> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cr3dentials.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Release checklist

> Everything to settle between your first SDK build and your app's store release.

Work down this page from first contact to production.

## 1. From us

* [ ] `baseUrl`, your `appCredential`, `trustOperatorKey`, the trust bundle URL, and the policy bundle URL and digest ([What you need from us](/sdk/overview#what-you-need-from-us)).
* [ ] The platforms you'll verify, each confirmed to have an SDK pack.
* [ ] Confirmation that production is live for your users' region. Until then, integrate against the test configuration we give you.

## 2. Decide

* [ ] Your minimum OS, at or above the SDK's: iOS 14.0 and Android 7.0 (API 24).
* [ ] How your app hashes its user id into `userIdHash`. Never send the raw id.
* [ ] Your disclosure text, in each language your app supports.

## 3. Integrate

* [ ] Your backend creates a new SDK run for every attempt, and terminates runs the app abandons ([Create an SDK run](/sdk/create-a-run)).
* [ ] Your backend handles the [webhook](/essentials/webhooks), including results that arrive after the user has left the app.
* [ ] Your app pins the version: `from: "1.0.0"`, `~> 1.0` or `1.0.0`. Read the [changelog](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/CHANGELOG.md) before every upgrade.
* [ ] One `ZktlsClient` per run, and one run at a time, as in the [iOS](/sdk/ios) and [Android](/sdk/android) code.
* [ ] Background time held from the `attesting` phase until `runTree` returns: `ZkTlsLifecycle`, plus `ZkTlsSessionService` on Android.
* [ ] A message for every [error case](/sdk/errors), and no automatic retry.
* [ ] No token, cookie or credential in your logs.

## 4. Test

* [ ] On a real iPhone at your minimum iOS, and on a mid-range and a low-end Android phone.
* [ ] Decline the disclosure. Close the sign-in page. Tap a link off the platform. Leave the app during the hand-off. Switch from Wi-Fi to cellular. Each case ends cleanly, and the user can start again.
* [ ] Your release build (R8 on Android) launches and completes a run.

## 5. Store submission

* [ ] **App Store privacy.** The SDK's privacy manifest is included for you. Add its answers to your App Privacy: User ID and Coarse Location, linked to the user, for App Functionality. Then add the data types your verification collects. [Details](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/docs/privacy.md).
* [ ] **Google Play Data safety.** Declare the SDK's part, and the permissions and `shortService` foreground service it adds. [Details](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/docs/privacy.md#google-play-data-safety-answers-for-the-sdks-part).
* [ ] **Export compliance.** Get your counsel's answer, and set `ITSAppUsesNonExemptEncryption` in your `Info.plist`. [Details](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/docs/export-compliance.md).
* [ ] **App Review.** Write notes on the sign-in WebView, and provide a working demo account for each platform. [Details](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/docs/store-review.md).
* [ ] Confirm you have the right, under each platform's terms, to access the account on the user's behalf (Apple guideline 5.2.2).
* [ ] Add the SDK's [open-source notices](https://github.com/Cr3dentials/zktls-sdk-releases/blob/HEAD/THIRD_PARTY_NOTICES.md) to your app's notices screen.

## 6. Go live

* [ ] Point `baseUrl`, the bundle URLs and your Partner API key at production.
* [ ] Fetch the trust bundle before every run, and pass its URL as `trustBundleUrl`.
* [ ] Watch the error cases you log. A `Policy` or `WrongEvidence` error that repeats is worth [reporting to us](/sdk/errors#getting-help).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.