Hi!
This is a general question about iOS app distribution, but it regards our use of Bluetooth Mesh. I know it is each company's own responsibility to make sure they comply with regulation, but I'd like a hint at what is required. We're about to publish an iOS app with Bluetooth Mesh communication with NRF52832 devices. What kind of "declaration of encryption" is needed for Apple's AppStore / Testflight (Appstore Connect)? It actually comes down to US regulation, as Apple states:
"Apps uploaded to App Store Connect are uploaded to an Apple server in the United States. When you submit your app with the intention of distributing your app on the App Store or to external testers through TestFlight outside of the U.S. or Canada, it is considered a U.S. export and is subject to U.S. export laws (regardless of where your legal entity is based).
If your app uses, accesses, contains, implements, or incorporates encryption, this is considered an export of encryption software, and is therefore subject to U.S. export and other country import compliance requirements."
https://help.apple.com/app-store-connect/#/dev88f5c7bf9
I suppose this is something almost everybody launching an app goes through since it is required (at least) if your app:
"
Making calls over secure channels (i.e. HTTPS, SSL, and so on).
Using standard encryption algorithms.
Using crypto functionality from other sources such as iOS or macOS.
"
(from same link as above)
There are some exemptions you could be eligible for, but I'm very uncertain. Here is a description of how complex it may get
https://medium.com/@cossacklabs/apple-export-regulations-on-crypto-6306380682e1
What about the nRF Mesh app? Could you invoke any exemption for that, or did you have to send documents specifying your encryption? If so, is there any resource we could tap into?
Thank you!
