a prompt. Those require "Full Disk Access" for third-party software to gain access, which you should give only to applications that really need it, such as a backup tool.

Anything not on those locations is not protected, so there's no Data Vault for Chrome's cookie file, for example.

[olliej]

Is there an API that allows apps to construct data vaults? I assumed that there would be, but I also generally don't write code at that level in the stack