I am looking for a secure file transfer solution that complies with ITAR regulations.

If you need secure file transfer for ITAR-controlled technical data, I’d evaluate solutions based on the actual ITAR controls they implement rather than relying on a vendor’s “ITAR compliant” marketing claim. ITAR compliance ultimately depends on your configuration, users, data flows, access controls, and procedures—not just the product.Globalscape

Options worth evaluating

ITAR-specific requirements to verify

For an ITAR environment, I'd make these hard requirements in your vendor evaluation:

• U.S.-controlled access: Determine exactly which personnel can administer, support, troubleshoot, or otherwise access the system and whether any non-U.S. persons can access ITAR data.
• Data residency: Confirm where files, replicas, backups, logs, and temporary data are stored. Don't assume “U.S. region” means every component is U.S.-located.
• Encryption: For the ITAR encryption carve-out, 22 CFR §120.54 addresses unclassified technical data secured with end-to-end encryption and appropriately validated cryptography/key-management controls.Virtru Trust Center
• Key control: Understand who possesses the keys and whether the provider can decrypt your data. Customer-controlled or separately managed keys can materially change the risk profile.Virtru
• Access controls: MFA, least privilege, role-based permissions, expiration/revocation, download restrictions, and detailed audit logs.
• Export-control workflows: The system should allow you to restrict sharing to authorized recipients rather than merely encrypting the connection.
• Backups and disaster recovery: Verify that replicated data and backups remain within your required geographic/personnel boundaries.
• CMMC/DFARS requirements: If you're a DoD contractor handling CUI in addition to ITAR technical data, evaluate the solution against your applicable CMMC, NIST SP 800-171, and DFARS obligations as well. Virtru, for example, explicitly markets its platform for CMMC/DFARS as well as ITAR.Virtru+1

A practical shortlist

If your primary need is people sending large ITAR files to external partners, I'd investigate Virtru Secure Share and Kiteworks first.

If you need automated machine-to-machine transfers, scheduled jobs, SFTP/AS2, and extensive MFT administration, Globalscape EFT is worth putting into the evaluation.

One important distinction: SFTP by itself does not make a file-transfer system ITAR compliant. The identity of the people who can access the data, where the data and keys reside, administrative/support access, encryption implementation, and your organizational procedures all matter.

If you tell me (1) company size, (2) approximate file sizes/volume, (3) whether recipients are external suppliers, (4) cloud vs. on-prem preference, and (5) whether you also need CMMC Level 2, I can build a detailed requirements matrix comparing these options.

If you need secure file transfer for ITAR-controlled technical data, I’d focus on solutions that can enforce U.S.-person access, U.S. data residency, strong encryption, audit logging, and controlled administration. Importantly, there is no formal “ITAR certification”; compliance depends on how the service is configured and operated within your overall export-control program.Amazon Web Services, Inc.+1

A practical option: AWS GovCloud + AWS Transfer Family

Amazon Web Services offers AWS GovCloud (US) specifically to support workloads subject to ITAR. The GovCloud regions are physically in the U.S., and AWS states that access by AWS personnel is restricted to U.S. citizens.Amazon Web Services, Inc.+1

For the actual file-transfer layer, AWS Transfer Family supports:

• SFTP
• FTPS
• AS2
• Integration with S3 and EFS
• VPC-based endpoints in GovCloud
• FIPS-enabled endpoints for applicable Transfer Family web appsAWS Documentation

A typical architecture would look like:

External partner → SFTP/FTPS → AWS Transfer Family (GovCloud) → encrypted S3 bucket → authorized U.S.-person users

You can add IAM-based access controls, encryption/KMS, CloudTrail auditing, network restrictions, and retention/deletion policies. AWS also provides guidance identifying what service metadata must not contain export-controlled information.Amazon Web Services, Inc.+1

Another major option: Microsoft Azure Government

Microsoft states that Azure Government can help organizations meet ITAR requirements and provides additional protections including U.S. data-storage commitments and restrictions on access to systems processing customer data to screened U.S. persons. Azure also supports FIPS-validated cryptographic modules and customer-controlled keys through Azure Key Vault/HSM.Microsoft Learn

For a managed-file-transfer application on top of Azure Government, you'd generally evaluate a third-party MFT product or build an SFTP-based service using Azure Government services, then validate the complete architecture against your ITAR controls.

