QuotedPartAnswers · Updated 2026-10-30
Can a customer email me ITAR drawings? Can I use Gmail or Dropbox?
Price one of your own parts: Drop a STEP model or PDF drawing — about 90 seconds, no account.
Your part priced in about 90 seconds, no account.
Do not assume that an ITAR drawing is safe just because it arrived in Gmail or Dropbox, and do not forward it to another service while you decide. Stop the spread, preserve the message and ask the customer which authorized transfer and storage path applies to your shop and any subcontractor. The right answer depends on the technical data, authorization, people, systems and contract. Worked example: a 45-minute controlled-intake review at an illustrative $125/hour is $93.75 of internal effort before the machining estimate; it is a planning assumption, not a compliance fee.
See how QuotedPart connects to your workflow with its API, MCP server, autonomous quoting and shop-specific learning.
Treat the first email as an incident to triage
Keep the original message and attachment where your approved process allows, limit access to the person responsible for export compliance, and do not reply-all with the drawing attached. Record the filename, revision, sender, date and marking. Ask whether the customer intended to send ITAR technical data, which authorization or contract controls it, and what transfer method they require. If your shop lacks an approved system, say that plainly and ask for a secure re-send or permission to decline.
Gmail and Dropbox are product names, not a compliance determination. A service may have a plan or region that a contract permits, or it may be outside the customer’s authorized path. Your shop must verify the account, storage location, administrator access, backups, support personnel and subcontractor access against the contract and your compliance advice.
| Question | Why ask it |
|---|---|
| Is the file actually ITAR-controlled? | The customer or authorized classifier must identify scope |
| Which authorization or contract applies? | The handling and recipient rules flow from it |
| Who may access the file? | US-person and need-to-know limits may apply |
| Which system is approved? | Email, cloud region, backups and support access matter |
| What should happen to the first copy? | Retention, return and destruction need instructions |
Keep the estimate moving without opening extra copies
You can ask for non-controlled commercial information separately: quantity, requested date, material family, finish type and whether an inspection report is required. Do not ask the customer to paste dimensions from controlled technical data into an ordinary email unless the customer’s process allows it. A budgetary range based on an agreed public part family is different from a firm quote based on the drawing; label the distinction.
In the illustrative example, an export-compliance owner spends 45 minutes reviewing the transfer at $125/hour: 0.75 × $125 = $93.75. Add this internal allowance to the controlled RFQ plan only when your business has approved it. The machining price still requires the authorized drawing and routing.
Review the path with the customer and a qualified adviser
Ask the customer for a named secure portal, approved vault or encrypted transfer method, the required user roles and the rule for outside processing. If the customer says “just use Dropbox,” ask them to identify the approved account and contractual basis in writing. Do not claim that a particular consumer plan is ITAR compliant from a marketing page.
Export-control obligations are fact-specific. DDTC registration, a license or exemption, US-person access, CUI controls and cybersecurity requirements are separate questions. Use qualified export counsel or the customer’s compliance office when the answer affects a transfer; this guide is a process aid, not legal advice.
What to do next
Create a canned response that says you received the marked file, have restricted access, and need the approved transfer path before quoting. Keep the exact wording aligned with your compliance program. Once the file is in the authorized system, record who opened it, which revision was used, where the quote is stored and how the record will be closed.
Illustrative intake assumption
- • Controlled-intake review 45 minutes; internal planning rate $125/hour.
- • No claim is made about the compliance status of Gmail, Dropbox or any other service.
| Line | Calculation | Value |
|---|---|---|
| Review time | 45 ÷ 60 hours | 0.75 h |
| Internal effort | 0.75 × $125/hour | $93.75 |
| Machining estimate | Not calculated until authorized drawing path is confirmed | — |
Sources and limits
Claims are dated where they can change. Product calculations are examples from the stated inputs, not a promise about a customer's quote. Competitor wording is attributed to the source shown.
- DDTC’s registration guidance explains that ITAR covers defense articles and technical data and that registration does not itself grant export rights or privileges. — source (checked 2026-10-30)
Price one of your own parts
Drop a PDF drawing or a STEP file. QuotedPart reads the print, measures the model and prices it in seconds, on default shop rates you can change.
Your STEP file or PDF drawingDrop a PDF drawing, a STEP file or both
Free. No account, no email. Priced at our default US rates until you set yours.
Related QuotedPart guides
Answers
How to quote an ITAR-controlled drawing without mishandling it
A shop workflow for scoping an ITAR drawing: classify first, restrict US-person access, control suppliers and price the work only after the transfer path is clear.
Answers
Can I use cloud quoting software for ITAR parts?
Maybe, but only if ITAR technical data is protected the way 22 CFR 120.54(a)(5) requires, or the provider meets the access rules itself. What the encryption carve-out says, what to ask any cloud vendor, and how an ITAR vault fits.
Answers
Does a machine shop need ITAR registration?
What DDTC says about registration for US manufacturers and why registration, export authorization and data handling are separate questions.
Answers
What does CUI on a drawing mean for my machine shop?
CUI (Controlled Unclassified Information) on a print means the government has marked the data for protection. What the marking looks like, what a shop must do with it, and what changes in how you quote.