2

Caveat - I am not the iOS developer but have been asked to research this

We submit our native iOS financial app to the Apple store for review and the person who previously managed the submission process insisted we had to provide Apple with a username and password to be able to login to our app to review the pages

The process to create and provide Apple with a username/password is very time consuming and alerts our security teams as our app holds sensitive data about people

Is it the case that Apple requires to be able to login to review? If so, how do people with financial/banking apps manage this? We cannot really create dummy users as this will skew our stats and as mentioned before, our security team do not like it

Many thanks

19

App Store Review Guidelines necessitates this. You will be rejected if the app requires login and you do not provide credentials.

Before you submit:

  • Provide an active demo account and login information, plus any other hardware or resources that might be needed to review your app (e.g. login credentials or a sample QR code).

2.1 App Completeness

… Make sure your app has been tested on-device for bugs and stability before you submit it, and include demo account info (and turn on your back-end service!) if your app includes a login. …

Also, how does your security team ensure that your first two users won’t see each other’s data? If adding a third account for Apple breaks your security, you’ve got your research can be concluded with the answer: the back end team is not ready to ship.

  • 1
    To anyone reading, I would recommend this answer over mine as it includes quoted reference from the App Store Review Guidelines document. – Nimesh Neema Dec 10 '19 at 10:48
  • Which is exactly how we do it. Provide Apple (and Google for the Android version) with an account on our demo server, the same server prospective customers can try the app on to see if it's a good option for them. – jwenting Dec 11 '19 at 6:14
7

Is it the case that Apple requires to be able to login to review?

Yes. If your app requires a login to access all the functionality, Apple requires you to provide one, so that they can review the app in its entirely. Absence of login information may prevent Apple from reviewing the app in its entirely.

If so, how do people with financial/banking apps manage this?

Ask your software development team with a dummy/demo account with placeholder data. This should let the review team at Apple review the app UI and functionality to make sure they are in compliance with the guidelines.

We cannot really create dummy users as this will skew our stats and as mentioned before, our security team do not like it

Only likely way to move ahead at this point would be to request the IT/security/software development team to set up an exception, so that the review team at Apple can do their job.

  • 1
    The advice to make a security exception or demo account seems to side step a critical flaw. How can the backend team secure any data if they cringe at adding one more account on the live system? – bmike Dec 14 '19 at 3:17
1

grg's answer is perfect to show you that you must provide them with a demo login account. However I think I can provide more advice on:

If so, how do people with financial/banking apps manage this?

Provide them an account that either fakes the data exchange in the app, so they can see the UI but the data is dummy from some XML files in the app. Or make it so if that account logs in it connects to test services rather than live services. The ones I hope your dev and test team are using.

  • In kindness, this is awful advice. The team has zero standing to ship if they can’t isolate data with distinct log in credentials. – bmike Dec 14 '19 at 3:18
  • @bmike could you elaborate? I thought my suggestion was to provide access to isolated data based on the log in credentials. – Tom.Bowen89 Dec 16 '19 at 9:38
  • Wouldn’t all data be isolated by the credentials? There shouldn’t have to be anything faked. Apple testers shouldn’t get access to any other customer data and vice versa. – bmike Dec 16 '19 at 12:51
  • 1
    @bmike depends on the application. A health care app let's doctors look up patient data. You don't want apple looking at real patients. Also for reporting reasons on something like a financial app you wouldn't apple screwing things or having "pretend" money in a live system. – Tom.Bowen89 Dec 16 '19 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .