The International Traffic in Arms Regulations (ITAR) is a set of United States regulations governing the export and handling of defense-related articles, services, and technical data. It is administered by the U.S. Department of State's Directorate of Defense Trade Controls (DDTC).

Files.com's built-in Native Storage is not ITAR-compliant. Files.com can support carefully configured ITAR workflows using customer-controlled storage, but mounting that storage or installing the Agent does not by itself keep every copy, transfer, or processing operation outside the Files.com cloud. Review the complete workflow with your legal and compliance teams before handling controlled data.

When ITAR Is Relevant

Evaluate ITAR when a workflow involves defense articles, defense services, or technical data controlled under the United States Munitions List (USML). Exchanging controlled engineering drawings or specifications can raise requirements even when no physical item is transferred. Working for a defense customer does not, by itself, classify every business record as ITAR-controlled.

Establish the classification of the information, the parties who may access it, and any applicable authorizations before configuring storage or transfers. Depending on your activities, registration and other requirements may also apply. The DDTC's ITAR resources explain the regulatory scope.

Unlike SOC 2 or ISO 27001, no formal ITAR certification is offered by any third party.

One of ITAR's key restrictions is that covered materials must not be accessed by non-U.S. persons unless a specific exemption or authorization exists.

Files.com's Role Under a Shared Responsibility Model

Files.com operates under a Shared Responsibility Model. Files.com is responsible for the infrastructure, platform, and security controls we provide. You are responsible for how you configure and use Files.com to meet regulatory requirements such as ITAR.

You must configure your Files.com environment carefully for ITAR compliance. We provide the tools; you are responsible for using them properly.

Using Files.com in an ITAR-Compliant Way

Files.com can be used in ITAR-compliant workflows when configured carefully, with the following key principles in mind.

No Long-Term Storage on Files.com

Files.com's built-in storage is not ITAR-compliant. Many customers use Files.com solely as a transfer and governance layer, with no data stored long-term on the platform.

To achieve this, mount an ITAR-compliant storage location (such as Amazon S3 in GovCloud) using Remote Server Mounts, or use the Files.com Agent installed on an environment you control and have validated as ITAR-compliant.

We strongly recommend Amazon GovCloud S3 as your backing storage. It carries the compliance guarantees ITAR workflows require and integrates directly with Files.com.

Folder and Site Configuration

Use Remote Server Mounts or Child Site storage overrides to place retained files on the approved backing storage. That does not guarantee that file contents never pass through or temporarily reside in Files.com. Buffering, GPG, Auto Unzip, Malware Scanning, editing, snapshots, logs containing payloads, and AI processing need separate review.

The Agent's ordinary transfer path relays contents through Files.com; supported Direct Transfers use a different path. Data Location & Processing and Data Paths & Storage describe the boundaries. Enable only operations and recipients that fit your validated workflow.

Additional Configuration Recommendations

Storage location is one part of the configuration. Logging, geographic access restrictions, and support-access settings address how data is accessed and how that access is recorded.

SIEM Integration

Enable Files.com's SIEM integration and export log data to your own compliant storage. This provides an auditable trail of access to all data passing through Files.com, satisfying traceability requirements.

Restrict to U.S. Access Only

Use the "Allowed/Disallowed Countries" feature to block all access from outside the United States based on IP geolocation. This is a helpful security layer, though not foolproof — VPNs and proxy services can circumvent it.

Disable Full-Access Support Tickets

Do not use Files.com's "Full Access" support feature when handling ITAR-sensitive data. Files.com cannot guarantee that all support staff are U.S. persons, so restricting full-access support is required to maintain ITAR compliance.

Organizational and Technical Controls at Files.com

Only a limited group of senior, U.S.-based full-time employees have access to production systems. These employees:

Are all considered U.S. persons under ITAR definitions,
Pass background, reference, and certification checks,
Sign binding confidentiality agreements,
Are subject to disciplinary action and termination for violations,
Must be employed for at least one year (unless approved by the CTO) before receiving "root" access, and
Have all system access fully logged.

Most Files.com staff do not have access to customer data, secrets, or credentials. This data is secured in production systems with access controls, and system secrets are managed using HashiCorp Vault.

Future Enhancements

We are actively exploring the following ITAR-specific platform improvements:

Direct support for GovCloud as a storage region, reducing manual configuration requirements.
The ability to flag an account as "ITAR-enabled," which would disable Full Access Support by default and apply additional restrictions automatically.

Legal Disclaimer

This article is not legal advice. Organizations handling ITAR-controlled data are solely responsible for ensuring that their use of Files.com complies with ITAR and all applicable regulations.

We strongly recommend consulting with your legal and compliance teams to assess your specific responsibilities under ITAR.