The encryption question is an export compliance questionnaire App Store Connect shows for new builds, because US law treats an app with encryption as an export. Setting ITSAppUsesNonExemptEncryption to NO in Info.plist removes it when your app uses no encryption or only kinds that need no documents (Apple's help, checked October 16, 2026).
Why Apple asks about encryption
When you upload a build for TestFlight or the App Store, it goes to a server in the United States. If you distribute the app outside the US or Canada, US export laws apply to it no matter where your company is registered. Encryption inside the app counts as an export of encryption software, and the import rules of the countries where it's sold come on top.
Apple counts standard algorithms, the operating system's own crypto and proprietary non-standard algorithms as encryption. It says plainly that the answer, and any wrongly claimed exemption, is the developer's responsibility.
Where the question lives in App Store Connect and Xcode
Until you answer, the build shows the yellow Missing Compliance status on the TestFlight tab, with a Manage button next to it that opens the questions. Documents go to App Store Connect › Apps › your app › App Information › App Encryption Documentation through the + button, then Choose File and Save. The Account Holder, Admin and App Manager roles can do this. Other statuses are covered on the build processing page.
To stop the question from coming back with every upload, record the answer in your app target's Info.plist. ITSAppUsesNonExemptEncryption set to NO says the app, libraries included, uses no encryption or only exempt kinds. YES goes together with ITSEncryptionExportComplianceCode, which holds the code Apple issues after reviewing your documents.
Which documents you need
| Case | What you need |
|---|---|
| Encryption only through Apple's operating system, such as HTTPS with URLSession | no documents, the key set to NO |
| A standard algorithm not provided by the system | a French encryption declaration if the app is sold in France |
| A proprietary algorithm not accepted by IEEE, IETF or ITU | a US CCATS and the French declaration |
| Document review | about 2 business days with complete information |
| Annual report to BIS | by February 1 of the following year, CSV only |
| Report for mass market products | no longer needed for most since March 29, 2021 |
Per App Store Connect Help (encryption documentation, uploading documents), Apple's documentation, EAR § 740.17 and the BIS rule of March 29, 2021, checked October 16, 2026.
How to answer the encryption question
- List every use of encryption in the app and in all its libraries. Apple gives HTTPS through URLSession as an example of system encryption, while a third-party crypto library or your own protocol is a different case.
- Answer the App Store Connect questions, and it will tell you from your answers whether you need documents and which ones.
- If you don't, add ITSAppUsesNonExemptEncryption set to NO to Info.plist. Later builds arrive without the question.
- If you do, fill in the app description and the countries where it's sold first, then upload the CCATS or the French declaration under App Encryption Documentation.
- Once approved, copy the code shown next to the document into ITSEncryptionExportComplianceCode and set ITSAppUsesNonExemptEncryption to YES.
- If you self-classified the product under US rules, work out whether you owe BIS an annual report, and file it by February 1.
Common mistakes
- Answering NO and forgetting the libraries. The key covers the app together with every library it links, and the developer carries the consequences of a wrong answer.
- Leaving the key out of Info.plist. App Store Connect then asks on every upload, and each new build sits in Missing Compliance until you answer.
- Uploading documents before the description. Without the app description and the countries where it's sold, Apple can't tell whether your documents are enough.
- Forgetting France. The French government controls the import and export of encryption apps there, mainly secure storage, secure communications and antivirus apps. Banking and medical apps are exempt, with details on the ANSSI website.
The annual self-classification report
Apple warns that with exempt encryption you might have to send the US government a year-end self-classification report, and that you don't need one if you provided documents. The rules come from the Bureau of Industry and Security of the US Department of Commerce (BIS), in EAR § 740.17(e)(3).
The report covers a calendar year and is due by February 1 of the next one, as a CSV file only. You don't file it if there were no exports of such products that year, or for products with a CCATS. A BIS rule of March 29, 2021 lifted the duty for most mass market encryption products. Under the current text of § 740.17(e)(3) it remains for mass market components and their executable software, and for non-mass-market products in categories 5A002, 5B002 and 5D002. Which group your app falls into is the app owner's call, Apple doesn't decide it for you.
Appto uploads the build to App Store Connect and runs the final checklist, waiting for your yes before every write to the account. More on the App Store Connect page.
Questions
What do I answer if my app only uses HTTPS?
Apple treats encryption built into the system, such as HTTPS through URLSession, as exempt from uploading documents. You then set ITSAppUsesNonExemptEncryption to NO, provided your libraries don't bring their own encryption.
What does Missing Compliance mean in TestFlight?
The build has no answer to the encryption question. Press Manage next to the build and answer, and add the key to Info.plist so the status doesn't come back.
How long does Apple take to review encryption documents?
According to App Store Connect Help as of October 16, 2026, Apple looks at each case separately and expects about 2 business days when the information is complete.
When do I need the French encryption declaration?
Only if the app is sold on the App Store in France and uses a standard algorithm not provided by the system, or a proprietary one. Encryption through the system doesn't need it.
Do I have to file the annual report with BIS?
For most mass market products, no, since March 29, 2021. The February 1 report remains for mass market components, their executable software and non-mass-market encryption without a CCATS.
Build your own app in Appto
Appto checks the niche on fresh App Store data, designs the screens, writes the code, builds the App Store page and submits to Apple from your account or shows you what to press in App Store Connect. Runs on your own Claude Code or Codex.
Download for Mac