LaunchLint Academy
The short answer
Apple asks about encryption for TestFlight and App Store releases. Inventory HTTPS, operating-system services, third-party SDKs, and custom cryptography before selecting a declaration.
- ITSAppUsesNonExemptEncryption can streamline recurring questions but does not replace correct classification. Seek qualified advice for legally unclear or non-standard implementations.
Evidence required for release
Do not review apple export compliance and encryption declarations as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Keep three evidence layers separate for Apple export compliance and encryption declarations: statically visible project configuration, behavior on a clean device, and external settings in Apple Developer, App Store Connect, or Play Console. The review is reliable only when those layers describe the same release candidate. Give every mismatch an owner and a stop condition instead of assuming a default will be correct.
Evidence required for release
- Production value for inventory the technical scope identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
1. Inventory the technical scope
List networking, secure storage, authentication, VPN, messaging, media, local databases, and every cryptographic SDK.
Do not review inventory the technical scope as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for inventory the technical scope identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
2. Separate OS and custom cryptography
Distinguish Apple-provided encryption, standard libraries, and proprietary or unpublished methods.
Do not review separate os and custom cryptography as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for separate os and custom cryptography identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
3. Include third-party SDKs
Bundled libraries may contain encryption. Review vendor documentation and the functions actually used.
Do not review include third-party sdks as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for include third-party sdks identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
4. Follow the App Store questions
Answer for the concrete build, territories, and features. Never copy a response blindly from another project.
Do not review follow the app store questions as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for follow the app store questions identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
5. Set the Info.plist key correctly
ITSAppUsesNonExemptEncryption indicates non-exempt encryption use and must match the technical and legal determination.
Do not review set the info.plist key correctly as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for set the info.plist key correctly identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
6. Manage documents and approval code
If documentation is required, plan review time, build assignment, and secure handling of the compliance code.
Do not review manage documents and approval code as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for manage documents and approval code identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
7. Resolve Expo and native config
Inspect the final Info.plist value produced by app config, plugins, or native projects.
Do not review resolve expo and native config as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for resolve expo and native config identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
8. Version the decision
Record sources, libraries, product changes, and date. New cryptography or territories can require reassessment.
Do not review version the decision as an isolated switch. Connect it to Apple export compliance and encryption declarations, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for version the decision identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
Frequently asked questions
Does HTTPS count as encryption?
Yes technically. Whether documentation is required depends on Apple’s questions and applicable exemptions.
Should ITSAppUsesNonExemptEncryption always be false?
No. It must truthfully match the cryptography and its classification.
Is this guide legal advice?
No. It explains technical evidence and Apple’s workflow. Obtain qualified advice for uncertain export controls.
Can LaunchLint decide the legal exemption?
No. It can identify keys, SDK signals, and contradictions but cannot issue a binding export classification.