Compliance-Aware Build Profiles

In this lesson, you will learn how to configure separate Expo build profiles to ensure your application automatically adheres to strict data protection regulations like GDPR or HIPAA before it ever reaches an app store.

When you develop mobile apps, the "environment" matters. A build intended for a general audience might include third-party analytics trackers that collect user IP addresses, which could violate GDPR. Conversely, a HIPAA-compliant build must strictly isolate patient data, often requiring the disabling of local logging, cloud-based telemetry, or non-secure background syncs.

Instead of manually changing your code every time you release for a specific region or policy, you use eas.json to define Compliance-Aware Build Profiles. This allows you to inject environment variables or toggle features based on the profile you select.

Setting Up Compliance Profiles

You define these profiles in your eas.json file. Each profile can trigger different native behaviors or environment configurations:

{
  "build": {
    "development": { ... },
    "production-standard": {
      "env": { "DATA_TRACKING": "enabled" }
    },
    "production-hipaa": {
      "env": { 
        "DATA_TRACKING": "disabled",
        "ENFORCE_ENCRYPTION": "true" 
      }
    }
  }
}

By setting these variables, your React Native code can react accordingly. For example, you might create a wrapper for your analytics provider:

// AnalyticsWrapper.js
import { DATA_TRACKING } from '@env';

export const logEvent = (name) => {
  if (DATA_TRACKING === 'enabled') {
    // Only fire if the build profile permits data collection
    AnalyticsProvider.track(name);
  }
};

In the production-hipaa profile, the DATA_TRACKING constant becomes disabled, effectively "stripping" the tracking capability at build-time. This ensures that you don't accidentally ship features that violate compliance requirements. By centralizing these rules in your build pipeline, you treat compliance as a configuration choice rather than a manual, error-prone checklist.

Key Takeaway: Use EAS build profiles to inject environment-specific constraints that automatically enable or disable sensitive features, ensuring your app's compliance posture is guaranteed at the moment of compilation.