Export Control Classification

Classification of Record: July 14, 2026  ·  Revised August 10, 2026  ·  BlackAtlas LLC

BlackAtlas LLC maintains good-faith export-control self-classification records for its products. This page summarizes the classification of record for customers, procurement officers, and compliance reviewers. It is published for transparency; the underlying memoranda are retained on file.

Jurisdiction

All BlackAtlas products are commercial or dual-use items subject to the U.S. Export Administration Regulations (EAR, 15 CFR 730–774), administered by the Bureau of Industry and Security (BIS). No BlackAtlas product is on the U.S. Munitions List, and none is subject to the ITAR. Classification follows the EAR Order of Review (Supplement No. 4 to Part 774).

No BlackAtlas product employs government-restricted cryptographic access mechanisms (such as SAASM or M-code), adaptive anti-jam antenna nulling, or any defeat, jamming, neutralization, or electronic-attack function. Those are the characteristics that would move an item to a controlled munitions or higher dual-use classification; none is present.

Classification Summary

"NLR" means No License Required. AT-only control is the lowest tier of dual-use control on the Commerce Control List.

Basis of classification

AtlasRF and the GridDown Sensor Hub (7A994). Both are passive, receive-only situational-awareness appliances. Each incorporates a commercially available GNSS receiver, and BIS guidance is explicit that commercial GNSS receivers that do not employ military-code decryption or adaptive anti-jam antennas are classified 7A994. Under the Order of Review the GNSS receiver is the highest-controlled component, so it determines the classification of the finished appliance. Encryption is present only as standard, published transport security (TLS, WPA2/WPA3) and, where a certified wireless module is incorporated, that module carries its own mass-market encryption classification; in both cases the cryptography is ancillary to the appliance's primary situational-awareness function and does not elevate the classification. AtlasRF and the GridDown Sensor Hub are separate, independently developed products and are separately classified.

GridDown Maps (EAR99). The shipped build performs no cryptography for data confidentiality. Plan and team packages are serialised JSON, base64-encoded for transport — an encoding, not encryption — and the application calls no Web Crypto operation and bundles no cryptographic library. It is therefore outside Category 5, Part 2 entirely, is not enumerated elsewhere on the Commerce Control List, and its primary function (offline mapping and navigation) is not controlled. Where confidentiality is needed, the encrypting link is provided by other products: the GridDown Secure Messenger firmware or a Meshtastic radio.

AtlasBridge (5D992.c software; 5A992.c as a preloaded appliance). AtlasBridge uses TLS for transport confidentiality on its sensor and command-and-control links, which places it in Category 5, Part 2. The cryptography is supplied by the operating system's own module rather than implemented in the product, and the release relied on is Note 3 — the Cryptography Note — on the basis of published pricing, self-service ordering, cryptography that is not user-modifiable, and installation without substantial BlackAtlas support. AtlasBridge has no receiver and no transmit capability; it consumes the standardised output of sensors that operate independently of it, which is what keeps it clear of USML Category XI and the 3A611/3D611 military-electronics entries. It is a general-purpose commercial translation appliance built to published interface standards, not to a government specification.

GridDown Secure Messenger firmware (published source: not subject to the EAR; pre-publication binaries: 5D992.c). The firmware provides message confidentiality using standard, published algorithms — AES-256-GCM, ECDH on NIST P-256, PBKDF2-HMAC-SHA256, HMAC-SHA256, and SHA-256, all via mbedTLS — and implements no proprietary or unpublished algorithm. Two distinct bases apply and should not be conflated: compiled binaries distributed before the source was published were self-classified 5D992.c as mass-market encryption software, while the published source and its corresponding object code are released from the EAR altogether on the basis of public availability under 15 CFR §§ 734.3(b)(3) and 734.7. The public-availability basis is the broader of the two and does not depend on the mass-market criteria. Publication does not retroactively change the classification of any binary distributed beforehand, and does not extend to any build that is not published.

