Typically, any cryptography carried out is a function of the OS; most apps can transparently leverage the OS's cryptographic services without having to replicate any code or functionality. For example, the SRG does not necessarily require apps to encrypt data at rest or call a cryptographic API because the OS may be able to perform this function for all data at rest or in transit. However, in some cases, the app may use its own cryptographic module or explicitly call external cryptographic modules.