Restricted Data Policy

What counts as restricted or regulated data

EAR99 items and published catalog data need no declaration beyond No.

• ITAR technical data (defense articles, US Munitions List).
• Export-controlled technology under the EAR with an ECCN (not EAR99), for example certain chemical-process vessels, heat exchangers, valves and pumps, or nuclear-related equipment.
• Controlled Unclassified Information (CUI), DoD distribution statements B to F, DFARS 252.204-7012 data.
• Nuclear technology (DOE 10 CFR Part 810), NRC Safeguards Information, UCNI.
• Classified information.
• Critical infrastructure security information: CEII, SSI (including TSA pipeline security), CVI, PCII.
• Third-party confidential material under an agreement that limits cloud or AI processing.
• Health records (HIPAA) and sensitive personal data.

Customers control what they upload

Customers are expected to have their own controls for regulated data. Classification under ITAR, the EAR, CUI rules and other rules is the customer's responsibility, not ours.

The declaration

Before files are processed, the person uploading them answers: does any file contain restricted or regulated data? No: the files are processed. Yes or Not sure: we show how files are processed and which services do it, and the person either accepts responsibility and proceeds, or declines. Declined files are removed and never processed.

Accepting needs a role with the restricted-content consent permission in the workspace. Without it, the files wait until someone with that permission accepts or declines them.

Markings we look for

Before any AI call, our code checks file names, text layers and title blocks for markings such as ITAR, EAR, ECCN, CUI, Distribution B to F, NOFORN, classification banners, SGI, UCNI, CEII, SSI, Proprietary and Export Controlled. If it finds any, the upload pauses. A person accepts, declines, or says the files are not restricted. Every choice is recorded and the workspace's admins are notified.

What we record

Who decided, their role, the workspace, the time (UTC), the files and their checksums, the answer, the markings found, any claim that a marking is a false positive, the version of the consent text shown, and whether files were accepted or declined.

Reporting a misclassified upload

Any upload can be reported from the app. We remove the file and everything derived from it (extracted values, models, renders, drawings, cached research), record the report and notify the workspace's admins. Catalog items already published from it are listed for a person in the workspace to unpublish.

Disclaimers

• The declaration does not determine export classification and is not legal advice.
• AI-extracted values are unverified and are not quality records.

Contact

To report a problem with restricted data: info@pitchlume.ai.