Export Control Statement - Nygma.ai
Last Updated: March 18, 2025
This Export Control Statement ("Statement") outlines the export control implications of using the Nygma.ai service ("Service") operated by Genie9 LTD ("Genie9", "we", "us", or "our"), a company registered in England and Wales with company registration number 08669198.
The Service incorporates encryption technology that is subject to export control regulations in various countries. This Statement provides important information about compliance requirements, restricted jurisdictions, and user responsibilities.
1. Encryption Technology Overview
1.1 Encryption Capabilities
The Service implements the following encryption technologies:
- • AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode)
- • ChaCha20-Poly1305 (for performance-optimized encryption)
- • PBKDF2 with 100,000 iterations (for key derivation)
- • TLS 1.3 (for data in transit)
- • All encryption/decryption occurs client-side using locally generated keys
- • Zero-knowledge architecture prevents server-side access to unencrypted data
1.2 Technical Classification
The Service falls under the following technical classifications:
- • U.S. Export Administration Regulations (EAR): ECCN 5D002
- • EU Dual-Use Regulation: 5D002.c.1
- • Wassenaar Arrangement: Category 5, Part 2
- • These classifications are subject to change based on regulatory updates
1.3 Export Control Status
The Service qualifies for the following exemptions under U.S. law:
- • License Exception ENC (encryption commodities and software)
- • Mass Market exemption for publicly available software
- • Similar exemptions may apply under the laws of other jurisdictions
2. United States Export Controls
2.1 Export Administration Regulations (EAR)
- Classification: ECCN 5D002 (Software for cybersecurity)
- License Exception: ENC (Encryption commodities and software)
- Mass Market Status: Qualified for mass market exemption
2.2 Bureau of Industry and Security (BIS) Compliance
- • Annual self-classification reviews conducted
- • Technical documentation maintained for BIS review
- • Compliance with notification requirements under License Exception ENC
2.3 Restricted Countries
Under U.S. export controls, the Service is not available in:
- • Countries subject to comprehensive U.S. trade sanctions
- • Countries designated as State Sponsors of Terrorism
- • Regions subject to specific OFAC restrictions
- • Current list maintained at: https://www.treasury.gov/ofac
3. European Union Export Controls
3.1 EU Dual-Use Regulation
- Classification: Category 5, Part 2 (Information Security)
- General Export Authorization: EU General Export Authorization No. 1 (cryptography)
- Intra-EU Transfers: Generally permitted under EU law
3.2 Member State Requirements
- • Compliance with individual EU member state export control laws
- • Some member states may impose additional requirements
- • Regular review of member state specific regulations
3.3 Third Country Exports
- • Exports to third countries subject to EU dual-use controls
- • License requirements vary by destination country
- • End-user and end-use restrictions apply
4. United Kingdom Export Controls
4.1 Strategic Export Licensing
- Classification: Category 5, Part 2 under UK Strategic Export Control Lists
- Open General Export License: OGEL (Cryptography) applies
- Post-Brexit Compliance: Independent UK export control regime
4.2 Licensing Requirements
- • Open General Export License covers most standard uses
- • Individual licenses required for certain restricted destinations
- • Compliance with UK sanctions regimes
5. Other Jurisdictions
5.1 Canada
- Export Control List: Category 5, Part 2
- General Export Permit: GEP-ENC (Encryption)
- Compliance: Regular review of Canadian export control requirements
5.2 Australia
- Defence and Strategic Goods List: Category 5A002/5D002
- General Export Controls: Encryption exports generally permitted
- Compliance: Australian export control law compliance maintained
5.3 Other Countries
- • Regular review of export control laws in countries of operation
- • Compliance with local encryption and technology export rules
- • Legal advice obtained for complex export control matters
6. Restricted Destinations
6.1 Embargoed Countries
The Service is not available in countries subject to:
- • Comprehensive trade sanctions
- • Technology export restrictions
- • Encryption import prohibitions
- • Other applicable legal restrictions
6.2 Entity List Restrictions
Service not provided to persons on relevant restricted entity lists:
- • U.S. Bureau of Industry and Security Entity List
- • U.S. Treasury OFAC Lists
- • EU Consolidated List
- • UK Consolidated List
- • Other applicable restricted party lists
6.3 End-Use Restrictions
Service not provided for the following end-uses:
- • Nuclear weapons development
- • Chemical or biological weapons development
- • Missile technology development
- • Other restricted military or weapons applications
7. User Responsibilities
7.1 Compliance Obligations
Users are responsible for:
- • Complying with applicable export control laws in their jurisdiction
- • Ensuring authorized use of encryption technology
- • Not providing access to restricted persons or entities
- • Reporting violations to appropriate authorities
7.2 Location Disclosure
- • Users must provide accurate location information
- • VPN or proxy use that obscures location may violate export controls
- • Users responsible for compliance regardless of technical access methods
7.3 Prohibited Transfers
Users may not:
- • Transfer the Service to prohibited destinations
- • Provide access to restricted persons or entities
- • Use the Service for restricted end-uses
- • Circumvent export control restrictions
8. Compliance Monitoring
8.1 Automated Screening
- • Automated screening of user locations and IP addresses
- • Real-time blocking of access from restricted jurisdictions
- • Regular updates to screening databases
8.2 Manual Review
- • Periodic manual review of user accounts and access patterns
- • Investigation of suspicious activity or potential violations
- • Cooperation with law enforcement and regulatory authorities
8.3 Reporting
- • Regular compliance reporting to relevant authorities
- • Voluntary disclosure of potential violations
- • Annual review and audit of export control compliance
9. Technical Safeguards
9.1 Geographic Restrictions
- • Technical measures to prevent access from restricted locations
- • IP address blocking and geolocation verification
- • Regular updates to geographic restriction lists
9.2 Access Controls
- • Strong authentication requirements
- • Account verification procedures
- • Monitoring for unauthorized access attempts
9.3 Encryption Key Management
- • Client-side key generation and management
- • No server-side access to encryption keys
- • Technical impossibility of unauthorized key disclosure
10. Regulatory Cooperation
10.1 Government Requests
- • Cooperation with legitimate regulatory inquiries
- • Technical limitations may prevent full compliance with some requests
- • Legal challenge of inappropriate or overly broad requests
10.2 Information Sharing
- • Sharing of export control compliance information where required
- • Protection of confidential business information
- • Compliance with data protection laws during information sharing
11. Changes and Updates
11.1 Regulatory Changes
- • Regular monitoring of export control law changes
- • Prompt implementation of new requirements
- • User notification of changes affecting service availability
11.2 Service Updates
- • Export control review of new service features
- • Classification updates for technical changes
- • Compliance verification before feature deployment
12. Contact Information
For export control questions and compliance matters:
Export Control Officer:
Email: export-control@genie9.com
Legal Department:
Email: legal@genie9.com
Compliance Questions:
Email: compliance@genie9.com
Mailing Address:
Genie9 LTD
3 Shortlands
W68DA, London
United Kingdom
12.1 Reporting Violations
Suspected export control violations should be reported to:
- • Our export control officer: export-control@genie9.com
- • Relevant government authorities in your jurisdiction
- • Law enforcement as appropriate
This Export Control Statement was last updated on March 18, 2025. Export control laws are complex and subject to change. Users should consult with qualified legal counsel for specific compliance questions.