Scarlet iOS for Business: Sideloading Enterprise Apps

ByScarlet iOS Team Updated on

The Business Case for Sideloading on iPhone

When most people think about sideloading on iPhone, they imagine games and social media tweaks. Businesses also need to get their own apps onto iPhones without a public App Store listing, and some look at tools like Scarlet iOS for that. Before you do, know the main catch: Scarlet signs apps with a shared certificate issued to an organization that has nothing to do with your business, and Apple can revoke it at any time.

This guide explores the legitimate business use cases for sideloading via Scarlet iOS, how it compares to formal enterprise distribution alternatives, and the practical steps for deploying business apps outside the App Store.

Why Businesses Need Alternatives to the App Store

The App Store review process, while valuable for consumer protection, creates real friction for business deployments:

Common Business Pain Points with the App Store

  • Review delays: every update has to wait for Apple’s review. For internal tools that need rapid iteration, this is unacceptable
  • Policy rejections: apps that use enterprise APIs or access device features beyond App Store guidelines get rejected even when used for legitimate business purposes
  • Distribution costs: Apple’s enterprise developer program costs $299/year and requires at least 100 employees, so most small businesses cannot enroll
  • Legacy software: older business applications built before modern iOS APIs may never be updated for App Store compliance
  • Competitor exposure: some businesses do not want their proprietary tools visible on the App Store, even unlisted

Legitimate Business Use Cases for Scarlet iOS

Understanding the valid applications helps distinguish legitimate business use from policy circumvention.

Custom Internal Tools

Many businesses have proprietary apps built for internal use only: inventory management systems, custom CRM interfaces, warehouse picking apps, and field service tools. These apps were never intended for public distribution and go through Scarlet iOS or similar tools because the full enterprise developer program overhead is not worth it for small deployments.

Beta Testing and Development

Development teams use Scarlet iOS to distribute internal beta builds without going through TestFlight. This is particularly useful when teams need to test builds with specific configurations that TestFlight does not support, or when testing with external partners who are not set up in the developer portal.

Vendor-Provided Software

Some enterprise software vendors, particularly those serving industries like healthcare, logistics, and manufacturing, distribute iOS apps directly to their customers as IPA files rather than through the App Store. They use this approach to maintain tighter version control and avoid situations where users accidentally update to incompatible versions.

MDM-Complementary Deployment

Organizations using Mobile Device Management (MDM) systems like Jamf or Microsoft Intune can distribute apps in-house, but some edge cases require supplementary sideloading. In practice an MDM can push in-house and custom apps itself, so check its options first; a shared-certificate installer like Scarlet iOS is outside your MDM’s control.

Comparing Business Distribution Options

Understanding where Scarlet iOS fits among the alternatives helps businesses make the right choice.

Option 1: Apple App Store (Public, Unlisted or Custom App)

  • Cost: $99/year developer account
  • Pros: Easiest distribution for end users, no certificate management; custom apps in Apple Business Manager go privately to the organizations you choose
  • Cons: Review delays, public visibility concerns, policy restrictions
  • Best for: Apps intended for broad customer-facing use

Option 2: Apple Enterprise Developer Program

  • Cost: $299/year
  • Pros: Direct distribution to employees without App Store review
  • Cons: Requires enrollment approval and at least 100 employees, distribution profiles expire, carries liability for misuse
  • Best for: Large organizations with IT departments

Option 3: TestFlight

  • Cost: Free with developer account
  • Pros: Official Apple solution, up to 10,000 external testers, internal testers without Beta App Review
  • Cons: External builds require Beta App Review, builds expire after 90 days
  • Best for: Beta testing before App Store release

Option 4: Scarlet iOS

  • Cost: Free
  • Pros: No review process, rapid deployment, no Apple enrollment required
  • Cons: Apps are signed with Scarlet’s certificate, which is issued to an unrelated organization and which Apple can revoke at any time, so reinstalls are needed and you have no control over the signer; not suitable for apps that handle customer, patient or payment data
  • Best for: Small teams, freelancers, developers, and businesses needing agile distribution

Setting Up a Business App for Sideloading

If you are a developer or IT professional setting up a business app for distribution via Scarlet iOS, follow these steps:

Step 1: Prepare the IPA File

  • Build your app in Xcode with a valid signing certificate
  • Export as an IPA using the Ad Hoc or Development distribution method
  • Ensure the IPA contains all necessary resources and does not depend on external servers that are inaccessible from end-user devices

Step 2: Host the IPA Securely

  • Upload the IPA to a secure, access-controlled file host
  • Use HTTPS for all distribution URLs
  • Consider using version-specific URLs to prevent users from staying on outdated builds
  • Document the SHA-256 hash of each build for verification

Step 3: Distribute to Devices

  • Send the IPA file or link to team members with instructions to install it with Scarlet iOS
  • Provide a simple one-page guide for non-technical users covering certificate trust steps
  • Establish a communication channel for users to report installation problems

Step 4: Manage Updates

  • Notify users when new builds are available
  • Document breaking changes and required update timelines
  • Maintain a changelog for each build to help users understand what changed

Security Considerations for Business Deployments

Business data security is paramount. When using Scarlet iOS for enterprise app distribution:

  • Always use HTTPS for IPA distribution URLs, never plain HTTP
  • Do not distribute apps containing hardcoded credentials or API keys
  • Implement proper authentication within the app itself, not relying on distribution security
  • Control access inside the app (accounts you can disable), because you cannot remotely remove an app installed this way
  • Train users to report unexpected certificate prompts, which could indicate a man-in-the-middle attempt

For a broader look at sideloading security, our guide on iOS sideloading safety is required reading for anyone deploying apps in a business context.

Example Business Scenarios

Scenario 1: Small Retail Chain

For example, a 12-location retail chain might use a custom inventory management app built by a freelance developer. The app communicates with their POS system via a local API. Rather than paying $299/year for enterprise distribution, they could distribute the IPA via Scarlet iOS to employee iPhones and reinstall when the certificate is revoked.

Scenario 2: Independent Software Vendor

A software vendor might distribute a clinical documentation app to hospital clients as an IPA, with clients installing it via Scarlet iOS using the vendor’s setup instructions. For an app that handles patient data, a custom app through Apple Business Manager or the client’s MDM is the safer route.

Scenario 3: Developer Studio

A mobile game studio might use Scarlet iOS to distribute daily builds to a small QA team if TestFlight’s Beta App Review for external testers and 90-day expiry create workflow friction. Direct IPA distribution via Scarlet iOS means builds are available within minutes of being compiled.

Getting Started with Business Sideloading

For small teams testing their own apps, Scarlet iOS is a quick way to get a build onto a few iPhones without a computer at each desk. For anything that holds business or customer data, Apple’s own routes (TestFlight, Ad Hoc, custom apps or an MDM) keep the signing in your hands and are not affected by revocations of a shared certificate.

Ready to deploy your business app? Download Scarlet iOS and give your team access to the tools they need without the App Store standing in the way.

Similar Posts