ITAR · Technical data sharing and transfer
Share ITAR drawings with suppliers and primes. Keep it on U.S. soil, administered only by U.S. persons.
Sharetru Federal is where ITAR technical data crosses your boundary: links for the people you work with, SFTP and the API for the systems you script, and a record of every view and download. It runs only in U.S. data centers and is FedRAMP Rev 5 (Class C) Certified (the new name for FedRAMP Moderate), package F1311222650.
15-day free trial on the certified environment · unlimited guests, never billed
Reviewing for export compliance? See who can reach the data
- Recipient
- j.alvarez@castpart.exampleSent by Sharetru · opens for this address only
- Domain
- castpart.exampleOn your allow-list
- Access
- View-onlyWatermark: viewer and time
- Sign-in
- United States · MFACountry access · authenticator app
- Expires
- Nov 61 of 3 uses
- Stored
- U.S. data centersAdministered by U.S. persons
Activity
- Link sent09:14 · m.okafor
- Registered10:41 · j.alvarez
- View10:43 · j.alvarez · view-only
- Upload16:40 · FAI-HX220-001.pdf
Illustrative share. Names, files and times are invented.
Where Sharetru Federal fits
When ITAR technical data has to leave the building
- 01
A prime’s flow-down
Your prime says to stop emailing ITAR drawings
An attachment leaves copies on mail servers you can’t vouch for. The prime wants one controlled place, and proof.
U.S. persons, U.S. soil, and links tied to one person.
Who can reach it - 02
An export compliance review
A review finds technical data in tools nobody vetted
Shared drives, personal cloud accounts, an old FTP folder, and no record of who opened what.
One place, and a log of every view and download.
Records - 03
Suppliers outside your tenant
Your enclave can’t take every supplier two tiers down
Admitting each one to your enclave, Microsoft 365 GCC High included, means provisioning, and often licensing, an outside account.
Guests register once with MFA and are never billed.
What it costs - 04
A foreign person on the team
A new hire or a visiting engineer is a foreign person
Showing them technical data is an export, even inside your building, and it needs a license or other approval.
Folder permissions you set, and the authorization stays yours.
The rule
Who can reach it
Who can reach our technical data on Sharetru Federal, and who decides?
On Sharetru’s side, only U.S. persons, every one a U.S. citizen, in U.S. data centers; on yours, only the people you give access to. Under ITAR, letting a foreign person see technical data is an export, even here. The map shows the main ways in, and whose decision each one is.
Sharetru’sClosed by how the service is built and staffed
- Sharetru staff. Only U.S. persons as ITAR defines them administer Sharetru Federal, every one a U.S. citizen.
- MIS Sciences staff. GovPoint Cloud Services, the FedRAMP platform beneath it, is administered the same way.
- Data centers. Production and disaster recovery are both in the United States.
SharedSharetru enforces it; you choose who it lets in
- Sign-ins from abroad. Every site starts with country access limited to the United States. Adding a country, and the license behind it, is yours; a VPN that exits here looks like here.
- A supplier’s engineer. When Sharetru sends the link, only the named address opens it, after MFA; a link you copy yourself isn’t tied to a recipient, though whoever opens it still signs in. Whether that person may receive the data is yours to decide.
YoursYour decision and your authorization
- A foreign person on your staff. Showing them technical data is a deemed export and needs a license or other approval. Sharetru doesn’t know anyone’s nationality; your folder permissions do the limiting.
- Your export program. DDTC registration, classification, licenses and agreements, and the records your counsel says to keep.
Illustrative: the main ways in, not every configuration. A guide to the conversation with your empowered official and counsel, not legal advice.
The rule
What does ITAR require of a cloud file‑sharing service?
ITAR certifies no software; it controls exports, and the risk a file service adds is a foreign person gaining access, or data leaving the country. So ask who administers the service and where it keeps your files. Four sections of the rule say why.
22 CFR 120.50(a)(2) (opens in a new tab)Export Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export);
For a file service
An export can happen at home. What matters is who can open the files, wherever they sit. Paragraph (b) counts it as an export to every country where the person has held or holds citizenship, or holds permanent residency.
22 CFR 120.56(a)(3) (opens in a new tab)Release The use of access information to cause or enable a foreign person, including yourself, to access, view, or possess unencrypted technical data;
For a file service
The provider’s administrators are part of the question. On Sharetru Federal, every one of them is a U.S. person, and a U.S. citizen, at Sharetru and at MIS Sciences.
