Showing a foreign learner the wrong training video can cost a training company up to $1,271,078 in civil penalties per violation, or twice the value of the transaction if that's higher. If it's wilful, it's a crime: fines of up to $1 million per violation, up to 20 years in prison, or both (22 CFR 127.10, 22 U.S.C. 2778).

That's because under ITAR (International Traffic in Arms Regulations), an export isn't only shipping something overseas. Showing controlled technical data to a foreign person counts too, even if they're sitting in the next office in the US, and it needs a licence, other approval or exemption from the State Department's Directorate of Defense Trade Controls (DDTC). It counts as an export to every country they hold or have ever held citizenship of, and any country where they currently hold permanent residency (22 CFR 120.50). In an LMS (learning management system), every page with controlled content on it is a potential export.

This week I spoke to a training company that's trying to get an LMS built for exactly this kind of training. Its courses include ITAR-controlled technical data, and its learners are all overseas. It had already spent about seven months, on and off, in a discovery phase with another developer, scoping that LMS, before stopping the project. That developer tried to build it by joining off-the-shelf products together. Each product could handle some of the rules but none could handle all of them, so nothing was ever built.

I'm not a lawyer. Your export compliance lead and your licences decide what applies to you.

Four rules that decide how the LMS is built

Showing the content is an export

Under ITAR, "releasing or otherwise transferring technical data to a foreign person in the United States" is an export, called a deemed export (22 CFR 120.50). A release includes "oral or written exchanges" of technical data with a foreign person (22 CFR 120.56), and a licence is needed for any "oral, visual or documentary disclosure" of technical data to a foreign person, including by electronic means (22 CFR 125.2). So a course page, a video or a 3D model shown to a foreign learner is a release that their export authorisation has to cover, whether that learner is in another country or in the next office.

Every nationality counts

Under ITAR, a release to a foreign person in the US counts as an export to every country where that person "has held or holds citizenship or holds permanent residency" (22 CFR 120.50). So a learner whose current citizenship is covered by a licence isn't automatically cleared if they hold, or once held, another one. The EAR (Export Administration Regulations), which cover commercial and dual-use technology, is narrower: a deemed export goes to the person's "most recent country of citizenship or permanent residency" (15 CFR 734.13). The same learner can get a different answer depending on which regime a piece of content falls under.

Where the learner is matters too

ITAR also treats it as a release when access information (a password, key or network access code) is used to let a foreign person see unencrypted technical data, or to decrypt technical data outside the US, whoever does the decrypting. Giving a foreign person that access information needs the same authorisation as giving them the data itself (22 CFR 120.55, 22 CFR 120.56). So where a learner is when they open controlled content can matter, as well as who they are.

Encryption changes what counts

Both regimes say that sending or storing unclassified data isn't an export if it's encrypted end to end with FIPS 140-2 (Federal Information Processing Standard 140-2) validated modules or equivalent (under ITAR, at least as strong as AES-128, the 128-bit Advanced Encryption Standard), and no third party is given the means to decrypt it. It also can't be intentionally stored in a restricted country: under ITAR the countries listed in 22 CFR 126.1, which it also can't be sent to or from, and under the EAR those in Country Group D:5 (22 CFR 120.54, 15 CFR 734.18). Accessing data in that encrypted form isn't a release.

That's what allows a provider to store data it can't read. But decrypting content so a foreign learner can view it is a release, and whoever holds the keys can decrypt it, so the keys decide who can see it.

Taken together, the four rules mean the platform has to know who every learner is, where they are and what they're cleared to see, every time they open something. That's what the requirements below are for.

LMS security requirements for export-controlled training

Here's how those rules turned into requirements for this company. Your licences will change the details.

1. Hosting and encryption

If a foreign person can reach unencrypted controlled data on a server, that access can be a release. So this company wants controlled data on US servers, run by US persons.

End to end has a specific meaning in the rules: the data stays encrypted between the sender and the intended recipient, and nobody else gets the means to decrypt it. A web application usually decrypts data on the server to show it to the learner. So my reading is that the carve-out helps most with storage, backups and transfers, and the live servers still need to sit somewhere that meets the rules. In practice that means:

• application servers in the US, administered by US persons;

• data encrypted in transit and at rest, with keys held in a key management system the client controls, not the hosting provider or the developer;

• backups encrypted the same way, so they can sit with a provider without anyone there being able to read them;

• logs, caches and error reports kept inside the same boundary, or stripped of content.

