This page provides detailed information on the export control status of the Apache Software Foundation's products , as well as pointers to the open source code from which those products are built.

ASF projects and PMCs should consult our guide to handling cryptography in order to comply with our export policies.

Exporting ASF Products¶

The Apache Software Foundation (ASF) is a 501(c)3 nonprofit charity based in the United States of America. All of our products are developed via online collaboration in public forums and distributed from a central server within the U.S. Therefore, U.S. export laws and regulations apply to our distributions and remain in force as products and technology are re-exported to different parties and places around the world. Information on export control classifications and associated restrictions may be required for exporting, re-exporting, record keeping, bundling/embedding of ASF products, encryption reporting, and shipping documentation. More information on U.S. Export Regulations can be found at " http://www.bis.doc.gov/ ".

The Bureau of Industry and Security (BIS) , a branch of the U.S. Department of Commerce, regulates exports through the Export Administration Regulations (EAR). The regulations describe the export rules and restrictions on a wide range of commodities, technologies, and software. This document is no substitute for understanding those regulations; the ASF cannot anticipate how they might apply to third party distributions or for specific export decisions made by those parties. End-user, end-use and country of ultimate destination may affect export licensing requirements.

The ASF Product Classification Matrix is a general listing of ASF software products and their source links for which we have determined an export classification for that product as distributed by the Apache Software Foundation. The matrix is to be used in conjunction with the EAR to provide classification information in order to assist exporters in the export of ASF products and to provide guidance to BIS employees that seek the source code for ASF products. All export classification information contained in the matrix is subject to change without notice.

Embargoed Destinations¶

ASF software and/or technical data may NOT be exported/reexported, either directly or indirectly, to any destination subject to U.S. embargoes or trade sanctions unless formally authorized by the U.S. Government. Note that said embargoed destinations are subject to change and the scope of what technology is included in the embargo is specific to each embargoed country. For the most current information on U.S. embargoed and sanctioned countries, see the U.S. Export Administration Regulations and Treasury Department regulations.

Denied Parties Lists¶

U.S. export regulations require that all international and domestic transactions be screened against the U.S. Government listing of prohibited end users. Shipments to certain individuals, organizations, or institutions who have violated U.S. export laws are prohibited. The United States government maintains export prohibited lists , including but not limited to the Treasury Department's Specially Designated Nationals List and Commerce Department's Entity and Denied Persons Lists.

ASF Product Classification Matrix¶

The Apache Software Foundation (ASF) makes NO WARRANTY or representation that the information contained in the ASF Product Classification Matrix is accurate, current, or complete. It is your obligation as the exporter to comply with the current applicable requirements of United States export rules and regulations. Any use of such information by you is without recourse to the ASF and is at your own risk. The ASF is in no way responsible for any damages, whether direct, consequential, incidental, or otherwise, suffered by you as a result of using or relying upon such information for any purpose.

Each ASF product is classified with an Export Control Classification Number (ECCN) if it is believed to correspond to an entry in the Commerce Control List (CCL) and subject to the EAR. All ASF software is published in a publicly available source code form. Since software classified as ECCN 5d002 or 5D992 is subject to the EAR, all ASF software product versions that do not fit those two classifications are noted as ECCN "Not determined" or not included in the matrix.

Products classified as ECCN 5D002 , are exported by the ASF under the publicly available exempton found in EAR Section 742.15(b), which applies to software containing or designed for use with encryption software that is publicly available as open source. Note that exporters other than the ASF within the U.S. may or may not be eligible for the publicly available exemption in section 742.15(b), and it is each specific exporter's responsibility to understand and comply with all export regulations applicable within their jurisdiction.

