Stuck in Missing Compliance: ITSAppUsesNonExemptEncryption
Without ITSAppUsesNonExemptEncryption in Info.plist, App Store Connect asks the export compliance questions on every single upload, and the build sits in Missing Compliance until somebody answers them. Setting the key answers them once, in the build.
Why it matters
This does not block anything permanently. It is a recurring interruption: every build you upload waits for a human to click through the same questions before it can go to TestFlight or review.
The value is not a formality. An app needs an export compliance determination if it uses standard encryption algorithms, accesses the operating system’s crypto functionality, or implements proprietary or non-standard cryptography, and almost every app that makes an HTTPS request is using encryption in the relevant sense.
What decides the value is whether your use is exempt, not whether you wrote any cryptography. Using standard encryption through the system is a different position from implementing your own, and only the second generally needs documentation attached to the build.
The value is a boolean, and it is one of the few Info.plist keys where the type matters visibly: written as the string "false" rather than the boolean false, App Store Connect goes on asking, and the key looks set to anyone reading the file.
It also has to be in the Info.plist that ships, not only in the one you edit. A project that generates Info.plist from build settings needs the key added there, or it is absent from the build while present in the repository.
How to fix it
- Decide which case your app is in, using Apple’s export compliance overview rather than assuming HTTPS does not count.
- Add ITSAppUsesNonExemptEncryption to Info.plist with the value that matches, as a boolean rather than a string.
- If your use is not exempt, obtain the documentation and attach it to the build before submitting.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Export compliance declaration. ITSAppUsesNonExemptEncryption avoids a manual export-compliance step on every upload.
- Whether ITSAppUsesNonExemptEncryption is present in Info.plist.
- Reported as an improvement rather than a risk, because it costs upload time rather than an approval.
- Reads the value from the Info.plist the target actually uses, so a key set somewhere the build does not read is reported as absent.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.