22 CFR 120.54(b)(1)(ii) (opens in a new tab)End-to-end encryption The means of decryption are not provided to any third party.
For a file service
Sharetru Federal doesn’t rely on the encryption carve‑out. It decrypts files to scan and display them, so it rests on who administers it and where it stores files. It encrypts with FIPS 140-3 validated modules all the same. The EAR’s carve-out, 15 CFR 734.18(a)(5), sets the same condition in its paragraph (b), so the same answer holds for EAR-controlled technology.
22 CFR 120.62 (opens in a new tab)U.S. person U.S. person means a person who is a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3).
For a file service
The definition Sharetru uses when it says who administers the service. Knowing which of your own users and guests qualify stays with you.
Records
What record can we show for an ITAR audit or a voluntary disclosure?
Sharetru Federal logs every view, upload, download and permission change to an account, for 12 months; anything kept longer is yours. Export the log to CSV, or forward it by syslog to your SIEM. If your counsel treats it as a record under 22 CFR 122.5, keep it five years.
The service itself, checked in public
FedRAMP Marketplace package F1311222650 lists Sharetru Federal under certified services in MIS Sciences Corporation’s GovPoint Cloud Services: Class C (Moderate), FedRAMP Certified, at IaaS, PaaS and SaaS.
yourcompany.sharetru.com · file log · illustrative export
| Time | Event | Account | Detail |
|---|---|---|---|
| 2026-10-02 09:12 | Upload | m.okafor | /Programs/HX220/Out/HX220-rev-C.pdf |
| 2026-10-02 09:14 | Link sent | m.okafor | HX220-rev-C.pdf to j.alvarez@castpart.example |
| 2026-10-02 10:41 | Registered | j.alvarez@castpart.example | Guest account created |
| 2026-10-02 10:43 | View | j.alvarez@castpart.example | HX220-rev-C.pdf · view-only |
| 2026-10-02 16:40 | Upload | j.alvarez@castpart.example | /Programs/HX220/In/FAI-HX220-001.pdf |
A record of every action, not of every file: Sharetru keeps no prior versions, and the log shows when a file was replaced or deleted, and by whom.
- 1
Forward the log as it happens.
Syslog to any SIEM: Microsoft Sentinel through a data collection endpoint, Splunk, QRadar and others. Your SIEM’s retention becomes the log’s.
- 2
Or export it on a schedule.
CSV from the log screen, or the latest 90 days over the API, into the archive that holds your licenses.
- 3
Review who can reach each folder.
The Users Access report lists every registered user’s permission on every folder, as CSV.
- 4
Have users acknowledge export controls.
A user agreement at sign-in that each registered user accepts; a report shows who accepted, and when.
For your reviewers: the FedRAMP listing is public. The SOC 2 Type II report and the NIST SP 800‑171 responsibility matrix come with a trial, under the NDA in the Terms of Service. So does a signed statement that only U.S. persons administer Sharetru Federal and that it stores files only in the U.S.: open a support ticket once your trial starts. The log is yours to export.
Plans and pricing
What does it cost to keep ITAR data on Sharetru Federal?
The Sharetru Federal package is $200 a month on top of a Core or Complete plan, on a 12-month commitment. Your suppliers never add to it: guests are never billed, however many you share with.
Sharetru Federal package
$200a month, added to your plan
As the plan page lists it
What it adds for ITAR technical data
- Stored in U.S. data centers
- Administered by U.S. persons
- FedRAMP Rev 5 (Class C) Certified
- FIPS 140-3 validated
- Authenticator-app MFA
- 12 months of logs
What your suppliers cost you
$0for every guest, at every tier
- 1 supplier
- $0
- 25 suppliers
- $0
- Their suppliers, a tier down
- $0
A supplier registers once with the address you sent to and an authenticator app, then opens only what you share. No seat in your tenant, and no license per supplier.
- Your planCore for 10, 20 or 30 users, or Complete for unlimited users; every price is on the plan page
- Commitment12 months; paying annually saves 10%
- Try it first15 days on the certified environment
Why Federal only? ITAR names no platform; this is Sharetru’s choice. Sharetru Federal is where U.S.-person administration and U.S. storage hold at every layer and are assessed every year, so it is the only platform we offer for ITAR technical data.
