App Store Export Compliance and ITSAppUsesNonExemptEncryption
Export compliance is the encryption question App Store Connect asks on every submission, and it exists because uploading a build sends your app to a server in the United States: if you distribute outside the U.S. and Canada, your app falls under U.S. export law regardless of where your company is based. The question is not whether your app is secure — it is whether the encryption inside it, including everything your third-party libraries bring with them, needs export documentation. For most apps the answer is no, because encryption provided by the operating system is typically exempt, and one key in the Info.plist ends the question permanently. For apps with proprietary cryptography the answer is yes, and there is paperwork. This guide covers which case you are in, how to clear a build stuck on Missing Compliance, and the obligation people miss even when they are exempt.
By the AscAuto team — engineers who automate App Store submissions and rejection fixes daily. · Last updated: July 2026
Why a U.S. export rule applies to your app at all
This surprises non-U.S. developers most. Apple's own wording is direct: when you submit to TestFlight or the App Store you upload your app to a server in the United States, and if you distribute outside the U.S. and Canada, your app is subject to U.S. export laws — regardless of where your legal entity is based. Because an app that "uses, accesses, contains, implements, or incorporates encryption" counts as an export of encryption software, the question comes with every version. You also inherit the import rules of the countries you ship to.
The one key that ends the question
App Store Connect will ask about encryption on every new version unless you answer in advance in your Info.plist:
<false/> <!-- or <true/> -->
Apple's rule for the value: set it to NO if your app — including any third-party libraries it links against — doesn't use encryption, or only uses forms of encryption exempt from export documentation requirements. Otherwise set it to YES. The clause about third-party libraries is the one that catches people: your dependency's crypto is your declaration.
Is my encryption exempt?
Apple's guidance is that encryption built into the operating system — the example given is making HTTPS connections with URLSession — is typically exempt from export documentation upload requirements, while proprietary encryption is not. In practice that puts most apps in the exempt column:
| Situation | Usual direction |
|---|---|
| HTTPS/TLS through the system networking stack | Typically exempt — no documentation upload |
| Keychain, CryptoKit and other Apple-provided cryptography used normally | Typically exempt |
| A third-party SDK that ships its own crypto implementation | Depends on what it implements — investigate, don't assume |
| Your own encryption algorithm, or a bundled crypto library doing non-standard work | Treat as non-exempt until determined otherwise |
Exempt is not the same as "no encryption". Your app still uses encryption; it just doesn't need documents uploaded. That distinction matters for the report obligation below. If you're unsure which column you're in, App Store Connect's own questionnaire walks you through it and tells you which forms, if any, it needs.
Clearing a build stuck on "Missing Compliance"
The practical failure mode is a build that appears in App Store Connect but can't be submitted or handed to external testers, because the encryption questions were never answered and the Info.plist says nothing. Two places to fix it:
- App Information → App Encryption Documentation, click the add (+) button and answer the questions.
- Or click Manage next to the build flagged as missing app encryption information on the Distribution or TestFlight tab.
You need the Account Holder, Admin or App Manager role to do this — the same role level a submission-capable App Store Connect API key needs. Answering per build works, but adding the Info.plist key is the fix that stops it recurring on every release.
If you do need documentation
Upload the required items in the App Encryption Documentation section before submitting the build for App Review or TestFlight review. Apple asks that your app description and availability are already filled in, because without them it can't judge whether the documents are sufficient. Reviews are case by case, and Apple expects to clear complete submissions in roughly two business days. Once approved you're given a key value — put it in your Info.plist as ITSEncryptionExportComplianceCode and the questions stop coming back.
The obligation people miss while being exempt
Here is the part that gets skipped: Apple notes that if your app uses exempt forms of encryption, you might still be required to submit a year-end self-classification report to the U.S. government — and that this report isn't necessary if you use non-exempt encryption and provide documentation to Apple. So the two paths invert: uploading documents to Apple can remove the reporting duty, while sailing through as "exempt" can leave one in place. Whether it applies to you depends on your product and your company, which is exactly where a checklist stops and legal advice starts.
How AscAuto handles it
Export compliance is one of the items in the pre-submission readiness scan: AscAuto reports whether the version's encryption declaration is missing, and whether a build is sitting in the Missing Compliance state that would block a submission you're about to attempt. Because this is a legal declaration you're making to the U.S. government and to Apple, AscAuto drafts and flags but never answers it silently — like the privacy and age-rating questionnaires, it waits for your explicit approval. The durable fix is the Info.plist key, and that lives in your repository where it belongs.
FAQ
What is ITSAppUsesNonExemptEncryption?
A Boolean key in your Info.plist declaring whether the app uses non-exempt encryption. Per Apple: set it to NO if your app — including any third-party libraries it links against — doesn't use encryption or only uses exempt forms; otherwise YES. Declaring it stops App Store Connect asking on every new version.
Does HTTPS count as encryption for export compliance?
It counts as encryption, but Apple says OS-provided encryption such as HTTPS via URLSession is typically exempt from documentation upload requirements, while proprietary encryption isn't. Exempt is not the same as absent.
Why is my build stuck on Missing Compliance?
The encryption questions weren't answered for that build and the Info.plist doesn't declare anything. Fix it under App Information → App Encryption Documentation, or via Manage next to the build on the Distribution or TestFlight tab. Requires the Account Holder, Admin or App Manager role.
What happens if my app does need export documentation?
Upload the documents in App Store Connect before submitting for review. Apple reviews case by case, expects to clear complete submissions in about two business days, and then gives you a key value to add as ITSEncryptionExportComplianceCode.
Do I still owe a report if my encryption is exempt?
Possibly. Apple notes that exempt apps might still owe a year-end self-classification report to the U.S. government, and that the report isn't necessary if you use non-exempt encryption and provide documentation to Apple. Whether it applies to you is a legal question about your product.