ECCN or Export Controls Classification Number for nWorks

[epchipko]

Has Veeam registered an ECCN number or done an assessment that describes the nWorks management pack and service and its suitability to be exported to various countries.
It ususally looks like this or similar
ECCN: 5D002

[Gostev]

Eric, it looks like U.S. Export Administration Regulation only affects US-origin items containing encryption functionality. But our software product is not produced in the United States, so those do not even apply to it?

I don't know much about all this, just Googled for a few minutes. Can you confirm?

[epchipko]

I concur with your part of your opinion.

Its unclear to me and my reviewers if a US based company is held accountable for exporting encryption functionality to banned countries just becuase the technology originated outside the US. I am not a legal expert.

Short version - does your product include ANY encryption code at all? So far I only recongize the HTTPS session when logging into nMC and that not really your code. Its browser to IIS.

[Gostev]

I assume nworks does use encryption code because it stores vCenter credentials. I will guess that it uses built-in Windows-based encryption (CryptoAPI) just like all our other products do, so not our own code either. But I will better ping nworks Product Manager and let him answer/confirm this

[Gostev]

Eric, nworks Product Manager is travelling right now, but I have confirmed with development directly. Indeed, nworks MP only leverages Windows encryption capabilities are leveraged.

Traffic Encryption
Microsoft .NET Remoting is used for secure communication between Collector and nMC.

Credential Encryption
Class System.Security.Cryptography.ProtectedData is used to store VC credentials. This class provides access to the Microsoft Data Protection API (DPAPI).

Hope this helps!

[epchipko]

The last statement in the EULA for the product indicates that VEEAM is aware of this issue with specific obligations to the Licensee. The ECCN is the best code for which segments of the Export Controls regulations apply.

[VMark]

epchipko,

I'll be responding to you with our ECCN number privately.

Mark