Run Sharetru for clients? If you’re an MSP or consultant serving defense manufacturers, book thirty minutes: tell us how you work with your clients and we’ll walk through the partnership options.
FAQ
Questions buyers ask before they put ITAR technical data in a cloud service
Is Sharetru ITAR certified?
No: ITAR has no certification for software or cloud services; the State Department’s DDTC registers companies and licenses exports. What a file service can show is who administers it and where it keeps data. For Sharetru Federal, that is U.S. persons and U.S. data centers.
Does keeping technical data in Sharetru Federal count as an export?
Not by Sharetru’s doing: the files are stored in U.S. data centers and administered only by U.S. persons, so Sharetru gives no foreign person access. Sharing a file is a release you make, and authorizing it is yours.
Can a foreign person on our staff use Sharetru Federal?
Only with a license or other approval: giving a foreign person access to technical data is a deemed export, even inside the United States. Sharetru doesn’t know anyone’s nationality. Set folder permissions so they reach only what your license or agreement covers, and check the Users Access report.
Can we share technical data with a partner outside the United States?
Only under your license or other approval, and only after you add their country to country access, which starts limited to the United States. Add a country listed in 22 CFR 126.1 only with your counsel. Links, MFA and the log work the same way for them as for a U.S. supplier.
Is Sharetru Federal end-to-end encrypted under 22 CFR 120.54(a)(5)?
No: Sharetru Federal decrypts files to scan and display them, so it relies on U.S. persons and U.S. storage, not that carve-out. Files are encrypted in transit and at rest with FIPS 140-3 validated modules. If you encrypt a file yourself before upload, with keys only you and your recipient hold, ask your counsel whether the carve-out covers it.
Who at Sharetru can reach our files?
Only U.S. persons administer Sharetru Federal, every one a U.S. citizen, and the same holds for the infrastructure beneath it. Inside your site, your administrators decide who opens what.
How long are logs kept on Sharetru Federal?
Twelve months; anything longer is kept in your own archive, by CSV export or SIEM forwarding. If your counsel treats the log as a record under 22 CFR 122.5, that archive holds it for five years.
Does ITAR require a FedRAMP Certified service?
No: ITAR asks who can reach technical data and where it goes, not for FedRAMP. Technical data is often CUI as well, though, and when a contract carries DFARS 252.204-7012, a cloud service holding it must meet FedRAMP Moderate or its equivalent. Sharetru Federal is certified.
Can ITAR technical data go on Sharetru Commercial?
No: Sharetru offers ITAR technical data only on Sharetru Federal, where U.S.-person administration and U.S. storage hold at every layer. That is Sharetru’s policy, not a line in ITAR, which names no platform. Commercial suits files that aren’t export-controlled.
Do our suppliers need a CAC or a Sharetru license to open a file?
No: a supplier registers once as a guest with the address the link went to, a password and an authenticator app; guests are never billed. They see only what you shared, for as long as the link lasts, and send files back through an upload-only link into a folder you choose.
Can Sharetru Federal replace our SFTP server or MFT tool?
Yes for the endpoint: scripts, schedulers and partner servers connect over SFTP, FTPS, SCP or the REST API. Sharetru has no job engine, so scheduling, retries, transformations and PGP stay in your scripts. The automation page covers the details.
Can ITAR technical data and CUI share one Sharetru Federal site?
Yes: one Sharetru Federal site can hold both, with folders, groups and permissions keeping each program to its own people. One site means one set of rules, one guest list and one log.
Next step
Bring your export lead’s questions, or start a free trial
Two ways in. Book the 30-minute security and compliance review and send the questions ahead; written answers follow. Or start the trial yourself from the pricing page.
Rather see a drawing go out first? Request a 60-minute demo on a live Sharetru Federal site with sample files. Not a compliance project? Talk through how you move files today.
Sources. Regulatory facts from the International Traffic in Arms Regulations, 22 CFR 120.33, 120.50, 120.54, 120.56, 120.62, 122.1, 122.5 and 126.1, on eCFR, from DFARS 252.204-7012 and 32 CFR 170, and from FedRAMP Marketplace listing F1311222650. Product facts from Sharetru product documentation and the plan page. Screens, names and files on this page are illustrative. Not legal advice: your empowered official and counsel decide what your exports need.