iOS Security

Keep iOS enrollment and remote tools limited to trusted developer builds.

Enrollment uses clear-text UDP and ws://. Run it only on a trusted local development network.

  • Keep Ansight initialization and scanner UI developer-only.
  • Add NSCameraUsageDescription only when invoking the SDK camera scanner.
  • Add the Local Network privacy description for physical-device connections.
  • Do not add Bluetooth, location, contacts, photos, or Bonjour discovery for Ansight.
  • Keep remote tools deny-all outside developer builds and prefer read-only access.
  • Revoke registrations through the host or clear app storage when a device should no longer reconnect.
  • Keep cellular host connections disabled unless the workflow intentionally uses mobile data or a personal hotspot.
  • Keep unattended provisioning and ANSIGHT_ENROLLMENT_PAYLOAD out of distributable schemes; never log the one-use bearer payload.
  • Treat crash messages, traces, breadcrumbs, and metadata as sensitive. Disable crash capture or handoff when policy requires it.

The iOS client uses Network.framework directly for the clear-text WebSocket, so it does not require an ATS exception.

Crash reports are bounded and stored in the app sandbox until delivery or expiry. See Crash Capture for retention and data-minimization guidance.