Under the ITAR, using access information to cause technical data located outside the United States to be in unencrypted form is a release, and releasing previously encrypted data in that way is an export (120.50(a)(6), 120.56(a)(4)). A U.S. person who decrypts controlled data on a server abroad, or lets a foreign system decrypt it, therefore makes an export that needs authorisation unless an exemption applies. The encrypted-storage carve-out only protects data while it remains encrypted end to end; decryption points and key locations must be designed so that plaintext only exists where an authorisation or exemption covers it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.