Apache Accumulo Project
Product Name	Versions	ECCN	Controlled Source
Apache Accumulo Project	development	5D002	ASF, Bouncy Castle
	1.6.0 and on	5D002	ASF, Bouncy Castle
	1.5.x	5D002	ASF
Apache ActiveMQ Project
Product Name	Versions	ECCN	Controlled Source
Apache ActiveMQ	development	5D002	ASF
	4.1 and later	5D002	ASF
Apache Camel	development	5D002	ASF
	1.0.0 and later	5D002	ASF
Apache Ant Project
Product Name	Versions	ECCN	Controlled Source
Apache Ant	development	5D002	ASF
	1.1 and later	5D002	ASF
Apache Ivy	development	5D002	ASF
	2.0.0-alpha-*-incubating	5D002	ASF
	2.0.0-alpha-*-incubating-bin-with-deps	5D002	ASF, JCraft, Inc.
	2.0.0-beta1-* and later	5D002	ASF
	2.0.0-beta1-bin-with-deps and later	5D002	ASF, JCraft, Inc.
Apache Aries
Product Name	Versions	ECCN	Controlled Source
Apache Aries RSA	development and all releases	5D002	ASF, Oracle, The Eclipse Foundation
Apache Cassandra Project
Product Name	Versions	ECCN	Controlled Source
Apache Cassandra	development	5D002	ASF, Oracle, The OpenSSL Project
	0.8 and later	5D002	ASF, Oracle
Apache Cayenne Project
Product Name	Versions	ECCN	Controlled Source
Apache Cayenne	development	5D002	ASF, Oracle
	3.2.M2 and later	5D002	ASF, Oracle
Apache Commons Project
Product Name	Versions	ECCN	Controlled Source
Apache Commons Compress	development	5D002	ASF
	1.6 and later	5D002	ASF
Apache Commons Crypto	development	5D002	ASF, The OpenSSL Project, Oracle
	1.0.0 and later	5D002	ASF, The OpenSSL Project, Oracle
Apache Commons OpenPGP	development	5D002	ASF
Apache CouchDB Project
Product Name	Versions	ECCN	Controlled Source
Apache CouchDB	development	5D002	ASF
	0.9.0 and later	5D002	ASF, ibrowse
Apache CXF Project
Product Name	Versions	ECCN	Controlled Source
Apache CXF	development	5D002	ASF, ASF, Bouncy Castle
	all 2.*	5D002	ASF, ASF, Bouncy Castle
	all 2.*-incubating	5D002	ASF, ASF, Bouncy Castle
Apache DB Project
Product Name	Versions	ECCN	Controlled Source
Apache Derby	development	5D002	ASF
	derby-10.*	5D002	ASF
Apache DdlUtils	development	5D002	ASF
	ddlutils-1.0 and higher	5D002	ASF
Apache ObjectRelationalBridge - OJB	development	5D002	ASF
	ojb-1.0.0 and higher	5D002	ASF
Apache Torque	development	5D002	ASF
	torque-3.1 and later	5D002	ASF
Apache Directory Project
Product Name	Versions	ECCN	Controlled Source
Apache Directory Server	development	5D002	ASF
	1.0 and later	5D002	ASF
	1.5 and later	5D002	ASF, Bouncy Castle
Apache Directory Studio	1.2 and later	5D002	ASF, Bouncy Castle
Apache Drill
Product Name	Versions	ECCN	Controlled Source
Apache Drill	1.2 and later	5D002	ASF, Oracle, The Eclipse Foundation, The Cyrus SASL project, MIT, The OpenSSL Project
Apache Felix
Product Name	Versions	ECCN	Controlled Source
Apache Felix Http Jetty	development	5D002	ASF, Oracle, The Eclipse Foundation
	all releases	5D002	ASF, Oracle, The Eclipse Foundation
Apache Forrest Project
Product Name	Versions	ECCN	Controlled Source
Apache Forrest	development	5D002	ASF
	apache-forrest-0.6 and later	5D002	ASF, JCraft, Inc.
Apache Geode Project
Product Name	Versions	ECCN	Controlled Source
Apache Geode	development	5D002	ASF, ASF, ASF, Oracle, The OpenSSL Project
	all releases	5D002	ASF, ASF, ASF, Oracle, The OpenSSL Project
Apache Geronimo Project
Product Name	Versions	ECCN	Controlled Source
Apache Geronimo	development	5D002	ASF
	1.0 and later	5D002	ASF
Apache Hadoop Project
Product Name	Versions	ECCN	Controlled Source
Apache Hadoop	development	5D002	ASF
	17.0 and later	5D002	ASF
Apache Harmony Project
Product Name	Versions	ECCN	Controlled Source
