What makes software ITAR compliant?
No software is certified ITAR compliant. The State Department has no certification for it. Software helps you comply when it controls who can see your technical data, where that data is stored and what records it keeps. Here is what to check before you trust a system with it.
Compliance is yours. Software makes it easier or harder.
ITAR puts the duty on your company, not on your vendors. The right systems make the rules part of daily work. The wrong ones leave gaps you only find during an audit or a voluntary disclosure.
There is no ITAR certification
Microsoft says it plainly in its Azure documentation: there is no ITAR compliance certification. A vendor that calls its product ITAR compliant means it can support your controls, not that the government approved it.
Source: Microsoft Learn, Azure ITAR offeringShowing data to a foreign person is an export
Releasing technical data to a foreign person counts as an export, even inside the United States. That makes access control the core job of any system that holds it.
Source: 22 CFR 120.50Encrypted storage can be allowed
Sending or storing unclassified technical data is not an export when it is end-to-end encrypted with FIPS 140-2 modules or comparable strength, and not stored in or sent from a country listed in § 126.1.
Source: 22 CFR 120.54(a)(5)
Six things ITAR asks of your systems
ITAR does not list software features. These follow from what the rules count as an export and what they require you to keep.
Access by role
Users see only the records and files their role needs, and you can limit controlled technical data to U.S. persons. Most of the risk sits here.
Known data location
You know which country every copy sits in, backups included. Data stored in a § 126.1 country falls outside the encryption carve-out.
Strong encryption
End-to-end encryption with FIPS 140-2 validated modules, or comparable strength, where the provider cannot read your data. Without it, location and access controls carry the full load.
Controlled support access
Vendor staff who can open your system are part of your access picture. Ask where support staff work and whether they are U.S. persons.
Complete records
ITAR registrants keep records of regulated activity for five years. The system should keep them complete and easy to pull when asked.
Activity logs
Logs show who opened, changed or shared controlled data, so you can check your controls and answer questions later.
Questions to ask any vendor
Put these to every software or hosting provider that will hold technical data. Clear written answers are a good sign. Vague ones are a reason to keep looking.
Where are our data and backups stored, by country?
Who on your team can open our data, and are they U.S. persons?
Is our data encrypted end to end, and who holds the keys?
Are your cryptographic modules FIPS 140-2 or 140-3 validated?
Can we limit records and files to U.S. persons by role?
What activity does the system log, and for how long?
Can we pull complete records going back five years or more?
How do we get all of our data back if we leave?
ITAR touches more than one system
Technical data rarely stays in one place. Drawings move from your ERP to file storage to team chat, so each one needs the same controls. Constaris sets up and maintains all three for FFL and defense companies.
ERP
Orders, inventory, manufacturing and records in one system, with access rules set once for every module.
See ERP
Cloud
Nextcloud file storage on servers you control, with role-based folders and activity logging.
See Cloud
Communications
Mattermost team chat on hosting you choose, with teams, channels and retention set up around ITAR.
See Communications
Common questions about ITAR and software
Is there an official ITAR certification for software?
No. The State Department's Directorate of Defense Trade Controls (DDTC) does not certify software, cloud services or hosting providers, and Microsoft's own Azure documentation says there is no ITAR compliance certification. Each company subject to ITAR is responsible for its own compliance. Software is one of the tools it uses to get there.
Can ITAR technical data be stored in the cloud?
Yes, with conditions. Since March 25, 2020, sending or storing unclassified technical data is not an export if it is end-to-end encrypted with FIPS 140-2 compliant modules or comparable strength, and it is not stored in or sent from a country listed in 22 CFR 126.1. Without that encryption, you need to control where the data sits and who can reach it, including the provider's own staff.
Do I need Microsoft GCC High or AWS GovCloud?
ITAR does not name a required platform. Government clouds are one option, and self-hosted systems on servers you control are another. What matters is that you can account for where data is stored, who can access it and how it is encrypted. Defense contracts with their own cybersecurity clauses can add requirements, so check your contracts too.
Does ITAR apply to FFLs?
It depends on what you make. Anyone in the U.S. business of manufacturing or exporting defense articles on the U.S. Munitions List must register with DDTC, with limited exceptions (22 CFR 122.1). Since March 9, 2020, most non-automatic and semi-automatic firearms up to .50 caliber are controlled by the Commerce Department instead, while fully automatic firearms, suppressors and related technical data remain under ITAR. Confirm your status with export counsel.
How long do ITAR records need to be kept?
Five years, counted from the date of the transaction or from when the related license or other approval expires (22 CFR 122.5). Your systems should keep those records complete and easy to retrieve for that whole period.
Sources
This guide explains the regulations in plain language. It is not legal advice. For decisions about your registration or a specific export, talk to export counsel.
Check your systems against ITAR
Tell us what you run today for ERP, files and chat. We'll follow up to set up a consultation and walk through where the gaps are.
Book a consultation