# TestFlight Missing Compliance: How to Fix It for Good

> Missing Compliance means Apple is waiting for your encryption declaration. Unblock the build in App Store Connect, then set the key so it never comes back.

Original page: [TestFlight Missing Compliance: How to Fix It for Good](https://devoria.fr/en/blog/testflight-missing-compliance-fix)
Author: [Mehdi Azizi](https://devoria.fr/en/mehdi-azizi)
Published: 2026-11-06
Content last revised: 2026-11-06


**Missing Compliance isn't an error. It's a build waiting for your answer about encryption.** Until you answer, the build stays blocked for your testers. For this build, you answer the questions in the TestFlight tab of App Store Connect. For future builds, you add the ITSAppUsesNonExemptEncryption key to your Info.plist, or `ios.config.usesNonExemptEncryption` to your app.json with Expo, and the status stops coming back.

I build my iOS apps with Expo. In Solys's app.json, the key is set to `false`, and it's set twice: in `ios.config` and in `ios.infoPlist`. This guide follows Apple's pages on [build statuses](https://developer.apple.com/help/app-store-connect/reference/app-uploads/app-build-statuses/) and on [export compliance for beta builds](https://developer.apple.com/help/app-store-connect/test-a-beta-version/provide-export-compliance-information-for-beta-builds/), which I reread on November 6, 2026.

## What Missing Compliance means

Apple's list of build statuses defines it in one sentence: the export compliance documentation is missing, and you need to take action. Apple shows it in yellow, the color for a process in progress that depends on you or on Apple, and its description says you need to take action.

Why does Apple ask? The [page on encryption export regulations](https://developer.apple.com/documentation/security/complying-with-encryption-export-regulations) explains it: when you upload a build to TestFlight or the App Store, you're uploading it to a server in the United States. If your app is distributed outside the United States and Canada, it falls under US export law, no matter which country your company is in. And as soon as an app uses, contains or incorporates encryption, Apple treats it as an export of encryption software.

**The result: with every new version, App Store Connect asks you the compliance questions, unless your Info.plist already answers them.** That's why a first Expo build almost always lands in Missing Compliance.

## Unblock the build that's waiting

These steps come from Apple's page on export compliance for beta builds. You need the Account Holder, Admin or App Manager role.

1. In Apps, open your app, then the TestFlight tab.
2. In the sidebar, under Builds, choose the platform.
3. In the Build column, click the icon or number of the build.
4. Click Provide Export Compliance Information, then answer the questions.
5. If Apple asks for documentation, click Go to App Encryption Page to upload it. Otherwise, click Save.

Apple also describes the shortcut: next to the build, the Manage link opens the same questions, and Choose File lets you attach documentation that's already been approved. Once saved, the build moves to Ready to Submit, or straight to Testing if it's going to an internal group. Ready to Test only comes after the beta review for external testers.

**The Manage link isn't clickable?** First check your role on the team: Apple only lets the Account Holder, Admin and App Manager roles answer. A Developer or Marketing account can't. Apple doesn't document any other cause. If you just uploaded the build, wait for the processing-complete email, covered in the guide on [build number and version](https://devoria.fr/en/blog/app-store-connect-build-number-version), then reload the page.

## Never answer again: the key in your project

Apple says it on the beta builds page: you can declare in your Info.plist that your app doesn't use encryption, or that it's exempt, and you no longer have to answer on every submission. The key is called [ITSAppUsesNonExemptEncryption](https://developer.apple.com/documentation/bundleresources/information-property-list/itsappusesnonexemptencryption). Xcode displays it as App Uses Non-Exempt Encryption.

| Your tool         | File         | Where                          | Value |
| ----------------- | ------------ | ------------------------------ | ----- |
| Expo (EAS Build)  | `app.json`   | `expo.ios.config`              | false |
| Expo, other way   | `app.json`   | `expo.ios.infoPlist`           | false |
| Bare React Native | `Info.plist` | App Uses Non-Exempt Encryption | NO    |
| Xcode, Swift      | `Info.plist` | App Uses Non-Exempt Encryption | NO    |

With Expo, the key is called `usesNonExemptEncryption`, and the [config reference](https://docs.expo.dev/versions/latest/config/app/) states that it writes Apple's key into the build's Info.plist, and that `ios.config` is build-only: it doesn't show up in the production manifest.

```json
{
  "expo": {
    "ios": {
      "config": {
        "usesNonExemptEncryption": false
      }
    }
  }
}
```

With Expo, `ios.infoPlist` also accepts the key under its Apple name, with the same value: that's the second line in Solys's app.json. In a native project, the same declaration is one line in Info.plist: the App Uses Non-Exempt Encryption key (the name Xcode displays) with the value NO. The value is a boolean, not a string.

**The key takes effect on the next build.** The build you already uploaded stays in Missing Compliance until you answer in App Store Connect. The two actions don't replace each other, they work together.

## false or true: how to decide

Apple defines NO like this: your app, third-party libraries included, uses no encryption, or only encryption that's exempt from the documentation requirements. Otherwise, it's YES.