Logs are on that list because a database can be encrypted properly and still leak through a debug log that prints the contents of a page.

2. Access by person and licence

A role like learner, instructor or admin says what someone can do, not who they are. Under ITAR, who they are decides what they can see. Each learner needs attributes the platform checks every time they open something:

• US person or foreign person;

• every country of citizenship and permanent residency, past and present where ITAR content is involved;

• the licence or other authorisation that covers them, with its scope and expiry date;

• the client organisation they belong to.

Those attributes should come from the client's compliance team, not from a sign-up form. I'd build it so a named compliance person verifies them and the platform records who verified what, and when. Each content item then carries the authorisation it needs, and the platform only shows it when the learner's attributes match. When a licence expires, access stops on that date without anyone having to remember to switch it off.

Uncontrolled content opens for anyone. Controlled content opens only when every check passes, and every refusal is logged as well as every view.

3. A separate space for each client organisation

This company trains several overseas customers, each covered by its own export approval, so one customer shouldn't see another's content, learners or records. That's multi-tenancy, but the strict kind: separation enforced in the database layer, so a mistake on one screen can't show another tenant's data. Client admins can manage their own people, but they can't change a learner's nationality or licence status. That stays with the training company's compliance team.

4. Content classified as controlled or uncontrolled

A course can mix general material that anyone can see with controlled technical data. If the platform can't tell the two apart, it has to either lock the whole course down or risk showing controlled material to everyone. So each piece of content, down to a single video or 3D model, carries a classification: uncontrolled, or controlled with its jurisdiction and category. That means a USML (US Munitions List) category under ITAR, or an ECCN (Export Control Classification Number) under the EAR.

Mixed courses then work. Everyone sees the general modules, and only covered learners see the controlled ones. The classification also tells the platform which deemed export rule to apply, because ITAR and the EAR treat nationality differently.

5. Compliance sign-off before release

Controlled content shouldn't go live because a course author pressed publish. I'd build an approval step where a named compliance person checks the classification and the audience before release. Editing an approved item sends it back for review, and the platform keeps every approved version, so you can show exactly what a learner saw on a given date.

6. Closing the side doors

Controlled content can also leave the platform through the tools around it:

• Email. Notifications should say "you have a new module" with a link, never include the content itself.

• Downloads and printing. Off for controlled content, or limited and logged where the client allows it.

• Video and file hosting. On the same approved hosting, served through short-lived signed links, never a public video platform.

• Third-party scripts. Analytics, chat widgets, error monitoring and session recording can all send page content to someone else's servers. On controlled pages I'd remove them, or host equivalents inside the boundary.

• AI features. Sending course content to an external AI service to summarise it or answer a question puts that content on another company's servers. If the client wants AI features, the model has to run inside the same boundary.

• Support access. Support staff who can view a learner's account can see the controlled content in it, so support for controlled content has to come from authorised people.

7. A full audit log

Every time controlled content is opened, the platform records who opened it, which item and which version, when, and from where (IP address and approximate location). That record shows who saw each piece of controlled content and whether they were allowed to.

ITAR registrants must keep records of what happens to technical data for five years from the licence's expiry (or from the date of the transaction, where an exemption is used) and make them available for inspection (22 CFR 122.5). The EAR has a similar five-year rule (15 CFR 762.6). So I'd keep the access log at least that long and make it tamper-evident, so nobody can quietly edit it. Location is in there because of the release rules above. If your compliance lead decides controlled content shouldn't be opened outside approved countries, the same data lets the platform block it.

8. Authoring inside the same boundary

Authoring was one of the two problems the last project couldn't solve. Every course-building tool the company looked at stored content on that tool's own cloud, so none of them could hold controlled material. Today their training manager builds everything in PowerPoint on his own laptop, because he knows the files stay there. It works for classroom sessions, but he can't add the interactive 3D models he wants.

The 3D models and source files need the same protection as the finished course, so authoring has to happen inside the platform, on the same hosting, under the same access rules:

• an editor the training manager can use without code, for text, video, quizzes and 3D content;

• 3D models converted and shown in the browser from files on the same hosting, with no third-party viewer or content delivery service;

• drafts covered by the same classification and approval rules as published content.

