Export and Deployment Policy
Overview
Section titled “Overview”VTEM Labs, Inc. is a U.S.-based provider of advanced cybersecurity and penetration testing technology. Our ARROW platform is a purpose-built solution for remote red team operations, ethical hacking engagements, and secure infrastructure assessments. The ARROW platform is available in two formats:
- Physical Device: A custom Linux-based computer with cellular management via WireGuard VPN.
- Virtual Machine (e.g., OVA Image): A downloadable, hardened VM image for authorized use.
This policy governs the export, distribution, and use of ARROW products globally and reflects compliance with U.S. export control laws, including the Export Administration Regulations (EAR), Office of Foreign Assets Control (OFAC), and the Wassenaar Arrangement.
Countries may be added to or removed from this restricted list at any time, with or without notice, based on changes to U.S. export control laws or at the sole discretion of VTEM Labs in response to geopolitical events, compliance concerns, or risk assessments.
Export Classifications
Section titled “Export Classifications”While VTEM Labs is working to obtain formal classification rulings, ARROW devices and virtual machines are considered dual-use technologies and may be subject to EAR restrictions based on their capability for cybersecurity testing and the inclusion of encryption and VPN components.
General Policy Summary
Section titled “General Policy Summary”| Classification | Physical Device | Virtual Machine |
|---|---|---|
| Prohibited Countries | Not Permitted | Not Permitted |
| Restricted Countries | Reviewed Case-by-Case | Reviewed Case-by-Case |
| Permitted Countries | Allowed (with compliance) | Allowed (with compliance) |
Prohibited Countries
Section titled “Prohibited Countries”VTEM Labs does not ship or provide downloads to the following destinations under any circumstance:
| Country/Region | Status | Physical Device | Virtual Machine |
|---|---|---|---|
| Cuba | Not Permitted | ❌ | ❌ |
| Iran | Not Permitted | ❌ | ❌ |
| North Korea | Not Permitted | ❌ | ❌ |
| Syria | Not Permitted | ❌ | ❌ |
| Crimea, Donetsk, and Luhansk | Not Permitted | ❌ | ❌ |
This prohibition applies to both physical shipments and virtual machine access.
Restricted Countries
Section titled “Restricted Countries”The following countries are subject to U.S. export licensing requirements or regulatory review. VTEM Labs will not export physical devices or permit virtual machine downloads to these destinations without explicit authorization:
| Country | Status | Physical Device | Virtual Machine |
|---|---|---|---|
| Russia | Formal Legal Review | ⚠️ | ⚠️ |
| Venezuela | Formal Legal Review | ⚠️ | ⚠️ |
| Nicaragua | Formal Legal Review | ⚠️ | ⚠️ |
| Somalia | Formal Legal Review | ⚠️ | ⚠️ |
| Iraq | Formal Legal Review | ⚠️ | ⚠️ |
| Zimbabwe | Formal Legal Review | ⚠️ | ⚠️ |
| China | Formal Legal Review | ⚠️ | ⚠️ |
| Sudan | Formal Legal Review | ⚠️ | ⚠️ |
| Yemen | Formal Legal Review | ⚠️ | ⚠️ |
| Lebanon | Formal Legal Review | ⚠️ | ⚠️ |
| Democratic Republic of Congo | Formal Legal Review | ⚠️ | ⚠️ |
| Myanmar | Formal Legal Review | ⚠️ | ⚠️ |
| South Sudan | Formal Legal Review | ⚠️ | ⚠️ |
| Libya | Formal Legal Review | ⚠️ | ⚠️ |
| Afghanistan | Formal Legal Review | ⚠️ | ⚠️ |
| Central African Republic | Formal Legal Review | ⚠️ | ⚠️ |
Requests will be evaluated on a case-by-case basis and may ultimately be denied. Please note that VTEM Labs will assess and invoice legal review fees for any formal request involving these countries—regardless of outcome.
Permitted Countries
Section titled “Permitted Countries”All other countries (including U.S. allies and most of the world) may receive ARROW shipments and download virtual machines, provided:
- The requesting entity is not listed on any U.S. denied, debarred, or restricted party list.
- The use case is authorized, legal, and involves client-approved penetration testing or internal red team operations.
- The device or software is not re-exported to a prohibited destination.
Client Responsibilities
Section titled “Client Responsibilities”Clients subscribing to ARROW must agree to the following:
- Authorized Use Only: ARROW must be used exclusively for lawful, authorized penetration testing or secure IT management.
- No Unauthorized Resale or Re-export: The device or VM may not be transferred to third parties in restricted or embargoed jurisdictions.
- Compliance with Local Laws: The client is responsible for complying with all local laws regarding encryption, VPN use, import/export, and wireless transmissions.
- Return of Physical Units: Physical devices remain the property of VTEM Labs and must be returned upon completion of the engagement unless otherwise agreed.
Questions & Licensing Requests
Section titled “Questions & Licensing Requests”If your organization is located in a country listed under the restricted category, or if you are unsure of your compliance status, please contact us.
General Reference Table
Section titled “General Reference Table”| Country | Physical Device Export | Virtual Machine Access | Notes |
|---|---|---|---|
| Afghanistan | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Albania | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Algeria | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Argentina | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Australia | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Austria | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Bangladesh | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Belarus | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Belgium | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Brazil | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Canada | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| China | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Colombia | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Cuba | Not Permitted | Not Permitted | U.S. embargo / comprehensive sanctions |
| Czech Republic | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Denmark | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Egypt | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Finland | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| France | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Germany | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| India | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Indonesia | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Iran | Not Permitted | Not Permitted | U.S. embargo / comprehensive sanctions |
| Iraq | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Ireland | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Israel | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Italy | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Japan | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Kenya | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Lebanon | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Libya | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Mexico | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Myanmar | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Netherlands | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| New Zealand | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Nicaragua | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Nigeria | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| North Korea | Not Permitted | Not Permitted | U.S. embargo / comprehensive sanctions |
| Norway | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Pakistan | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Philippines | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Poland | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Portugal | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Russia | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Saudi Arabia | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Singapore | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| South Africa | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| South Korea | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| South Sudan | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Spain | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Sudan | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Sweden | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Switzerland | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Syria | Not Permitted | Not Permitted | U.S. embargo / comprehensive sanctions |
| Thailand | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Turkey | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Ukraine | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| United Arab Emirates | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| United Kingdom | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| United States | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Venezuela | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Vietnam | Permitted with Compliance | Permitted with Compliance | General availability with lawful use |
| Yemen | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
| Zimbabwe | Formal Legal Review | Formal Legal Review | Subject to U.S. export restrictions |
Last Updated: May 30, 2025