Legal

Export Compliance & Sanctions Notice

Product: Ferrite Desktop Firewall Status: Draft — classification pending

DRAFT — classifications not yet confirmed. The classifications below (Canadian and U.S.) are a preliminary engineering assessment, not a determination. Ferrite Security must obtain formal classifications and file any required encryption self-classification / notification in each applicable regime before relying on this. Not legal advice.

Related drafts: Acceptable use · Security · Open-source notices · Data Processing Addendum

Ferrite includes cryptography and network-inspection technology and is therefore subject to export-control and economic-sanctions laws. By downloading or using Ferrite, you agree to the terms below.

1. Export classification

Ferrite implements encryption (including TLS, QUIC, and post-quantum digital signatures) and is therefore subject to export-control law in the countries from which and into which it is distributed — not only the regime named below.

Canada. Ferrite Security operates from Canada, so the Export and Import Permits Act and Canada's Export Control List — administered by Global Affairs Canada, under Canada's participation in the Wassenaar Arrangement — govern export from Canada in the first instance. The Export Control List's Group 1, Category 5, Part 2 includes a "Mass Market Note" (Note 3): cryptographic software meeting four conditions needs no export permit at all. Our own (non-authoritative) read is that Ferrite plausibly meets all four — sold to the general public without restriction, its cryptographic functionality isn't user-alterable (activating a license key is exactly the kind of simple activate/deactivate the note itself permits), it installs without our ongoing support, and we'd disclose technical details to Global Affairs Canada on request rather than proactively filing anything. This is engineering-level research, not a legal conclusion — the classification is not yet formally confirmed, and no self-classification filing has been made.

United States. Where U.S. law also applies (for example, use by a U.S. person, or components sourced from the U.S.), Ferrite is subject to the U.S. Export Administration Regulations (EAR) and comparable regimes. We assess it as [mass-market encryption software, expected ECCN 5D992.c — to be confirmed]. Whether dual-use "surveillance" / "intrusion software" controls (for example under EU Regulation 2021/821) apply to its deep-inspection features is [under review].

2. Embargoed destinations and sanctioned parties

Ferrite may not be downloaded, exported, re-exported, or used in or by any country, region, entity, or individual subject to comprehensive sanctions or trade embargoes, including those administered by Canada under the Special Economic Measures Act and the United Nations Act (Global Affairs Canada's Consolidated Autonomous Sanctions List), the U.S. Office of Foreign Assets Control (OFAC), the EU, and the UK. This currently includes, without limitation, [Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions], and any party on a denied- or restricted-party list (for example Canada's Consolidated List, the OFAC SDN List, or the BIS Entity List).

3. End-use restrictions

You may not use Ferrite in connection with any prohibited end use, including the development of weapons of mass destruction or other uses restricted by applicable export law.

4. Your representations

By using Ferrite you represent and warrant that: you are not located in, under the control of, or a national or resident of an embargoed region; you are not on any denied- or restricted-party list; and you will not export or re-export Ferrite in violation of applicable law.

5. Screening

We screen orders and downloads against applicable sanctions lists and may block or refuse access where required to comply with the law.

← Back to home · Questions: admin@ferritesec.com