ITAR and the Cloud: What 22 CFR 120.54 Actually Says About Storing Technical Data

The key idea in 120.54 is that encrypted technical data passing through or sitting on someone else's servers isn't an export if it's properly protected. 'Properly' has specific meanings: the data has to be end-to-end encrypted, using FIPS 140-2 validated cryptography or an equivalently effective method, and the keys can't be held by the cloud provider or anyone else who isn't authorized to see the data. The rule has further conditions, including limits on the countries where the data can be stored, so read the text of 22 CFR 120.54 itself before relying on it.

In practice, that describes encrypted storage and transfer, such as an archive of drawings encrypted on your machine before upload, where only your people hold the keys. The provider stores scrambled bytes it can't read.

Access by a foreign person is still an export, carve-out or not. If someone who isn't a US person can view the decrypted drawings, whether that's a vendor's offshore support engineer, a contractor, or an employee, that's a controlled release of technical data. This is where most real ITAR risk with software sits: in who can see the data, not in where the disk is.

Ask any software vendor who can access your data in readable form, where those people are, and whether they're all US persons. Be skeptical of a badge or a marketing claim. What matters is the access control and the contract terms behind it.

A typical cloud shop system has to work with your data in readable form on its servers to search jobs, run reports, and show drawings in the browser. That means it isn't end-to-end encrypted in the 120.54 sense, and the carve-out generally doesn't cover it. Using it for ITAR technical data then depends on the vendor's controls: US-person-only access, where the data is hosted, and what the contract commits to.

Some vendors build for exactly that, often on government cloud regions. Others don't address it at all. ITAR technical data is also frequently marked as CUI, which brings DFARS 7012 into play, including the FedRAMP Moderate equivalency rule for any cloud service that stores it. Our guide on FedRAMP equivalency for job shops explains that rule, and /glossary/cui explains the term.

Cloud isn't banned, but for a small shop it may not be the simplest answer. If the drawings stay on a box in your building, and only your people and support staff you approve can reach it, then the hosting questions disappear and the question of who has access is one you control directly.

Traveler's Shop Server is designed for that setup. The Shop Server Defense edition, planned at $6,500 one-time with an optional $99/month continuity plan, adds support from US persons only, remote support sessions you approve, an encrypted backup drive with keys you hold, and a hardened FIPS-mode configuration. It's pre-launch, and no software makes a shop meet ITAR on its own: registration, export authorizations, and access policies are still your program. Details and reservations are at /shop-server, and /for/defense-subcontractors covers the wider picture.