App Store export compliance: what to answer about encryption
If your app only uses encryption that comes with iOS, which for most apps means HTTPS through URLSession, you answer the questions, upload nothing, and never think about it again. Apple's own wording is that "the use of encryption that's built into the operating system, for example, when your app makes HTTPS connections using URLSession, is exempt from export documentation upload requirements".
The reason the questions feel alarming is that they are not Apple's questions. Encryption is a controlled export under US law, and Apple is distributing your software worldwide, so it has to ask. The questions are compliance plumbing, not a review criterion.
This page is not legal advice. If your product's whole point is cryptography, talk to someone qualified.
What Apple is actually asking
Two things, in sequence.
Does the app use, contain, or incorporate encryption at all? Almost certainly yes. HTTPS counts. Keychain counts. CryptoKit counts. Answering "no" because you did not write any crypto yourself is the most common mistake on this page.
If yes, what kind? This is the question that decides whether you upload anything, and Apple reduces it to three cases.
The three cases, and what each one needs
Apple's documentation reference states the requirement per encryption type. Reproduced faithfully:
| What your app uses | What you must upload |
|---|---|
| Encryption limited to that within the Apple operating system | No documentation required in App Store Connect |
| An industry standard algorithm, not provided within the Apple operating system | Your French encryption declaration, in App Store Connect |
| Proprietary encryption algorithms not accepted by international standard bodies (such as IEEE, IETF, or ITU) | A US Commodity Classification Automated Tracking System (CCATS) file, and your French encryption declaration |
The French declaration is only required if you are distributing your app on the App Store in France.
Apple's overview page names the standards bodies it means more fully: IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA and GSMA. "Proprietary" in this context means an implementation involving unpublished cryptographic functionality, including algorithms or protocols not adopted by those bodies.
What an HTTPS-only app answers
This is the case for the overwhelming majority of apps, so it is worth spelling out.
Your app calls an API over HTTPS. It may store a token in the Keychain. It may hash something with CryptoKit. It does not implement its own cipher.
You are in row one. Encryption is present, it is the operating system's, and no documentation is required in App Store Connect. Answer accordingly and move on.
The same is true if you use a well-known third-party TLS or crypto library that implements published standards, in the sense that you are not shipping proprietary cryptography. Whether that puts you in row one or row two turns on whether the algorithm is "provided within the Apple operating system", and a bundled OpenSSL arguably is not.
Stop being asked on every upload
Answering these questions on each build gets old, and it is the reason people click through them carelessly. There is a permanent fix: declare the answer in the app itself.
Two Info.plist keys exist for this. Apple describes them as:
ITSAppUsesNonExemptEncryption, "A Boolean value indicating whether the app uses encryption."ITSEncryptionExportComplianceCode, "The export compliance code provided by App Store Connect for apps that require it."
For an app whose encryption is exempt from documentation, set ITSAppUsesNonExemptEncryption to false. Note the double negative carefully: false means "this app does not use non-exempt encryption", which is what an HTTPS-only app is saying. It does not mean "this app has no encryption".
If Apple has approved documentation for you and given you a code, put that in ITSEncryptionExportComplianceCode and the questions stop as well.
Once either key is present, App Store Connect and TestFlight stop prompting on upload. This is the single most useful thing on this page for a team shipping frequently.
When documentation is genuinely required
Three situations, and only three.
You ship proprietary cryptography. You wrote a cipher, or you use a protocol no standards body has adopted. This needs a CCATS from the US Bureau of Industry and Security, and it is not a same-week process.
You ship a standard algorithm that is not the operating system's, and you sell in France. This needs the French encryption declaration.
Your app's function is cryptographic in a controlled way. Encrypted messaging, VPN clients, disk encryption, key management products. These are the categories where the paperwork is real and where professional advice earns its cost.
For everything else, including every app that talks to a server over TLS and stores a token, there is nothing to upload.
Apple's help notes that France exempts banking and medical applications from its encryption controls for secure storage, secure communications and anti-virus applications, which narrows the French declaration further for those categories.
Uploading documentation, and the status it produces
If you do need to upload, the flow is in App Store Connect under app encryption documentation. Apple reviews the file and, once approved, gives you a key value you attach to a beta build or app version and put in Info.plist.
While that review is happening, your version can show the status Waiting for Export Compliance, which App Store Connect defines as "Your CCATS file is in Apple's export compliance review process."
That status is worth recognising, because it looks like an App Review delay and is not one. It is a separate queue, in a different part of Apple, and pinging App Review about it will not help.
The year-end self-classification report
This is the part of export compliance that has nothing to do with App Store Connect and gets missed because of it.
Apple's wording: "If your app uses exempt forms of encryption, you might alternatively be required to submit a year-end self-classification report to the U.S. government." Apple links to the US Bureau of Industry and Security's guidance on filing an Annual Self Classification Report.
Two honest observations. First, this is a filing to a government agency, not to Apple, and Apple does not do it for you. Second, Apple's phrasing is "might alternatively be required", and it does not tell you whether your specific app qualifies, because that is a question about US export regulations and your company, not about the App Store.
Whether it applies to a solo developer shipping an app that uses TLS is exactly the sort of question where the honest answer is that Apple does not say and this page cannot tell you. Read the BIS guidance, and if the answer is not obvious, ask someone whose job it is.
Getting this wrong, and how
The failure modes are unevenly distributed. Two are common, and neither is dramatic.
Answering "no encryption" when you use HTTPS. This is an inaccurate declaration on a legal question. Nothing usually happens, and that is the problem, because the incentive to answer carelessly is high and the correction cost is zero. Answer it accurately.
Setting ITSAppUsesNonExemptEncryption to true by accident. Some templates and cross-platform toolchains set it, or an old build set it and nobody revisited. The symptom is App Store Connect asking for documentation you do not need, on every single upload. Check the built app's Info.plist, not just the source, because a build system can inject it.
The rarer failure is a genuine crypto product treating this as a formality, discovering mid-launch that a CCATS is weeks away, and having no launch date. If your app encrypts things as its actual purpose, start the paperwork before you start the marketing.
AppSubmit surfaces the export compliance answer as part of the pre-submission checklist rather than a per-upload prompt, because the honest fix is the Info.plist key and a tool should tell you that once rather than ask you eight times.