What I'd require from any vendor

Before selecting a product, ask the vendor to document:

• U.S. data residency: Where are files, backups, logs, metadata, and encryption keys stored?
• U.S.-person access: Can vendor support, administrators, subprocessors, and operations personnel access the data?
• Export-control boundaries: Does any diagnostic data, telemetry, metadata, or support tooling leave the U.S.?
• Encryption: Encryption in transit and at rest, preferably with FIPS-validated cryptography where applicable.
• Identity/access: MFA, RBAC, least privilege, IP/network restrictions, and preferably customer-managed keys.
• Auditability: Detailed immutable logs of uploads, downloads, access, administrative activity, and sharing.
• Sharing controls: Ability to prevent accidental sharing with foreign persons or unauthorized organizations.
• Subprocessors: A complete list and contractual commitments concerning ITAR data.
• Contractual terms: Appropriate data-processing/export-control language and incident-notification obligations.
• CMMC/NIST requirements: If you're a DoD contractor, determine whether the same system also handles CUI and therefore falls within your CMMC obligations.

One important distinction: putting an SFTP server in a U.S. data center does not by itself make the solution ITAR compliant. Your identity management, personnel access, endpoints, backups, support processes, metadata, and operational procedures all matter.

If you tell me your requirements—e.g. SFTP vs. web portal, number of users, external customers/partners, approximate file sizes, cloud vs. on-premises, and whether you also need CMMC compliance—I can narrow this to a few concrete products/architectures and compare their ITAR-relevant controls.

For ITAR-controlled data, you’ll want more than “encrypted file transfer.” A suitable solution should support Export Administration/ITAR requirements, U.S. person access controls (where applicable), data residency controls, audit trails, and often related frameworks such as NIST SP 800-171/CMMC if you handle Controlled Unclassified Information (CUI). ITAR compliance is ultimately about your overall compliance program and handling procedures; a file-transfer product alone does not make an organization ITAR compliant.

Here are several categories of solutions to evaluate:

Enterprise managed file transfer (MFT) platforms

Kiteworks

A strong candidate for defense contractors and organizations exchanging sensitive engineering data. Kiteworks offers secure file sharing and managed file transfer capabilities, with controls such as encryption, access policies, audit logging, and deployment options including on-premises and government cloud environments. The company states support for ITAR, CMMC, NIST 800-171, FedRAMP, and FIPS-related requirements.Kiteworks+1

Good fit if you need:

• External sharing with suppliers or partners
• Detailed audit trails
• Policy-based access controls
• Hybrid/on-prem deployment options
• CMMC alignment supportKiteworks

Fortra GoAnywhere MFT

GoAnywhere provides managed file transfer with encrypted transfers, automation, workflow controls, and deployment flexibility (cloud, on-premises, or hybrid). It supports protocols such as SFTP, FTPS, and HTTPS and is designed for regulated enterprise data exchange.Fortra's GoAnywhere+1

Good fit if you need:

• Automated machine-to-machine transfers
• Scheduled exchanges with suppliers
• Large-volume file workflows
• Traditional MFT capabilitiesFortra's GoAnywhere

What to look for in an ITAR-oriented file transfer solution

Questions to ask vendors before selecting one

1. Can you support ITAR-controlled technical data workflows?
2. Where are files stored, processed, and backed up?
3. Can access be restricted to U.S. persons or approved users?
4. Are cryptographic modules FIPS validated?
5. Can we export audit logs for compliance reviews?
6. Do you support CMMC Level 2/NIST SP 800-171 control requirements?
7. Can the platform be deployed on-premises or in an approved government cloud environment?

If you are a defense contractor handling CUI, I would generally prioritize a platform with CMMC/NIST 800-171 alignment, strong audit evidence, and controlled hosting rather than a general-purpose consumer file-sharing service.Kiteworks

I can also help compare options such as Kiteworks vs GoAnywhere vs ShareFile vs Box Enterprise vs Egnyte based on your environment (small contractor, prime contractor, aerospace manufacturer, government agency, etc.).