Who builds it, and who can see the data

That leaves the people building the platform. We're a UK team, and the client is in the US. Under ITAR our developers are foreign persons, so if we could see the client's controlled data, that would be a release to us. There are two ways to handle that.

Option 1: get authorisation that covers us

The usual route is a licence or agreement from DDTC that covers our team. DDTC doesn't charge for licences or agreements, only for annual registration, which a company already exporting under ITAR will have (DDTC fee rule). This company estimated that adding the UK to its approvals would cost it about $3,000.

Since 2024 there's also a licence exemption for transfers between the US, the UK and Australia (22 CFR 126.7). It can apply when the US client is registered with DDTC, the UK company has been vetted and enrolled as an "Authorized User", and the data isn't on the rule's excluded technology list.

Once we're covered, we can host and run the platform for them like any managed platform, on hosting that meets the rules. We can support it directly: fixing problems in the live system, deploying updates and checking the logs ourselves. Server management is part of our support retainer, so there's no separate hosting company to pay.

Option 2: we never see the data

We build the platform without ever touching the live system. It's how we worked with a large social media company that didn't want any outside company holding its data:

1. We build and test the platform on our own servers, using made-up test data. No controlled content ever goes there.

2. When a release is ready, we hand over the code. The client, or a US hosting provider working for them, deploys it to their US servers.

3. The live platform, its database and its encryption keys stay with the client, run by their US persons.

4. Every update follows the same route: we build and test, they review and deploy.

We only ever hold the code and made-up test data. The live data, the keys and the people running the servers all stay on the client's side.

The catch is who runs the live servers. Without authorisation covering us, the client needs its own technical team or an independent US-based server management company to deploy updates and keep the servers running. I'd expect an independent server management company to cost somewhere between $1,500 and $8,000 a month. And when something breaks in the live system, we can't just log in and look. So the build needs diagnostics that never include controlled content: error reports that say which feature failed and why without the page's content, and a way to reproduce the problem with test data. That's more work up front, and I'd rather plan it into the scope than discover it after launch.

What I'd recommend

For most clients I'd recommend option 1. Getting authorisation costs time and paperwork for each approval, while a separate server management company is likely to cost $1,500 to $8,000 every month. And the team that built the platform can support it directly. It's still the client's decision, made with their export compliance lead.

Why joining off-the-shelf tools together didn't work

The requirements above explain why joining existing products together stalled. Each product brings its own hosting, its own logins and its own rules on who can see what, and the requirements depend on each other.

Access rules don't help if the video host ignores them, and an audit log is only useful if it covers every place the content can be opened.

How we'd scope it

In our Blueprint we'd start with the compliance workflows, before any screens: how a learner's status is verified, how content is classified and approved, what gets logged and for how long, where everything is hosted, and who holds the keys. Each of those gets agreed with the client's export compliance lead and written into the technical scope, and the build follows it.

If you're planning a platform for export-controlled or other regulated training and want a second pair of eyes on your requirements, I'm happy to go through them with you. Explore your options.

FAQ

What are the LMS security requirements for ITAR training?

Hosting and encryption that meet the rules, access based on each learner's nationality and licence, a separate space for each client, classified content, compliance sign-off, no leaks through third-party tools, a full audit log, and authoring inside the same boundary.

What is a deemed export?

Releasing controlled technical data or technology to a foreign person inside the United States. Under ITAR it counts as an export to every country where that person has held or holds citizenship, and any country where they currently hold permanent residency. Under the EAR, it goes to their most recent one.

Does an ITAR-compliant LMS have to be hosted in the US?

Not always. Data encrypted end to end to the standard in 22 CFR 120.54 can be stored elsewhere, but the servers that decrypt and display it still need to meet the rules, so ask your export compliance lead which approach fits your licences.

Can a non-US company build an LMS for ITAR content?

Yes. Either the developers are covered by a DDTC licence or agreement (or, for a UK or Australian company, possibly the exemption in 22 CFR 126.7), or they build with made-up test data and hand the code to the client, or a US server management company, to run.

Can we use a cloud authoring tool for export-controlled courses?

Only if its hosting, access controls and keys meet the same rules as your LMS. The company in this post couldn't find one that did.