Apache Harmony	development	5D002	ASF
	5.0M1 and later	5D002	ASF, Bouncy Castle
Apache HAWQ (incubating) Project
Product Name	Versions	ECCN	Controlled Source
Apache HAWQ (incubating) Project	development	5D002	ASF
Apache Hive Project
Product Name	Versions	ECCN	Controlled Source
Apache Hive	development	5D002	ASF
	1.3.0 and on	5D002	ASF
Apache HttpComponents Project
Product Name	Versions	ECCN	Controlled Source
Apache HttpComponents Core	development	5D002	ASF
	4.0 and later	5D002	ASF
Apache HttpComponents Client	development	5D002	ASF
	4.0 and later	5D002	ASF
	1.x, 2.x, 3.x	5D002	ASF
Apache HTTP Server Project
Product Name	Versions	ECCN	Controlled Source
Apache HTTP Server	development	5D002	ASF
	apache_1.3.x	n/a
	httpd-2.0.x	5D002	ASF
	httpd-2.2.x	5D002	ASF
	apache_2.2.x-win32-*-openssl-*	5D002	ASF, The OpenSSL Project
	httpd-2.4.x	5D002	ASF
Apache Flood	development	5D002	ASF
	flood-0.4	5D002	ASF
Apache libapreq	development	5D002	ASF
	libapreq2	5D002	ASF
	libapreq	n/a
Apache mod_ftp	development	5D002	ASF
Apache mod_python	development	5D002	ASF
	mod_python-*	5D002	ASF
Apache Incubator Project
Product Name	Versions	ECCN	Controlled Source
Apache Abdera	development	5D002	ASF
	all 0.*-incubating	5D002	ASF, ASF, Bouncy Castle, Bouncy Castle
Apache Airavata	development	5D002	ASF, Bouncy Castle, The Cryptix project, Claymore Systems Puretls, Globus Project
Apache CloudStack	development	5D002	JaSypt.org, Oracle, Bouncy Castle, ASF, OpenSwan.org, JCraft, Inc., ASF
Apache Hop	Development	5D002	ASF
	all releases	5D002	ASF
Apache Impala	development	5D002	ASF
	2.7.0 and later	5D002	ASF
Apache Milagro	Development - C Library	5D002	ASF
	Development - JavaScript Library	5D002	ASF
	Development - Rust Library	5D002	ASF
	Libraries and Servers 0.0.1 and later	5D002	ASF
Apache NiFi	development	5D002	JaSypt.org, Oracle, Bouncy Castle, JCraft, Inc., ASF
	0.0.1-incubating and later	5D002	JaSypt.org, Oracle, Bouncy Castle, JCraft, Inc., ASF
Apache PDFBox	development	5D002	ASF, Bouncy Castle, Bouncy Castle
Apache Pirk	development	5D002	ASF
	0.1.0-incubating and later	5D002	ASF
Apache Pulsar	development	5D002	ASF, Bouncy Castle
	1.20-incubating and greater	5D002	ASF, Bouncy Castle
Apache Shindig	development	5D002	ASF
Apache Slider	development	5D002	ASF, Oracle, The Eclipse Foundation
	0.30-incubating	5D002	ASF, Oracle
	0.40-incubating and later	5D002	ASF, Oracle, The Eclipse Foundation
Apache Taverna	development	5D002	ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, ASF, Bouncy Castle, The Eclipse Foundation, Oracle, ASF, ASF, ASF, ASF, ASF, Dropbox, Google, Ruby Programming Language, The OpenSSL Project
	all releases	5D002	ASF, Bouncy Castle, The Eclipse Foundation, Oracle, ASF, ASF, ASF, ASF, ASF, Dropbox, Google, Ruby Programming Language, The OpenSSL Project
Apache Trafodion	development	5D002	ASF, The OpenSSL Project, Oracle
	all releases	5D002	ASF, The OpenSSL Project, Oracle
Apache Tuweni	development	5D002	ASF, Bouncy Castle, Bouncy Castle
	all releases	5D002	ASF, Bouncy Castle, Bouncy Castle
Apache Whirr	development	5D002	ASF
	all 0.*-incubating	5D002	ASF, Bouncy Castle, JCraft, Inc., Not-Yet-Commons-SSL
Apache Jakarta JMeter Project
Product Name	Versions	ECCN	Controlled Source
Apache Jakarta JMeter	1.0 and later	5D002	ASF
Apache JAMES Project
Product Name	Versions	ECCN	Controlled Source
Apache JAMES Server	development	5D002	ASF, Bouncy Castle
	2.3.0 and later	5D002	ASF, Bouncy Castle
Apache JAMES jDKIM	0.1 and later	5D002	ASF, Not-Yet-Commons-SSL
