ITAR vault

How the ITAR vault works

The vault lets a shop quote export-controlled parts in QuotedPart without QuotedPart ever holding readable technical data. Models and drawings are encrypted in your browser before upload, the key stays with your team, and vault parts are priced in your browser. This page is for the person who has to sign off on it.

What is encrypted, and what isn't

Encrypted in your browser: The 3D model, the drawing, the thumbnail and the part's technical data (measured geometry, routing, material, finishes, what was taken from the print, and notes) are encrypted with AES-256-GCM in your browser before upload, using the browser's built-in WebCrypto. Every value gets a fresh random 96-bit IV and is bound to what it is (model, drawing, part data), so one ciphertext can't be swapped for another.
What we store: QuotedPart's backend (Convex on AWS in the US) and its website host (Netlify) hold only that ciphertext. Files are stored as opaque binary.
What stays readable: The part's name and part number, its quantities, the unit price, total and lead time for each quantity (without the cost lines, which name materials and weights), the quote's status and the customer. Quote pages, totals and orders need them.
Priced in your browser: Vault parts are measured and priced in your browser from the 3D model and your rates, with material and tolerances from the print. The server stores the prices but never reprices a vault part, and refuses any server-side change to its technical data.

The key

The shop key: A random 256-bit AES-GCM key, made in the owner's browser when the vault is turned on. One key per shop.
The passphrase: The team picks a vault passphrase of at least 12 characters. QuotedPart stores the shop key only wrapped (encrypted) under a key derived from that passphrase with PBKDF2-SHA256, 600,000 rounds and a random salt, and refuses a key wrapped with fewer rounds. The passphrase never leaves your browsers.
The recovery key: Shown once when the vault is turned on and downloaded as a file. It is the shop key itself, so keep it offline. We never store it. It opens the vault if the passphrase is lost, and lets the owner set a new passphrase.
Unlocking a device: Each person unlocks the vault once per device with the passphrase. The key is then kept in that browser as a non-extractable key: it can encrypt and decrypt there but can't be read back out. Lock vault removes it from the device. Decrypted files live in memory only and are dropped when the vault locks.
Who holds it: Only your team. We never receive the passphrase, the recovery key or the unwrapped key, so we can't open vault parts, and we can't recover a lost passphrase. If both the passphrase and the recovery key are lost, nobody can open the vault parts. Helios One Oy, which makes QuotedPart, is a Finnish company: give the passphrase and recovery key only to people allowed to receive your controlled data.

AI and vault parts

QuotedPart's AI provider never receives vault parts. Drawings of normal parts are read through our Anthropic account; vault parts never are.
Optional, AI in your own AWS GovCloud: the owner pastes an Amazon Bedrock API key from the shop's own AWS GovCloud (US) account in Settings. It is checked with a text-only request, then encrypted with the vault key in the browser, so we store only ciphertext of it.
When a vault part has a drawing, your browser decrypts it and sends it directly to Claude on Amazon Bedrock in AWS GovCloud (US-West) (https://bedrock-mantle.us-gov-west-1.api.aws), with your API key. What Claude read is encrypted with the part. Our servers, analytics and logs never see the drawing, the read or the key, and AWS bills the usage to your account.
To use our AI on a part that turns out not to be controlled, an estimator chooses "Use AI on this part (not export-controlled)" and confirms it isn't ITAR, EAR or CUI controlled. The browser checks the decrypted files for export-control markings, stores them as normal files, and the part becomes a normal part. The move is logged with who and when.

Where the vault's boundary is

RFQ emails forwarded to your shop's address and your public RFQ page create normal parts, not vault parts. Add ITAR drawings in the app, into the vault.
Before a normal part is uploaded, and before a buyer uploads on your RFQ page, the browser searches the PDF drawing's text layer and the STEP file's text for export-control markings (ITAR, 22 CFR 120–130, the Arms Export Control Act, the EAR, an ECCN, CUI) and asks before anything leaves the machine. In a vault shop it points the estimator to the vault. A scanned drawing with no text layer can't be searched.
Send to JobBOSS² and Export for JobBOSS skip vault parts. CSV and Excel order exports carry only a vault part's name, number, quantity and price.
The account data export marks vault parts and leaves out their technical data, which stays encrypted.

What a vault shop's devices turn off

Session replay, autocapture, heatmaps, dead and rage clicks, console, error and performance capture are off. Analytics keeps page views and named product events only.
The Google Ads tag doesn't load, and feedback is sent without an automatic screenshot.
AI logs for the shop keep no request or answer text, only token counts, cost and outcome.
A strict Content Security Policy goes into the page before anything is decrypted: scripts only from QuotedPart's own site, and network requests only to QuotedPart, its Convex backend, the EU analytics host and the AWS GovCloud Bedrock endpoint. No third-party script can load or receive decrypted data.
These settings stay on for the device from the first time it opens a vault shop.

The design target

22 CFR 120.54(a)(5) says that sending or storing unclassified technical data is not an export when it is secured with end-to-end encryption and the means to decrypt it are never given to a third party, among other conditions in that section. The vault is designed for that rule: technical data is encrypted with AES-256 before it leaves your machine, and the means to decrypt it stay with your team. You decide whether a part is export-controlled and whether the vault fits your contracts and obligations; section 9 of the Terms has the details.

Turn it on

A shop owner opens Settings, ITAR vault, and chooses Turn on the ITAR vault.
Pick a team passphrase of at least 12 characters. It stays in your browsers.
Download the recovery key, store it offline, and confirm you saved it. Once on, the vault stays on.
Choose whether new parts go to the vault by default. On the quote screen, tick ITAR vault next to Upload files to put a part in the vault.
Each estimator unlocks the vault once on their own device with the passphrase.
Optional: set up AI for vault parts with a Bedrock API key from your AWS GovCloud account.

The vault is part of every QuotedPart plan. How the rest of your data is handled is on the security page.

Questions from your security or export-compliance person? Email support@quotedpart.com or book 15 minutes with a founder.