Ryft — Export Compliance & Sanctions Notice
Last updated: October 6, 2026 Effective date: October 6, 2026
This Export Compliance & Sanctions Notice (the "Notice") applies to Ryft, an API security testing desktop application ("Ryft" or the "Software"), published by Ryft Security, LLC ("we," "us," or "our"), formed in Virginia, USA. This Notice is incorporated into and forms part of the Ryft End User License Agreement and Terms of Service (the "Terms").
Read this Notice before you purchase, download, install, export, or use Ryft. Your purchase and use of Ryft constitute your agreement to it.
1. Why Export and Sanctions Law Applies to Ryft
1.1. Ryft contains both cryptographic functionality and security-testing (offensive) functionality:
(a) Ryft uses encryption — it secures network connections using TLS, installs a local certificate authority on your machine to operate its intercepting HTTPS proxy, and can store saved projects locally as encrypted bundles protected by a passphrase or the operating-system keychain; and
(b) Ryft is an offensive security testing tool that can generate and send attack traffic — including vulnerability scanning, fuzzing and brute-forcing, and authorization testing — against targets you direct it at.
1.2. Because of this functionality, Ryft is subject to the export-control and economic-sanctions laws of the United States, including the Export Administration Regulations (EAR) administered by the U.S. Department of Commerce, Bureau of Industry and Security (BIS), and the economic sanctions programs administered by the U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC). Other countries' export, import, and cryptography laws may also apply to you.
2. Export Classification
2.1. Ryft is commercially available desktop software, distributed to the public through our website without restriction on the class of purchaser, and is designed to be installed and operated by the end user. Based on these characteristics, Ryft is expected to qualify as mass-market encryption software under the EAR.
2.2. Classification. The Software uses standard, widely-available cryptography — Transport Layer Security (TLS) for network connections, and standard hashing and key-derivation functions (for example, HMAC-SHA-256 and scrypt/PBKDF2) to protect locally-stored project data — and incorporates no proprietary or non-standard encryption. It is published as a mass-market commercial product generally available to the public. We have determined not to pursue a formal export self-classification, CCATS, or encryption self-classification report at this time. This determination should be reviewed with export-controls counsel before any large-scale, enterprise, or government-channel distribution outside the United States. The sanctions and embargo restrictions in Section 3 apply regardless of classification.
2.3. Until a formal classification is confirmed and any required filings are made, the statements in this Notice about classification are preliminary and provided for transparency; they are not a representation that any particular export authorization, license exception, or reporting obligation has been satisfied.
2.4. General availability. The Software is made generally available to the public through our website. The professional-and-business-use positioning stated in the Terms is a contractual use restriction and does not change how the Software is distributed.
3. Embargoed Destinations and Restricted Parties
3.1. Embargoed and restricted destinations. Ryft may not be sold, exported, re-exported, transferred, downloaded, or used in or to any country or region that is the target of comprehensive U.S. sanctions or embargoes. As of the effective date, these include Cuba, Iran, North Korea, Syria, the Crimea region and the so-called Donetsk (DNR) and Luhansk (LNR) regions of Ukraine, the Kherson and Zaporizhzhia regions of Ukraine, and any other country or region subject to comprehensive U.S. sanctions or embargo from time to time. This list may change; you are responsible for complying with the sanctions and embargo programs in force at the time of your activity.
3.2. Denied and blocked parties. Ryft may not be sold, exported, re-exported, transferred to, or used by any person or entity that is denied, blocked, or restricted under applicable export or sanctions laws. This includes, without limitation, parties on OFAC's Specially Designated Nationals and Blocked Persons (SDN) List and on the BIS Entity List, Denied Persons List, and Unverified List, and any entity owned or controlled by such parties.
3.3. No prohibited end uses. Ryft may not be exported, re-exported, or used in connection with any end use prohibited by the EAR or other applicable law.
4. Buyer Representations and Obligations
By purchasing, downloading, installing, or using Ryft, you represent, warrant, and agree that:
4.1. You are not located in, ordinarily resident in, organized under the laws of, or a national of or acting on behalf of, any embargoed or comprehensively sanctioned country or region identified in Section 3.1, and you will not download or use Ryft from any such location;
4.2. You are not a person or entity identified in Section 3.2, and you are not owned or controlled by, or acting on behalf of, any such person or entity;
4.3. You will not export, re-export, transfer, release, or make Ryft (or any license key, download, or component of it) available, directly or indirectly, to any destination, party, or end use prohibited by the EAR, OFAC sanctions, or other applicable law, and you will not permit any such export, re-export, transfer, or use;
4.4. You will comply with all applicable U.S. and non-U.S. export-control, import, sanctions, and cryptography laws and regulations in connection with your acquisition and use of Ryft; and
4.5. You will obtain any license, authorization, permit, or registration required under any applicable law before acquiring, possessing, exporting, importing, or using Ryft where such a requirement applies to you.
5. Local Legality of Security Tools and Encryption
5.1. Security / "hacking" tools. Some countries and jurisdictions restrict, condition, or prohibit the possession, import, distribution, or use of security-testing, penetration-testing, or so-called "hacking" tools. Ryft is such a tool.
5.2. Strong encryption. Some countries and jurisdictions separately restrict, condition, or prohibit the import, possession, or use of strong encryption, or require licensing, registration, or key disclosure. Ryft contains encryption.
5.3. Your responsibility. You are solely responsible for determining whether Ryft may lawfully be imported, possessed, and used where you are located and where you intend to use it, and for complying with all such local laws. We make no representation that Ryft is lawful to import, possess, or use in any particular jurisdiction. If local law prohibits or restricts Ryft, you must not acquire or use it.
6. No Legal Advice; Changes
6.1. This Notice is provided for general information and does not constitute legal advice. Export-control and sanctions laws are complex and change frequently. If you are unsure whether your intended acquisition, export, or use of Ryft is permitted, consult qualified export-control counsel before proceeding.
6.2. We may update this Notice from time to time. The "Last updated" date above reflects the most recent version. Your continued use of Ryft after a change takes effect constitutes acceptance of the updated Notice.
7. Contact
Export-compliance and sanctions questions may be sent to legal@ryftapi.com. General support questions may be sent to support@ryftapi.com.
This Notice is governed by the laws of Virginia and, as to U.S. export and sanctions matters, by applicable U.S. federal law. It is subject to the governing-law and venue provisions of the Ryft Terms of Service.