The ability to access technical data or technology in encrypted form that satisfies the carve-out is not a release or export (120.54(c); 734.18(c)). This is what allows foreign-national staff of a hosting or managed service provider to administer storage that holds controlled data: they may handle ciphertext, but they must not hold access information. Selection and contracting of cloud, backup, email and collaboration services for controlled data should therefore test key custody and the location conditions, not only the provider's nationality claims.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.