App encryption export compliance helper
Set ITSAppUsesNonExemptEncryption to NO if your app, with every library in it, uses no encryption, or only encryption that is exempt from documentation; Apple says the encryption built into its systems, such as HTTPS through URLSession, is typically exempt. Set it to YES if it uses proprietary encryption. If you bring your own standard algorithms, whether the app is on the App Store in France usually decides it, and App Store Connect's own questions have the final word. Answer the questions below to get your value, the Info.plist lines to paste, and what App Store Connect will ask you to upload, each step linked to the Apple page it comes from.
This is not legal advice. It restates Apple's own pages so you can find the right answer faster; when in doubt, read Apple's page linked on each line or ask a lawyer who knows export rules.
Rules read from Apple's pages on 2026-11-01. Apple can change them; the linked page is the final word.
Question 1
Does your app use, access, contain, implement or incorporate encryption?
Count your third-party libraries and SDKs too. HTTPS connections count, even through Apple's own URLSession: Apple lists crypto functionality within its operating system as encryption that needs an answer here.
What it does
- •Asks up to four yes-or-no questions, worded after the questions Apple uses for app encryption declarations: do you use encryption, is any of it proprietary, do you bring standard algorithms of your own, and are you on the French App Store.
- •Gives the ITSAppUsesNonExemptEncryption value and the XML lines for Info.plist, with a slot for ITSEncryptionExportComplianceCode when Apple will send you a code.
- •Says whether App Store Connect will ask for documents, which ones (a CCATS, the French encryption declaration), where to upload them, and what Apple says about review time, TestFlight and the year-end self-classification report.
- •Links every line to the Apple page it restates, so you can check the wording yourself. Your answers stay in this page; nothing is sent anywhere.
What it does not do
- •It is not legal advice and it does not classify your app under US export law. Apple says that is your responsibility; when in doubt, ask a lawyer.
- •It does not read your code or your libraries. You need to know what encryption your app and its SDKs use.
- •It does not replace the questions in App Store Connect, which also ask where the app will be available. If they lead somewhere else, follow App Store Connect.
- •It does not cover rules Apple's pages do not state, such as other countries' import rules or how to fill in a CCATS request.
- •Apple notes that US export law applies when you distribute outside the U.S. or Canada; this helper does not ask about that and assumes worldwide distribution.
Questions
- Who can upload export compliance documents in App Store Connect?
- Apple's help pages say the Account Holder, Admin or App Manager role can upload export compliance documentation for an app.
- What does ITSAppUsesNonExemptEncryption mean?
- It is a Boolean Info.plist key. NO tells App Store Connect that your app, including the third-party libraries it links against, uses no encryption or only encryption that is exempt from export compliance documentation requirements. YES means it uses non-exempt encryption.
- My app only makes HTTPS calls with URLSession. What should I set?
- Apple says encryption built into the operating system, with HTTPS through URLSession as its example, is typically exempt from documentation upload requirements, so the value is NO and there is nothing to upload. Apple also notes that exempt encryption might need a year-end self-classification report to the U.S. government.
- What happens if I leave the key out of Info.plist?
- App Store Connect walks you through the export compliance questions every time you upload a new version, and a TestFlight build without the answers is marked Missing Compliance until you provide them.
- When do I need the French encryption declaration?
- Apple lists it when your app uses an industry-standard algorithm not provided by Apple's systems, or a proprietary one, and only if you distribute the app on the App Store in France.
- When does Apple ask for a CCATS?
- Apple's table lists a CCATS (the US Commerce Department's commodity classification) for apps that use proprietary encryption algorithms not accepted by international standard bodies such as IEEE, IETF or ITU.
- Where do I put the code Apple sends after review?
- Add it to Info.plist as the string value of ITSEncryptionExportComplianceCode, next to ITSAppUsesNonExemptEncryption set to YES. App Store Connect shows the code next to your approved document.