Sending, taking or storing unclassified technical data or technology is not an export when it is secured with end-to-end encryption and with cryptographic modules compliant with FIPS 140-2 or its successors, supported by key management and other procedures in line with current NIST guidance, or (under the ITAR) other means giving security strength at least comparable to AES-128 (EAR: other equally or more effective cryptographic means). The storage-location condition differs: the ITAR requires that the data is not intentionally sent to a person in, stored in, or sent from a country proscribed in 126.1, while the EAR requires that it is not intentionally stored in a Country Group D:5 country. End-to-end means the data is never unencrypted between the originator's and recipient's in-country security boundaries and the means of decryption are not given to any third party; for the ITAR the recipient must be the originator, a U.S. person in the United States or an otherwise authorised person. Data in transit over the internet is not treated as stored in the countries it crosses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.