What's generally exempt, according to the export regulations page: encryption built into the operating system, like HTTPS connections through URLSession. What isn't: proprietary encryption that you wrote or bundled. The [export compliance overview](https://developer.apple.com/help/app-store-connect/manage-app-information/overview-of-export-compliance/) adds a reminder that matters: you're responsible for the interpretation, and for the consequences, if you wrongly claim an exemption.

For an Expo app that calls an API over HTTPS, stores preferences and sells a subscription, `false` is the usual answer. For an app that encrypts messages, files or a vault itself, the answer is `true`, and Apple expects documentation.

> Don't set `false` on autopilot. Go through your dependencies: an end-to-end encryption library or homemade encrypted storage puts you on the documentation side.

## If your app uses non-exempt encryption

The [page on encryption documentation](https://developer.apple.com/help/app-store-connect/manage-app-information/determine-and-upload-app-encryption-documentation/) describes the process. In App Information, next to App Encryption Documentation, the add button opens the questions, then Choose File for the document, then Save. Apple asks you to fill in the app description and set its availability first, so it can judge whether the documentation is enough. It aims for about two business days when the file is complete.

Once the documentation is approved, Apple gives you a value to put in the `ITSEncryptionExportComplianceCode` key of your Info.plist. With it, no more questions on every upload. During the review, your build shows Waiting for Export Compliance Review or In Compliance Review: you don't need to do anything.

Two points Apple flags, one on the export regulations page, the other in the compliance overview:

- **Even with exempt encryption, an annual self-classification report to the US government may be required.** It isn't if you use non-exempt encryption and you've provided the documentation to Apple.
- **France also controls the import and export of encryption apps.** Apple's overview lists secure storage, secure communications and antivirus as affected areas, with exemptions for banking and medical apps, and points to ANSSI.

## What happens next in TestFlight

The unblocked build follows the normal life of a TestFlight build, described in the guide [TestFlight for testing your iPhone app](https://devoria.fr/en/blog/testflight-test-iphone-app-before-submitting): internal testers right away, external testers after the beta review, and expiration after 90 days, according to the list of build statuses. The other ways an Expo upload can stall, like a build number that's already been used or a rejected file, are in [EAS upload errors to App Store Connect](https://devoria.fr/en/blog/eas-submit-ios-errors-fixes), and the full pipeline is in [publishing an Expo app to the App Store with EAS](https://devoria.fr/en/blog/eas-submit-ios-publish-expo-app-store).

The [iOS & Android Kit](https://devoria.fr/en/kits/ios) includes my Expo starter code, with this key already set, and the path from your first build to your App Store listing. If you want to know what's still blocking your release, the [free diagnostic](https://devoria.fr/en/diagnostic) tells you in a few questions and sends you my checklist for avoiding Apple rejections. The full steps are in [publishing an app on the App Store](https://devoria.fr/en/expertise/publish-an-app-on-the-app-store).

## Frequently asked questions

### What does Missing Compliance mean on TestFlight?

The build is waiting for your export compliance declaration, meaning your answer about encryption use. Apple lists it among the statuses that need action from you. The build doesn't go out to testers until you answer.

### Why isn't the Missing Compliance Manage link clickable?

Check your role: Apple only lets the Account Holder, Admin and App Manager roles answer. Apple doesn't document any other cause. If the build just arrived, reload the page after the processing-complete email.

### My app only uses HTTPS, do I have to answer yes to encryption?

Apple says encryption built into the operating system, like HTTPS connections through URLSession, is generally exempt from the documentation requirements. In that case, the ITSAppUsesNonExemptEncryption key is NO, as long as no third-party library adds proprietary encryption.

### Do I have to answer the encryption questions for every build?

Yes, as long as your Info.plist doesn't contain the ITSAppUsesNonExemptEncryption key. With it, App Store Connect stops asking. With Expo, you set it in app.json with `ios.config.usesNonExemptEncryption`.

### Where do I declare encryption in app.json with Expo?

In app.json, under `expo.ios.config`, with `"usesNonExemptEncryption": false` if your app uses no non-exempt encryption. EAS Build writes the key into the build's Info.plist. It takes effect on the next build, not on the one you already uploaded.

### Does Missing Compliance also block App Store submission?

The export compliance questions apply to every new version, beta or App Store. A build that hasn't answered them can't be distributed. The key in your Info.plist handles both cases at once.

### Do I need to file an annual self-classification report?

Apple notes that using exempt encryption can still require an annual self-classification report to the US government, and points to the official procedure. If your app uses non-exempt encryption and you've provided the documentation to Apple, this report isn't needed.


## Your project

[Review Kit](https://devoria.fr/en/kits/app-review): My App Store review checklist, the Apple rejections I fixed, a Google Play checklist and three Claude Code skills. $55.

[iOS & Android Kit](https://devoria.fr/en/kits/ios): Build your iPhone and Android app with Claude Code: the starter code from my apps, the path all the way to the stores, and every kit. $109.

[Diagnostic: what's between you and your iPhone app](https://devoria.fr/en/diagnostic): 7 questions, 60 seconds: find out what's really stopping you from publishing your iPhone app, get your 4-step path and the kit that fits you.