ITSAppUsesNonExemptEncryption = false — the wrong reflex of Flutter apps that encrypt

ITSAppUsesNonExemptEncryption = false

The reflex of most Flutter apps that encrypt their local database. And it's wrong!

You ship sqlite3mc, so AES-256 on your data. Apple's exemptions only cover OS crypto, TLS, authentication, DRM and medical. Nothing for your case.

That plist box isn't a technical setting — it's an answer to an EAR classification question.

Two notes decide

• Note 4 decontrols a product whose primary function is not storing or processing information, and whose crypto is limited to supporting that function. A local-first inventory stores information by definition. It doesn't save you.
• Note 3 takes over. It decontrols consumer software: sold at retail, crypto not modifiable, installable without assistance. An App Store app ticks all three. You move from the heavy controlled category to mass market. No more licence or CCATS, but mass market keeps its obligations: an ERN registration with BIS and an annual report. One hour per year.

The bad temptation

Removing the encryption to make the false true. You trade real security for administrative comfort. Bad math.

Not one, but two filings

1. On the American side, the EAR export registration with BIS.
2. On the French side, the ANSSI filing under article 30 III: publishing an encrypting app from France remains a supply of a cryptology means.

Neither exempts you from the other.

Quick glossary

• EAR: Export Administration Regulations, the US export rules covering encryption.
• BIS: Bureau of Industry and Security, the US agency that administers the EAR and receives registrations.
• ERN: Encryption Registration Number, the number issued by BIS when you register your encrypting app.
• CCATS: BIS's heavy classification procedure, which mass market exempts you from.
• ANSSI: the French cybersecurity agency, recipient of the article 30 III filing.
• Info.plist: the configuration file of an iOS app, where the ITSAppUsesNonExemptEncryption key lives.