QuotedPartAnswers · Updated 2026-10-30
Can I use cloud quoting software for ITAR parts?
Price one of your own parts: Drop a STEP model or PDF drawing — about 90 seconds, no account.
Your part priced in about 90 seconds, no account.
It can be done, but a cloud vendor is not allowed by default. Under the ITAR, sending or storing unclassified technical data in the cloud is not an export if it is secured end to end with encryption that meets the standard in 22 CFR 120.54(a)(5) and is not sent to or stored in a proscribed country. If the vendor can read the data in the clear, anyone at the vendor with access is a recipient, and the question becomes who they are. This page explains the rule in plain words; it isn't legal advice, and your empowered official or counsel decides.
See how QuotedPart connects to your workflow with its API, MCP server, autonomous quoting and shop-specific learning.
What the encryption carve-out says
Section 120.54(a)(5) lists activities that are not exports, reexports, retransfers or temporary imports. One is sending, taking or storing technical data that is unclassified, secured using end-to-end encryption, and protected with cryptography that uses modules compliant with FIPS 140-2 or its successors (backed by implementation and key management that follow current NIST guidance), or other cryptographic means that provide at least comparable security to the 128 bits of the Advanced Encryption Standard (AES-128). The data must also not be intentionally sent to a person in, or stored in, a country proscribed in § 126.1, and not sent from such a country. A note adds that data in transit over the internet is not considered stored in a country it passes through (eCFR, checked October 30, 2026).
The condition that does the work is end-to-end. The data has to be encrypted before it leaves your control and stay encrypted while the provider holds it, with the provider not holding the keys. If the quoting software decrypts the file on its servers to read it, measure it or price it, the carve-out doesn't cover that processing.
Two ways a cloud vendor can be used, and the questions to ask
First, the vendor never sees plaintext: the browser or your own system encrypts the files, the vendor stores ciphertext, and only your people can decrypt it. That is the end-to-end case. Second, the vendor does see plaintext, so you rely on the vendor's controls: US-person staff only, data held in the US, access logging, and a contract that binds them. Some vendors offer government cloud regions for this. Whether that satisfies your obligations is a question for your empowered official.
Ask any vendor the questions in the table, and get the answers in writing. We have not compared other vendors' claims here, because a claim only counts if you can read it in their documents.
| Question | A good answer |
|---|---|
| Is the file encrypted before it leaves my browser or server, and who holds the keys? | Encrypted on the client; you hold the key; the vendor can't decrypt |
| What cryptography, and is the module validated (FIPS 140-2 or successor)? | Named algorithm and validated module, or AES-256 with documentation |
| Where is the data stored, and who can access it? | A named region; a list of roles; US persons only if plaintext is visible |
| Does any AI or third-party service read the file? | No, for ITAR files |
| What happens to deleted files and backups? | Stated deletion and backup policy |
| Can I get this in a signed agreement? | Yes |
How QuotedPart handles it, and what that doesn't mean
QuotedPart has an optional ITAR vault. It encrypts models, drawings and technical data in the browser with AES-256-GCM before upload, and QuotedPart's AI never reads vault parts. Before an upload in the app or on the RFQ page, the browser also checks PDF and STEP text for ITAR, EAR and CUI markings and asks before uploading a marked file. ITAR parts go in the ITAR vault.
That is a description of what the product does, not a certification and not a ruling that your use is compliant. Registration with DDTC, licenses, US-person access in your own shop, how you share the data with subcontractors and what is in your contracts remain yours. A vault protects a file; a compliance program protects the shop.
A practical rule for any shop: keep ITAR files out of general-purpose email, shared drives and AI tools, quote them by hand or in a vault, and put the rule in writing for your staff.
Sources and limits
Claims are dated where they can change. Product calculations are examples from the stated inputs, not a promise about a customer's quote. Competitor wording is attributed to the source shown.
- 22 CFR 120.54(a)(5): sending, taking or storing unclassified technical data is not an export if secured by end-to-end encryption using FIPS 140-2 (or successor) modules or cryptography comparable to AES-128, and not intentionally sent to or stored in a country proscribed in § 126.1. — source (checked 2026-10-30)
- QuotedPart's optional ITAR vault encrypts models, drawings and technical data in the browser (AES-256-GCM) before upload; its AI never reads vault parts; the browser checks PDF and STEP text for ITAR, EAR and CUI markings before upload. — source (checked 2026-10-30)
Questions
Is a US data center enough?
Location is one condition, not the whole test. The rule also turns on encryption and on who can read the data. Ask your empowered official.
Does this cover CUI as well?
No. CUI under DFARS and CMMC has separate cloud requirements, such as FedRAMP Moderate or equivalent for providers that handle CUI. See the CUI page.
Price one of your own parts
Drop a PDF drawing or a STEP file. QuotedPart reads the print, measures the model and prices it in seconds, on default shop rates you can change.
Your STEP file or PDF drawingDrop a PDF drawing, a STEP file or both
Free. No account, no email. Priced at our default US rates until you set yours.
Related QuotedPart guides
Answers
Can a customer email ITAR drawings? Gmail, Dropbox and safer quoting paths
How to pause an ITAR drawing transfer, ask the customer for an approved method and keep a quote moving without guessing at export-control compliance.
Answers
How to quote an ITAR-controlled drawing without mishandling it
A shop workflow for scoping an ITAR drawing: classify first, restrict US-person access, control suppliers and price the work only after the transfer path is clear.
Answers
Does a machine shop need ITAR registration?
What DDTC says about registration for US manufacturers and why registration, export authorization and data handling are separate questions.
Answers
A customer cancelled an order part-way through: what can I charge?
Charge for what you've spent and what you can't recover, stage by stage: material, programming and setup, machining done, finishing. A cancellation schedule on a 100-piece bracket order and the clause wording to put in your terms.