# Third-Party Libraries The Incode iOS SDK builds on a set of third-party libraries and services. This page groups them by purpose, not as a full dependency tree. Use it to complete your own privacy review, App Store App Privacy details, or internal SDK inventory. This page covers only the SDK's own dependencies. Your app may add others. It omits build-only tooling, like the Swift compiler, Xcode, and Swift Package Manager, since these don't ship in your app. It also omits dependencies used only by the Incode sample app (Omni), since the sample app isn't part of the published SDK. Most third-party components are vendored into the SDK as binary `.xcframework` libraries or as source. Exact pinned versions change with each release. For the current, per-version list, see the API changes and dependency sections of the [iOS SDK release notes](https://developer.incode.com/docs/releases-ios-sdk). *** ## How Data Is Handled Capture and biometric processing happen on the device. The SDK sends capture artifacts and verification requests to the Incode Platform over an encrypted channel. It does not log PII or capture content. For more detail, see [Security](https://developer.incode.com/docs/ios-security). *** ## Capture, Media, and On-Device Processing | Library | Purpose | Used by | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OpenCV: `opencv2.xcframework` (vendored) | Computer-vision primitives for the on-device ML and image-processing components: liveness and presentation-attack detection, face recognition, ID face detection, face occlusion, and age estimation. | [Selfie](https://developer.incode.com/docs/module-selfie), [ID Capture](https://developer.incode.com/docs/module-id-scan), [Document Capture](https://developer.incode.com/docs/module-document-scan) | | OpenSSL: `OpenSSL.xcframework` (vendored) | Cryptography for the ePassport (eMRTD) chip protocol stack—BAC, PACE, and chip authentication—and X.509 certificate parsing. | [NFC](https://developer.incode.com/docs/module-nfc-scan) | Camera and media capture are built on Apple's native iOS frameworks, so there is no third-party camera library to disclose. The SDK also includes on-device machine-learning models for liveness and presentation-attack detection, face recognition, ID face detection, face occlusion, and age estimation. These are first-party Incode components, shipped in `IncdRecogKit`. They run locally on the device. OpenCV, above, provides the vision primitives they build on. *** ## Networking and Storage The iOS SDK's networking and persistence are built on Apple's native frameworks rather than on third-party libraries. | Concern | iOS implementation | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | Requests to the Incode Platform | Apple's native networking stack. | | Request and response serialization | Apple's native `Codable`. | | Local and offline onboarding state | A first-party storage manager (`IncdOnboardingStorageManager`) backed by Apple's Core Data. This is the equivalent of Android's on-device database. | For how data is protected in transit and at rest, see [Security](https://developer.incode.com/docs/ios-security). *** ## Platform Services On iOS, device location and wallet and pass integration are handled by Apple's native platform frameworks, not by third-party libraries: - **Device location** uses Apple's native Core Location. See [Geolocation](https://developer.incode.com/docs/module-geolocation). - **Wallet and pass integration** uses Apple's native PassKit. *** ## Contact, Localization, and UI | Library | Purpose | Used by | | ----------------------------------- | ------------------------------------ | --------------------------------------------------------------------- | | PhoneNumberKit (vendored as source) | Phone number parsing and validation. | [Phone](https://developer.incode.com/docs/module-phone) | UI and theming use Apple's native UIKit and SwiftUI together with Incode's own theming layer. Runtime string localization uses Apple's native localization mechanisms. See [Customization](https://developer.incode.com/docs/ios-customization). No third-party UI or animation library is bundled. *** ## Real-Time Video | Library or Service | Purpose | | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | OpenTok (Vonage Video): `OpenTok.xcframework` (vendored) | Real-time video conferencing with a remote agent. See [Video Conference](https://developer.incode.com/docs/module-conference). | *** ## Telemetry and Diagnostics | Service | Purpose | Notes | | ------- | ---------------------------------- | --------------------------------------------------------------------------------- | | Statsig | Feature flags and experimentation. | Vendored into the SDK as source, rather than as the public Statsig Swift package. | *** ## Risk and Antifraud | Capability | Purpose | Notes | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Device-risk provider—Sardine: `MobileIntelligence.xcframework` (vendored) | Optional third-party device-risk and antifraud signals. | Present only in the `-ra` (risk-analysis) build variant and used only when device-risk analysis is provisioned for your configuration. See [Antifraud](https://developer.incode.com/docs/module-antifraud). | | Silent Network Authentication—IDlayrKit: `IDlayrKit.xcframework` (vendored) | Optional telco-based (Silent Network Authentication) phone-number verification. | Present only in the `-sna` build variant. Used by the [Phone](https://developer.incode.com/docs/module-phone) module. | *** ## Framework and Utility Libraries These support the SDK internally. They don't collect end-user data. On iOS, they are provided by Apple's native frameworks rather than by third-party libraries. - **Dependency injection**: None. The SDK does not bundle a third-party dependency-injection container; wiring is done in first-party code. - **Asynchronous and reactive**: Apple's native Swift Combine and async/await. No third-party reactive library is bundled. - **Logging**: Handled in first-party code. The SDK does not log personally identifiable information (PII) or capture content. *** ## Release Hardening The SDK's own code, including source-vendored dependencies like PhoneNumberKit and Statsig, compiles into the precompiled `IncdOnboarding.xcframework` you integrate. Other third-party components, such as OpenCV, OpenSSL, OpenTok, and the optional risk-analysis and SNA libraries, ship as their own separate `.xcframework` libraries. All are built with standard release optimizations at build time; this doesn't affect the runtime behavior your integration relies on.