Scans of passports, contracts and medical letters end up in Photos and Files, where anyone with the passcode can open them.
Files app folders are not private
Files has no lock. iCloud Drive syncs the folder to every device on the account and to the web.
Use a vault that takes documents
Vaultpod accepts any file type, not only photos. Add, From Files, pick the PDFs. They are encrypted like everything else, shown in the grid with a preview of page one, and open in a built-in PDF viewer without a decrypted copy ever hitting the disk. Other document types are stored and exported but not previewed.
Filter and folders
The grid filter shows Documents only; folders keep passports apart from holiday photos.
When you need to send one
Open it, Export, Share. The decrypted copy exists only for the share sheet and is removed afterwards.