Exports, re-exports FileCloud products and technology are subject to control under the Export Administration Regulations (“EAR”), as administered by the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”). Diversion of FileCloud products and technology contrary to U.S. law is prohibited. Depending on where you reside, additional import or export requirements may apply.

The export or re-export of items that are subject to the EAR to an embargoed or sanctioned destination without a valid license or license exception is prohibited. Further, the U.S. Department of Treasury’s Office of Foreign Assets Control may impose additional controls on exports, re-exports, or transfers to these destinations.

Exports to entities listed on a U.S. government denied party/prohibited end-user list may be prohibited or proceed only if they have been licensed. In addition, exports that support the design, development, or production of biological, chemical, or nuclear weapons, or missile proliferation, are prohibited without prior U.S. government authorization.

Please note that the information set forth in this Policy is provided for general reference purposes only. It is not intended to constitute legal guidance, and the information contained herein is subject to change at any time by the BIS or other U.S. government authorities. Please consult the EAR, or contact the BIS, for further details on U.S. export control and licensing requirements.

Product Export Classification and Licensing Definitions

Following are definitions of key terms that relate to the export classification and licensing of FileCloud products and technology. If you have a question about how an FileCloud product has been classified for export, please contact our Compliance team at legal@filecloud.com.

ECCN: The Export Control Classification Number, or ECCN, is the U.S. term for an export classification code. An ECCN identifies the relevant category and paragraph of a classification, as they are maintained under the EAR’s Commerce Control List.

Typically, FileCloud’s products are classified under the following ECCN:

5D992(c): FileCloud is a private cloud storage software product for on-premises and SaaS applications. FileCloud uses AES/128 and AES/256 from OpenSSL to encrypt/decrypt file data-in-transit and data-at-rest stored in FileCloud Local Managed Storage and in DRM secure file share mode. FileCloud also uses AES/128 and Pbkdf2/512 for encryption of user passwords, and various hash algorithms for authentication, digital signature, data integrity, digital rights management, and key management.

CCATS: Refers to the Commodity Classification Automated Tracking System, or CCATS, number that the BIS assigns to a commodity classification request.

Encryption Licensing Arrangement: Refers to a specific type of export license that allows the export or re-export of specified encryption hardware or software to specified. In certain cases, shipments authorized under an Encryption Licensing Arrangement may be limited to specified end users for specified end uses.

License Exception: A license exception is an authorization that allows the export or re-export of items subject to the EAR without first obtaining an export license under certain specified conditions. Most FileCloud products may be exported without License Exception ENC, as set forth under Section 740.17 of the EAR.

ENC-Restricted: Refers to products that may be exported or re-exported under License Exception ENC to non-government end users in all countries, except to embargoed or sanctioned countries. These products also may be exported without a license to government entities in the countries listed in Supplement No. 3 to Part 740 of the EAR. Exports or re-exports to government entities in other countries require a license.

ENC-Unrestricted: Refers to products that may be exported or re-exported under License Exception ENC to government or non-government end users in all countries, except embargoed or sanctioned countries.

Mass-Market Encryption: Refers to products that meet the following characteristics:

1. (a) Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
   • Over-the-counter transactions;
   • Mail order transactions;
   • Electronic transactions (such as thru the Internet); or
   • Telephone call transactions.
2. (b) The cryptographic functionality cannot be easily changed by the user;
3. (c) Designed for installation by the user without further substantial support by the supplier;
4. (d) When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter’s country in order to ascertain compliance with the conditions described in (a) through (c).

Deemed Export: Under the EAR, an export is “deemed” to take place when technology or source code is released to a foreign national in the United States. Such a release is viewed as an export to that foreign national’s country or last country of permanent residence.

ENC Reporting: Refers to the semi-annual reporting requirement, as set forth under the Section 740.17(e) of the EAR, for exports to all destinations other than Canada, and for re-exports from Canada for certain encryption items. For questions, please contact FileCloud’s Compliance Team at legal@filecloud.com.