Adding a security SDK can change data collection and API use. Privacy-manifest review must match enabled features and store disclosures.
Evaluation approach
Compare SDK data collection, API use and packaged manifests with actual application behavior. Track current requirements in Apple's documentation.
Application example
If a new RASP release adds a telemetry field, review application disclosures alongside the technical integration.
Limits and considerations
A manifest file does not guarantee an accurate description of real data flows.
Declarations and actual data flows
Privacy manifests and similar declarations must remain consistent with the behavior of the application and its SDKs. A file in the project does not establish that every processing activity is accurately described. Review changes in APIs and data use when an SDK is updated.
Compare RASP event fields against network observations and product documentation. Removing an unused field only from a privacy notice is insufficient; change actual transmission and storage behavior. Version declarations and implementation together.
Checks and decisions
- Request an SDK data inventory
- Inspect the final package
- Record changes
Review your own configuration before copying a vendor example.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.