Export Control and Sanctions Statement — OasisGUI, Oasis Mobile, oasis-runner and OasisNet
Draft prepared for review by counsel, dated 2026-10-06. This is a first draft for attorney review, not legal advice, and has not been adopted by Varrock Inc. Sections 3 and 8 are written for publication; Sections 4 to 7 and 9 are an internal classification memorandum and procedure. Business decisions are marked [DECISION: …]; questions for counsel are marked [COUNSEL: …]. All markers are collected under "Open decisions" at the end.
Related documents: End User License Agreement (Section 16) · Website Terms of Service (Section 17) · Acceptable Use Policy (Section 11) · Privacy Policy · Subprocessors · Third-Party Notices
3. Public statement#
3.1 The Software contains encryption. OasisNet is a WireGuard mesh VPN; OasisGUI connects to machines over SSH with post-quantum key exchange by default; the desktop application and the runner make TLS connections; mesh chat is end-to-end encrypted. The Software is therefore subject to the EAR and may be subject to the import, use and export laws of your country.
3.2 Classification. Varrock treats the Software as an encryption item under ECCN 5D002 qualifying for mass-market treatment (5D992.c), distributed under License Exception ENC, 15 C.F.R. § 740.17(b)(1); Varrock files the annual self-classification report that exception requires, beginning with the report for calendar year 2026 due 1 February 2027. [COUNSEL: confirm this classification and route before publication, including whether a one-time e-mail notification to BIS and the NSA is required in addition to, or instead of, the annual self-classification report, given that the source code is not published.] The Software is not subject to the International Traffic in Arms Regulations.
3.3 Where Varrock does not offer the Software. Varrock does not authorise, and does not knowingly permit, the download, export, re-export or transfer of the Software to any Embargoed Destination or Restricted Party, and will not provide updates, support, licences or classification letters to them. Varrock operates no user accounts and cannot identify who downloads a free copy; it relies on the representations in Section 8 and on screening the counterparty to any written support, rollout or licence agreement it enters into. [DECISION: whether to geo-block Embargoed Destinations at the oasisgui.com download and update endpoints, and who maintains the block list; only once blocking is live, add "and on geographic blocking at the oasisgui.com download and update endpoints" to the preceding sentence — never before.]
3.4 Your obligations. By downloading or using the Software you make the representations in Section 8. Organisations needing a classification letter may contact Varrock. [DECISION: contact mailbox for export-compliance requests; only sales@oasisgui.com exists today.]
3.5 Open source. Some components are open-source cryptographic libraries (listed in the Third-Party Notices). Their authors' export status does not carry over to the combined product; Varrock classifies what it ships.
3.6 Status and changes. This statement is informational. The binding export and sanctions terms are Section 16 of the EULA and Section 17 of the Website Terms, which are governed by the law stated there. Varrock updates this statement when the destination lists, the classification or the Software change; the current version and its date are published at oasisgui.com. Last updated: [DECISION: date of first publication, then the date of each revision].
8. User obligations clause (canonical text)#
8.1 The following clause is the single source for the export and sanctions representations in the EULA, the Terms of Service and the Acceptable Use Policy, which should be conformed to it. Where the clause is copied, the definitions of "Embargoed Destination", "Restricted Party", "Runner" and "Mesh Daemon" in Section 2 must be reproduced alongside it, since the Terms and the AUP do not define those terms today. [COUNSEL: harmonise the three existing clauses with this text.] [COUNSEL: confirm that no Country Group D:5 "arms embargo" residency representation is needed for a 5D992.c item; the earlier draft of representation (a) contained one, which would have excluded users in China and other D:5 countries whom the EAR does not bar from a mass-market item.]
Export controls and sanctions. The Software contains encryption and is subject to the United States Export Administration Regulations (15 C.F.R. Parts 730–774) and may be subject to the export, re-export and import laws of other jurisdictions, including Regulation (EU) 2021/821 and the sanctions laws of the United States, the European Union and the United Kingdom. You represent and warrant that you are not (a) located in, organised under the laws of, or ordinarily resident in an Embargoed Destination (as defined above and listed, as at the date of this clause, as Cuba, Iran, North Korea, Syria and the Crimea, so-called Donetsk People's Republic and so-called Luhansk People's Republic regions of Ukraine), or in a country to which the Export Administration Regulations require a licence for the Software (currently Russia and Belarus); (b) a Restricted Party, that is, a person listed on, or owned or controlled by a person listed on, any United States, European Union or United Kingdom restricted-party list; or (c) acquiring or using the Software for a nuclear, chemical or biological weapons, missile, or military, military-intelligence or other end use or end user prohibited by 15 C.F.R. Part 744 or by EU, UK or other applicable law. You will not export, re-export, transfer or make the Software available, or install any component of the Software, including the Runner or the Mesh Daemon, on any machine, in violation of those laws, and you are responsible for any authorisation your own export, import or use requires. Varrock may refuse to supply the Software, updates, support or licences where it believes this clause would be breached; a breach of it is a material breach of your licence.
8.2 Section 8.1 allocates compliance responsibility, excludes no liability and does not limit EU consumers' rights under mandatory law.
Source: docs/legal/export-control-and-sanctions.md in the repository (public Sections 3 and 8 only) · draft for attorney review · 4 [DECISION] markers and 4 [COUNSEL] markers on this page.