Export compliance rejection: Encryption declaration (ITSAppUsesNonExemptEncryption)
How the rejection usually reads: "Missing Compliance" in App Store Connect / "your app uses encryption; provide export compliance documentation"
Why it happens
Every build has to answer whether it uses non-exempt encryption. Standard HTTPS is exempt; a custom cipher is not. Leaving the key out of Info.plist stalls every submission with a question in App Store Connect; declaring false while the binary links CryptoKit or CommonCrypto for something beyond TLS can be questioned later. Set ITSAppUsesNonExemptEncryption explicitly and honestly.
What can be checked before you submit
2 of RejectProof’s checks map to Export compliance. Each one reads your .ipa — no upload — and reports the evidence with a fix.
- ITSAppUsesNonExemptEncryption key missing
PB-17 · guideline export compliance · likely rejection
Add the ITSAppUsesNonExemptEncryption key to Info.plist and set it to false (if you only use standard HTTPS/TLS) or true plus export compliance documents. Expo: app.json → expo.ios.config.usesNonExemptEncryption.
- Encryption declaration may contradict binary contents
PB-18 · guideline export compliance · warning
If you only use standard HTTPS/TLS you can ignore this warning. If you implement a custom encryption algorithm, set the declaration to true and prepare export compliance documentation.
What a scan cannot tell you
Static checks read the build; they do not run it. Whether a reviewer likes your design, agrees with your content, or considers the app “sufficiently different” is their call. Fix the mechanical layer first so the human review is about your product, not about a missing plist key.