How does FeaturePoints.com distribute its iOS app to the public without the App Store

On featurepoints.com, a free iOS app is offered for direct download.

The download link uses an itms-service URL. (itms-services:///?action=download-manifest&url=https%3A%2F%2Ffeaturepoints.com%2Fenroll%2FFeaturePoints.plist)

If you click on the download link, the app is downloaded and installed on your iDevice without using the App Store (the app is installed without entering the iTunes password even if you are logged out of your iTunes account).

Also a Provisioning Profile is installed named "TapGen InHouse" expiring 2014-06-30.

I wonder how this app is distributed to the public and to non-jailbroken iDevices effectively circumventing Apple's review process and the App Store?

The only way (I know of) to distribute an unlimited number of apps without the App Store is the iOS Enterprise Developer programm. However, this program limits distribution to "in-house iOS apps for internal deployment within the company", see Apple's FAQ and other discussions (which I can not link to since I have not enough reputation).

They probably use the iOS Enterprise Developer program you mentioned. This happened before, for example with GBA4iOS. When this comes to Apple's attention they usually do something about it though.

http://readwrite.com/2013/07/17/apple-slams-the-door-on-super-mario#awesm=~oyiYU7RMNByRFi