Export control and sanctions position

Applies to: Throughline 3.0.0 · Last updated: 2026-09-22
Status: engineering position — requires confirmation by counsel before the
first international sale.

1 · Why this applies at all

Throughline is proprietary software distributed internationally, and it contains cryptography. That is enough to bring it inside the US Export Administration Regulations. The open-source publication exemption (EAR §734.7) does not apply, because the source is not published.

2 · Cryptography inventory

use	library	algorithm
Licence signature verification	PyNaCl / libsodium	Ed25519
Transport security	`cryptography`, `certifi`, system TLS	TLS 1.2/1.3
Password hashing	`argon2-cffi`, `passlib`	Argon2id
Cache and file integrity	`hashlib`, `xxhash`	SHA-256, xxHash
Update signature (if enabled)	Sparkle	Ed25519

Cryptography is ancillary to the product’s function. Throughline is a video synchronisation tool; it uses cryptography to protect licences, transport and integrity, and for nothing else. It provides no cryptographic service to the user and exposes no cryptographic API.

3 · Classification

Position: ECCN 5D992.c — mass-market encryption software, self-classified under License Exception ENC.

The product meets the mass-market criteria of Note 3 to Category 5 Part 2: sold without restriction from stock at retail, with cryptographic functionality that the user cannot readily change, designed for installation without further substantial support from the supplier.

Consequences:

Annual self-classification report to BIS and the ENC Encryption Request Coordinator, due by 1 February for the preceding calendar year. Owner: the publisher (Lucrative Pictures LLC), reviewed annually in January. This is the obligation most likely to be quietly missed, so it is named rather than assumed.
ITSAppUsesNonExemptEncryption = true in Info.plist, with the matching App Store export-compliance answer if Mac App Store distribution is pursued.
No CCATS is required for 5D992.c self-classification.
Retain records for five years.

If counsel concludes the correct classification is EAR99, obligations 1 and 3 fall away; §4 still applies in full.

4 · Destination restrictions

Sales must be blocked to comprehensively sanctioned destinations, and purchasers screened against the restricted-party lists:

Embargoed: Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk and Luhansk regions of Ukraine.
Restricted: Russia and Belarus carry software-specific measures under both US and EU regimes.
Screening: BIS Denied Persons List, BIS Entity List, OFAC SDN List, and the EU consolidated sanctions list.

Where this is enforced — and where it must not be

At the storefront, at the point of sale. Not in the application.

An IP-based block inside the binary is the wrong control and should not be built. It fails offline — where this app is designed to run; it is defeated by any VPN; and it strands legitimate customers who travel. Sanctions compliance is a transaction control, and the transaction happens on the website.

A Merchant of Record (compliance plan §6) performs this screening as part of its service, which is a further argument for using one.

5 · Other regimes

regime	position
EU Dual-Use Regulation 2021/821	Mass-market cryptography benefits from the Cryptography Note; no EU export authorisation is expected for retail sales to consumers.
Wassenaar Arrangement	The mass-market note is the basis in most member states; national implementations vary.
France	Import and supply of cryptographic means were liberalised for mass-market authentication and integrity uses; no declaration expected.
China · Russia	Both operate cryptography import/licensing regimes. Both are already excluded on other grounds (compliance plan §3.4).

6 · Record to keep

For each release, archive: the version and build date, this classification position, the cryptography inventory in §2, the SBOM (SBOM.json), and the date the annual report was filed. Five years.