Apache JAMES Mailet Crypto	0.1 and later	5D002	ASF, Bouncy Castle
Apache JAMES Mime4J	0.4 and later	5D002	ASF
Apache Jena
Product Name	Versions	ECCN	Controlled Source
Apache Jena (distribution)	development	5D002	ASF
	binary distribution	5D002	ASF, ASF
Apache Kafka Project
Product Name	Versions	ECCN	Controlled Source
Apache Kafka	development	5D002	ASF, Oracle
	0.10.2 and later	5D002	ASF, Oracle
	0.9.0 and later	5D002	ASF, Oracle
Apache Kudu Project
Product Name	Versions	ECCN	Controlled Source
Apache Kudu	development	5D002	ASF
	1.1.0 and later	5D002	ASF
Apache Labs Project
Product Name	Versions	ECCN	Controlled Source
Apache BaDCA	development	5D002	ASF
Apache Vysper	development	5D002	ASF, Bouncy Castle
Apache Lucene Project
Product Name	Versions	ECCN	Controlled Source
Apache Nutch	development	5D002	ASF
	0.7 and later	5D002	ASF, PDFBox
Apache Solr	development	5D002	ASF
	1.4 and later	5D002	ASF, Apache Tika
Apache Tika	development	5D002	ASF
	0.2-incubating and later	5D002	ASF, Bouncy Castle, Bouncy Castle
Apache MyFaces Project
Product Name	Versions	ECCN	Controlled Source
Apache MyFaces	development	5D002	ASF
	1.1.2 and later	5D002	ASF
Apache Mynewt (incubating) Project
Product Name	Versions	ECCN	Controlled Source
Apache Mynewt	development	5D002	ARM mbed, TinyCrypt, PolarSSL
Apache Oltu Project
Product Name	Versions	ECCN	Controlled Source
Apache Oltu	development	5D002	ASF
Apache Open For Business Project
Product Name	Versions	ECCN	Controlled Source
Apache Open For Business	development	5D002	ASF
	4.0 release branch	5D002	ASF
Apache OpenEJB Project
Product Name	Versions	ECCN	Controlled Source
Apache OpenEJB	development	5D002	ASF
	1.0 and later	5D002	ASF
	All 0.x	n/a
Apache ORC Project
Product Name	Versions	ECCN	Controlled Source
Apache ORC	development	5D002	ASF, The OpenSSL Project
	1.6.0 and on	5D002	ASF, The OpenSSL Project
Apache Perl Project
Product Name	Versions	ECCN	Controlled Source
mod_perl	Perl-*-win32-bin-*.exe	5D002	ASF, The OpenSSL Project
Apache POI Project
Product Name	Versions	ECCN	Controlled Source
Apache POI	development	5D002	ASF
	3.5 and later	5D002	ASF
Apache Polygene Project
Product Name	Versions	ECCN	Controlled Source
Apache Polygene	development	5D002	ASF, Bouncy Castle
	2.1	5D002	ASF, Bouncy Castle
Apache Shiro Project
Product Name	Versions	ECCN	Controlled Source
Apache Shiro	development	5D002	ASF
	1.1 and later	5D002	ASF
	1.0	5D002	ASF
	All 0.x	n/a
Apache ServiceMix Project
Product Name	Versions	ECCN	Controlled Source
Apache ServiceMix 3.x	development	5D002	ASF, ASF, Bouncy Castle
	All 3.x versions	5D002	ASF, ASF, Bouncy Castle
Apache ServiceMix 4.x	development	5D002	ASF
	4.0-m1	n/a
Apache ServiceMix NMR	development	5D002	ASF
	1.0-m1, 1.0-m2	n/a
Apache ServiceMix Kernel	development	n/a
	All 1.0 milestones	n/a
Apache ServiceComb Project
Product Name	Versions	ECCN	Controlled Source
Apache ServiceComb Java-Chassis	development	5D002	ASF, Oracle, The OpenSSL Project
	1.0.0-m1 and later	5D002	ASF, Oracle, The OpenSSL Project
Apache ServiceComb Service-Center	development	5D002	ASF, The golang Project
	1.0.0-m1 and later	5D002	ASF, The golang Project
Apache ServiceComb Pack	development	5D002	ASF, Oracle, The OpenSSL Project
	0.2.0 and later	5D002	ASF, Oracle, The OpenSSL Project
Apache RocketMQ Project
Product Name	Versions	ECCN	Controlled Source
Apache RocketMQ	development	5D002	ASF, Oracle, The OpenSSL Project
	rocketmq-4.0.0-incubating and later	5D002	ASF, Oracle, The OpenSSL Project
Apache RocketMQ ONS	development	5D002	ASF, Oracle
