We found that your app description states: Encryption

my app get rejected for that reason. basic feature of my is to provide vpn service with only IKEv2 protocol.

in app description i mention that

(Name) App Offers:

- Blazing Fast Speed

- 99.9% Uptime

- 256-bit AES Encryption

- Free Ad-Blocker

- 24x7 Technical Support

- Unlimited Bandwidth

Basically encryption is handled by vpn server.

for that i need Export Compliance ?



We found that your app description states:


Encryption


However, your app does not have Export Compliance, which does not comply with the Apple Developer Program License Agreement, as required by the App Store Review Guidelines.


Section 2.3 of the Apple Developer Program License Agreement specifies,


"You certify that ℹ none of the Licensed Applications contains, uses or supports any data encryption or cryptographic functions; or (ii) in the event that any Licensed Application contains, uses or supports any such data encryption or cryptographic functionality, You will, upon request, provide Apple with a PDF copy of Your Encryption Registration Number (ERN), or export classification ruling (CCATS) issued by the United States Commerce Department, Bureau of Industry and Security and PDF copies of appropriate authorizations from other countries that mandate import authorizations for that Licensed Application, as required."


Please review your app's encryption ability, and when resubmitting your binary, check the appropriate answers to the questions in the Export Compliance section of iTunes Connect. You may be asked some follow-up questions to determine the level of encryption in your app; you may also be asked to provide a copy of your CCATS.


If you have questions related to export compliance and your app's use of encryption, please contact the App Store Export Compliance team at appstore.ec@apple.com.

Replies

Can you check "yes it uses encryption" and then "yes it qualifies for the exemption" - it's a standard option after you check "yes it uses encryption". All IAPs use OpenSSL to decode the receipt. But because they are only decoding, not encoding, they check "yes" and then "exempt". Same thing with apps that download HTTPS.

our encryption is based on server side, app is not using any external library for encryption. https and token authentication don’t require any export compliance as per my research, after all i need to check the option you have suggested ? For https and token auth ?

Might be simpler to just remove the verbiage "- 256-bit AES Encryption" from the description?