Under the Export Administration Regulations (EAR), providing software as a service is generally not an export of that software. Distributing software such as client apps, SDKs and on-premise editions is an export, and that software needs classification. Controlled technology in the cloud can be exported if it is stored abroad or accessed by foreign persons, unless the encrypted-data rule in § 734.18 applies. Sanctions can apply to the service even when no EAR export occurs.
Export controls were written for goods that cross borders. Cloud computing blurs that picture: software runs in one country, data sits in another, and users log in from everywhere. The EAR and BIS guidance give a workable framework once you separate the service, the software and the data.
1. The service: generally not an export
BIS has indicated in advisory opinions that providing computational capacity or access to software as a service is generally not an export of the software itself, because the user receives only the output. A SaaS platform used by foreign customers does not, by that alone, export its server software.
2. The software you distribute: what ECCN applies?
- desktop and mobile client apps;
- SDKs, agents and connectors installed by customers;
- on-premise editions and downloadable updates.
These are software exports and need classification like any other software. Software ECCNs sit in product group D of each category. Encryption is almost universal in these components, so they are usually in Category 5 Part 2, often mass market 5D992.c under the Cryptography Note. See the encryption FAQ for common cases. Publicly available open-source code follows its own rules.
3. The data: technology in the cloud
Uploading controlled technology to a cloud service can be an export if it is stored abroad or accessed by foreign persons. Section 734.18 of the EAR provides that technology or software is not exported when it is:
- unclassified;
- secured using end-to-end encryption meeting specified standards (FIPS 140-2 or equivalent, or other approved methods);
- not intentionally stored in a country in Country Group D:5 or in Russia; and
- decryptable only by the intended recipients, which excludes the cloud provider.
Outside that safe harbour, where the data lives and who administers it both count, including the cloud provider's own foreign staff. See deemed exports.
4. ITAR data is stricter
The ITAR has a parallel, but separate, provision for encrypted technical data. ITAR technical data in the cloud needs particular care. See technical data under the ITAR.
5. Sanctions still apply
Providing services to users in embargoed countries or to blocked persons can violate OFAC sanctions even when no EAR export occurs. Screen customers and consider geoblocking where programmes require it. See sanctions screening.
Checklist for SaaS export regulations
- Classify every distributed component (apps, SDKs, on-prem builds).
- Decide the § 740.17 filing position for encryption components (self-classification reports explains the annual filing).
- Know where customer and internal technical data are stored, and who can access it.
- Use end-to-end encryption to the § 734.18 standard for controlled technology where possible.
- Screen customers and apply sanctions geoblocking where needed.
Common scenarios
| Scenario | Usual result |
|---|---|
| A foreign customer uses your SaaS | Generally not an export of your server software; screen the customer for sanctions |
| A foreign customer downloads your desktop client | An export of software; classify it |
| Your engineers in India access source code on U.S. servers | A release of source code: an export (or deemed export) to India, subject to its classification |
| You back up design files to a cloud region abroad | Potentially an export of technology, unless the § 734.18 conditions are met |
| A cloud provider's foreign administrators can read your data | Potentially a release; encryption and key management decide the risk |
Frequently asked questions
Is running software on a foreign server an export?
Installing your own software on a server abroad is generally an export of that software to that country.
Are API calls exports?
Providing results through an API is usually a service. Distributing an SDK is a software export.
Do cloud providers handle compliance for me?
Providers offer controls (regions, keys, access), but responsibility for your data and exports stays with you.
Classifying SaaS components in ECCN.help
ECCN.help classifies the components a SaaS company distributes, software and technology as well as hardware, in the rule-based ECCN.help Classification Workflow. Do not upload controlled technology to ECCN.help itself: the service is hosted in the United States, and ordinary descriptions are enough to classify. For data that cannot leave your network, see Enterprise Solutions.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.