	1.8.0 and later	5D002	ASF, Oracle
Apache Portable Runtime Project
Product Name	Versions	ECCN	Controlled Source
APR	development	5D002	ASF
APR-Util	development	5D002	ASF
	0.9.x, 1.2.x	n/a
	1.4.x and later	5D002	ASF
Apache Santuario Project
Product Name	Versions	ECCN	Controlled Source
Apache XML Security for Java	development	5D002	ASF
	1.5.x	5D002	ASF
Apache XML Security for C++	development	5D002	ASF
Apache SpamAssassin Project
Product Name	Versions	ECCN	Controlled Source
Apache SpamAssassin	development	5D002	ASF, The OpenSSL Project, Steffen Ullrich
	3.0.x and later	5D002	ASF, The OpenSSL Project, Steffen Ullrich
Apache Spark Project
Product Name	Versions	ECCN	Controlled Source
Apache Spark	2.2.0 through 2.3.x	5D002	ASF, Bouncy Castle
	2.4.0 and later	5D002	ASF
Apache Tomcat Project
Product Name	Versions	ECCN	Controlled Source
Apache Tomcat	development	5D002	ASF
	3.x and later	5D002	ASF
Apache Tomcat native connector	development	5D002	ASF, The OpenSSL Project
	1.x and later	5D002	ASF, The OpenSSL Project
Apache UIMA Project
Product Name	Versions	ECCN	Controlled Source
Apache UIMA-AS	development	5D002	ASF
	all releases starting with 2.2.2-incubating	5D002	ASF
Apache UIMA Addons	development	5D002	ASF
	2.3.0 and later	5D002	ASF
Apache UIMA Addon Tika Annotator	development	5D002	ASF
	2.3.0 and later	5D002	ASF
Apache UIMA-DUCC	development	5D002	ASF
	all releases starting with 1.0	5D002	ASF
Apache VCL Project
Product Name	Versions	ECCN	Controlled Source
Apache VCL	development	5D002	ASF
	2.1 to 2.2.2	5D002	ASF
	2.3 and later	5D002	ASF, phpseclib
Apache Web Services Project
Product Name	Versions	ECCN	Controlled Source
Apache WSS4J	development	5D002	ASF, Bouncy Castle, ASF
	1.6	5D002	ASF, Bouncy Castle, ASF
	1.0 to 1.5	5D002	ASF, Bouncy Castle, Bouncy Castle, ASF
Apache Rampart/Java	development	5D002	ASF, Bouncy Castle, Bouncy Castle, Apache Santuario
	1.1 and later	5D002	ASF, Bouncy Castle, Bouncy Castle, Apache Santuario
Apache Rampart/C	development	5D002	ASF, The OpenSSL Project
	0.09 and later	5D002	ASF, The OpenSSL Project
Apache Synapse	1.0, 1.1, 1.1.1, 1.2, 2.0.0	5D002	ASF, Bouncy Castle, Bouncy Castle, Bouncy Castle, Bouncy Castle, Apache Santuario
Apache Synapse Project
Product Name	Versions	ECCN	Controlled Source
Apache Synapse	development	5D002	ASF, Bouncy Castle, Bouncy Castle, Bouncy Castle, Bouncy Castle, Apache Santuario
	1.1.1 and later	5D002	ASF, Bouncy Castle, Bouncy Castle, Apache Santuario
Apache Wicket Project
Product Name	Versions	ECCN	Controlled Source
Apache Wicket	1.3, development	5D002	ASF
Apache MINA Project
Product Name	Versions	ECCN	Controlled Source
Apache MINA	development	5D002	ASF
	1.0, 1.1, 2.0	5D002	ASF
Apache Vysper	development	5D002	ASF, Bouncy Castle
Apache FtpServer	development	5D002	ASF
	1.0	5D002	ASF
Apache SSHD	development	5D002	ASF, Bouncy Castle
Apache Wookie Project
Product Name	Versions	ECCN	Controlled Source
Apache Wookie	development	5D002	ASF, Apache Santuario
	0.13 and later	5D002	ASF, Apache Santuario
Apache Ignite Project
Product Name	Versions	ECCN	Controlled Source
Apache Ignite	development	5D002	ASF, Oracle, The OpenSSL Project, Microsoft, .NET Foundation, JCraft, Inc., The Eclipse Foundation
	2.5.0 - latest	5D002	ASF, Oracle, The OpenSSL Project, Microsoft, .NET Foundation, JCraft, Inc., The Eclipse Foundation
	2.4.0	5D002	ASF, Oracle, Microsoft, .NET Foundation, JCraft, Inc., The Eclipse Foundation
	1.0.0 - 2.3.0	5D002	ASF, Oracle, JCraft, Inc., The Eclipse Foundation