Can you use cloud FAI software for ITAR drawings?

Short answer by deployment path

The encryption rule in plain language

ITAR section 120.54 creates a narrow path where sending, taking, or storing unclassified technical data secured with prescribed end-to-end encryption is not treated as an export event. That is not the same as a blanket approval for every cloud workflow. You still have to control who can decrypt the data, where it is intentionally stored, whether a prohibited destination is involved, and whether the recipient is authorized. This page is product guidance, not legal advice.

What Articul ships today

The hosted SaaS runs on commercial cloud infrastructure and hosted extraction services when extraction is enabled. Do not upload export-controlled drawings there.

The self-host profile builds the same app shape with an API container, worker, Postgres database, and uploaded drawings in a customer-managed storage volume. It can use local_http to call an internal extraction endpoint.

No bundled local extraction engine is included today. Without a customer-supplied local endpoint, self-host still supports FAIR creation, forms, review, nonconformance handling, approvals, exports, audit history, backup, and restore; extraction is manual/import-driven until that endpoint exists.

CMMC and NIST 800-171 flow-down angle

Many defense suppliers treat ITAR drawings and AS9102 evidence as part of the same controlled-information boundary used for CUI or covered defense information. NIST SP 800-171 focuses on protecting CUI in nonfederal systems, and the CMMC program ties Level 2 to NIST SP 800-171 Rev. 2. The practical question for FAI software is where drawings, FAIR records, exports, attachments, audit events, and extraction work sit relative to that boundary.

Current self-host boundary

• What exists: compose self-host profile, API, worker, Postgres, local upload storage, backup, restore, storage verification, and local_http extraction adapter.
• What does not exist: no turnkey local extraction engine, no packaged self-host offer, no self-serve license checkout, no published fixed appliance price, no support policy, and no current government cloud extraction service.
• Current status: contact us only if you need to discuss an early customer-managed deployment; pricing, support, installation, and extraction integration terms are not standardized yet.
• Roadmap: AWS GovCloud or Azure Government extraction may be added when demand warrants, but neither should be planned as available until a written offer exists.

Related AS9102 resources

FAQ

Can I upload ITAR drawings to hosted Articul?

No. Hosted upload is for non-controlled drawings only. Contact Articul only if you need to discuss an early customer-managed self-host path for drawings or technical data that require customer-controlled infrastructure.

Does self-host include local extraction out of the box?

No. The self-host profile can call a customer-supplied local extraction endpoint through local_http. Without that endpoint, it still supports forms, review, export, and audit workflow, but extraction is manual or import-driven.

Does encrypted cloud storage automatically solve ITAR?

No. The encryption rule is specific and conditional. Confirm classification, storage location, decryption control, recipient authorization, contract terms, and customer flowdowns with export-control counsel.

Source notes

Source links are used for public orientation only. Purchase orders, customer portals, and controlled supplier-quality documents govern actual requirements.

• 22 CFR 120.54 activities that are not exports
• DDTC ITAR Encryption Rule overview
• NIST SP 800-171 Rev. 3 CUI security requirements
• Federal Register CMMC Program final rule