Export compliance and encryption for the App Store
What export compliance means for your app
When you distribute an app through the App Store, you are exporting software, and software that contains encryption can fall under US export regulations. Apple cannot make this determination for you, so it asks you to declare it. The declaration is a yes or no answer to one core question: does your app use, contain, or incorporate encryption that is not exempt from export documentation requirements?
The key word is non-exempt. A large share of apps use only exempt encryption and can answer no. Encryption that is built into the operating system, for example an HTTPS connection made with URLSession, is generally exempt. Encryption you implement yourself with a proprietary algorithm is more likely to be non-exempt.
How to answer the encryption question
You have two ways to record the answer, and they do the same thing:
- Set it in Info.plist. Add the ITSAppUsesNonExemptEncryption key with a boolean value. Set it to NO if your app, including any third-party libraries it links against, uses no encryption or only exempt forms. Set it to YES otherwise. When this key is present, App Store Connect stops asking on every upload.
- Answer it in App Store Connect. If the key is missing, App Store Connect shows a Missing Compliance warning on the build and asks the encryption question before you can use that build. You answer it once for that build.
If you answer YES, App Store Connect walks you through follow up questions to decide whether you still qualify for an exemption or whether you need to provide documentation. Apps that need it may have to file an annual self classification report and store a copy of the compliance approval. Once approved, App Store Connect can give you an ITSEncryptionExportComplianceCode that you add to Info.plist to streamline future uploads.
If you distribute in France
France has its own encryption rules that are separate from the US ones. If your app implements encryption and you make it available in France, you may have additional declaration requirements there even when your US answer is exempt. Apple's export compliance pages describe the current French documentation requirement, so review them if France is one of your storefronts.
Where AppFlight fits
AppFlight builds your app and runs the full App Store submission flow, and the encryption declaration is part of that flow. It sets the ITSAppUsesNonExemptEncryption value during the build so the Missing Compliance warning does not stall your upload. Because the declaration is a legal statement, you stay responsible for confirming it is accurate, especially if you or a connector add custom encryption beyond the standard system networking that most apps rely on.
FAQ
Does my app use non-exempt encryption?
Probably not, if it only uses encryption built into the operating system, such as HTTPS connections through URLSession. That kind of use is generally exempt. Proprietary or custom encryption you add yourself is more likely to be non-exempt and may require additional documentation.
What is the Missing Compliance warning in App Store Connect?
It means a build was uploaded without an encryption declaration. You can answer the encryption question in App Store Connect for that build, or set the ITSAppUsesNonExemptEncryption key in Info.plist so the question is answered automatically on every upload.
Does AppFlight handle export compliance?
AppFlight sets the encryption declaration as part of building and submitting, so the Missing Compliance warning does not block your build. You are still responsible for confirming the declaration is accurate for any custom encryption you add, since it is a legal statement.