ITAR

ITAR is administered by the State Department's Directorate of Defense Trade Controls (DDTC). It covers items on the US Munitions List and the technical data needed to make them, such as drawings, models, and specifications. A key point for machine shops is that sharing controlled technical data with a foreign person, even inside the US, can count as an export that requires authorization.

US companies that manufacture defense articles are generally required to register with DDTC, even if they never ship anything overseas. Registered shops are also expected to control access to technical data, train employees, keep records, and handle customer drawings accordingly. This is a summary, not legal advice; your export compliance counsel and DDTC guidance are the authority.

ITAR does not ban cloud storage outright. Under the carve-out in 22 CFR 120.54, technical data that is end-to-end encrypted with FIPS 140-2 validated cryptography, where the cloud provider holds no keys, is not an export just because it sits on that provider's servers. Giving a foreign person access to the data is still an export, though, whoever's servers it's on. So the practical question with any cloud system is who holds the keys and who could reach the data, including the vendor's own staff.

Software doesn't make a shop ITAR compliant. What Traveler offers is a choice about where data lives. The Shop Server ($4,250 one time) runs the whole system on a box on your network that works with the internet unplugged, so there's no third-party provider holding your drawings. Shop Server Defense ($6,500 one time) adds a hardened configuration, an encrypted backup drive with keys only you hold, and support from US persons only, when you grant access. Both are planned to ship after Traveler Cloud.