SUP encryption, App Store and US Export Regulations

[Former Member]

Hi all,

I would like to ask you about your experiences with publishing the apps made with SUP in App Store. To be more specific, I would like to as how do you classify the apps that use SUP in the export regulations part. While submitting the app a question is asked whether the application uses cryptography. As SUP encrypts the data stored locally with 256 bit AES it seems that the answer to this question is yes. However that means, the application must be assessed and probably get an ERN (Encryption Registration Number) from US Bureau of Industry and Security. On the other hand there are many exemptions form this requirement and maybe the SUP technology qualifies for one of those exemptions.

There is an official FAQ from Apple about the topic here:

https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/wo/3.0.0.9.1.0.9.1.5.7.1

Unfortunately the FAQ did not help us to solve the question of how shall the SUP based application be qualified for US Export Regulations.

Do you have any experiences? Can you help?

Best regards,

Szymon

[clemens_suter-crazzolara · Accepted solution]

I cannot assess the functionality of your app and its interaction with the SAP Mobile Platform 100%, and therefore the following answer is only a suggestion for your consideration. As a partner you remain responsible for any legal obligations associated with your developed software.

However, the Apps created on the SAP Mobile Platform follow the technological standards of the platform. Thus the technology component actually conducting the encryption needs to fulfill the export requirements. In the described case, it seems that Sybase Unwired Platform does the encryption and not the partner app. If this is the case, then the SAP platform must fulfill such requirements and not the partner app.