A note on the frequency-hopping feature. The Messenger firmware derives its channel-rotation sequence from the group pre-shared key using SHA-256 with a domain separator. BlackAtlas's position is that this is the routine composition of a standard primitive rather than a new cryptographic algorithm, and that the equipment control for frequency hopping (ECCN 5A001.b.3) does not apply in any event, because its Note excludes equipment operating at an output power of 1 W or less — this firmware transmits at 25 mW by default, with a configurable maximum of 158 mW. Because that reading is arguable rather than certain, BlackAtlas treats the question as open and has recorded it for review by counsel rather than resolving it in its own favour.

Standing Compliance Policies

United States sales only

BlackAtlas sells its products to U.S. customers only, for deployment within the United States only, and does not knowingly sell to or target foreign persons. Because the EAR is triggered by export, purely domestic sales do not require export licensing or reporting. AtlasRF additionally enforces this in software: it is region-locked (geofenced) so that it will not function outside the United States — a technical reinforcement of the policy, not a substitute for screening.

One deliberate exception: published firmware. The GridDown Secure Messenger firmware is free and open-source software, and its complete source is published publicly. Publication is not a sale, and the U.S.-only sales policy above does not apply to it: anyone, anywhere, may obtain, read, build, and redistribute that source under the GNU General Public License. Published source and its corresponding object code are released from the Export Administration Regulations altogether under 15 CFR §§ 734.3(b)(3) and 734.7, so no export authorization is required to publish or to download it. That release does not extend to any build that is not published, and it does not change the classification of binaries distributed before publication. BlackAtlas does not sell the third-party radio hardware this firmware runs on.

Restricted-party screening

All customers are screened against the U.S. Consolidated Screening List (denied and blocked parties) prior to sale. OFAC sanctions are observed regardless of the domestic nature of a transaction.

U.S.-persons-only access to controlled technology

Access to BlackAtlas controlled technology, engineering internals, and cryptographic source code is restricted to U.S. persons. BlackAtlas has no foreign-national employees or contractors with such access, so there is no "deemed export" exposure and no deemed-export license or filing is required. This policy is re-evaluated before onboarding any foreign-national employee or contractor.

Mass-market products vs. customized government builds

BlackAtlas's standard, generally available products that perform cryptography are classified as mass-market items; products that perform no cryptography fall outside Category 5, Part 2 entirely and are classified on their own primary function. Any unit designed or modified to a specific government or defense customer's specifications loses mass-market status and is classified — and, where required, submitted to BIS — individually before delivery, on its own facts. Such customization could reclassify the encryption from mass-market to a controlled classification, or add a separately controlled function; each such build is assessed on its own facts.

Recordkeeping

Classification records and transaction records are retained for five (5) years, per EAR Part 762.

Re-classification on material change

Items are re-classified on any material change — in particular any change to cryptographic algorithms (including the removal of cryptography, which can lower a classification as readily as an addition can raise it), any build customized to a government customer's specifications, or any change that adds a controlled function.

Scope of This Record

The classification summary above reflects the products covered by BlackAtlas's current classification memoranda. Classifications for additional BlackAtlas products — including AtlasRF expansion modules, AtlasGate, and AtlasGuard — are in preparation and will be added to this record as they are completed. Contact us for the classification status of any product not listed above.

Third-party hardware that BlackAtlas does not sell is classified by its own seller or exporter and is outside the scope of this record. Where BlackAtlas firmware runs on a commercially available third-party device, this record classifies the BlackAtlas firmware only.

Important Notice

These classifications are BlackAtlas LLC's good-faith self-classification. They are not a legal opinion and not a formal U.S. Government determination (no CCATS has been issued). They are published so that customers and reviewers can see BlackAtlas's export-control posture. Customers remain responsible for their own compliance with the EAR, OFAC sanctions, and all other applicable U.S. law, including any re-export or transfer of a BlackAtlas product. If you require a formal classification for your own compliance file, contact us and consult your own export-control counsel.

Contact

Export-control and compliance inquiries:
info@blackatlas.tech