Security

Your Connect keys stay on your device

Uploading to App Store Connect requires trust. Here is how Capto Studio treats credentials and Pro AI traffic.

App Store Connect credentials

Issuer ID, Key ID, and .p8 material are stored in the iOS Keychain
Credentials are used only to authenticate with Apple’s App Store Connect API
We do not upload your .p8 to a CaptoStudio server vault
We do not put secrets in SwiftData, UserDefaults, or logs

How upload works

Capto Studio creates a short-lived ES256 JWT from your Keychain credentials and talks to Apple’s API to update listing fields and replace the target screenshot set for a device class and locale. Progress is shown in the publish UI.

Pro AI traffic

When you use Capto Pro AI, screenshot copy and/or listing fields are sent over HTTPS to captostudio.app API endpoints, which forward the request to OpenAI. See the Privacy Policy for details.

Your responsibility

Create API keys with the minimum App Store Connect role you need
Revoke keys in App Store Connect if a device is lost
Keep device passcode / biometrics enabled

Questions? security@captostudio.app