The Apache Software Foundation
Apache 20th Anniversary Logo

Community-led development "The Apache Way"

Apache Support Logo

This page provides detailed information on the export control status of the Apache Software Foundation's products , as well as pointers to the open source code from which those products are built.

ASF projects and PMCs should consult our guide to handling cryptography in order to comply with our export policies.

Exporting ASF Products

The Apache Software Foundation (ASF) is a 501(c)3 nonprofit charity based in the United States of America. All of our products are developed via online collaboration in public forums and distributed from a central server within the U.S. Therefore, U.S. export laws and regulations apply to our distributions and remain in force as products and technology are re-exported to different parties and places around the world. Information on export control classifications and associated restrictions may be required for exporting, re-exporting, record keeping, bundling/embedding of ASF products, encryption reporting, and shipping documentation. More information on U.S. Export Regulations can be found at " ".

The , a branch of the U.S. Department of Commerce, regulates exports through the . The regulations describe the export rules and restrictions on a wide range of commodities, technologies, and software. This document is no substitute for understanding those regulations; the ASF cannot anticipate how they might apply to third party distributions or for specific export decisions made by those parties. End-user, end-use and country of ultimate destination may affect export licensing requirements.

The ASF Product Classification Matrix is a general listing of ASF software products and their source links for which we have determined an export classification for that product as distributed by the Apache Software Foundation. The matrix is to be used in conjunction with the EAR to provide classification information in order to assist exporters in the export of ASF products and to provide guidance to BIS employees that seek the source code for ASF products. All export classification information contained in the matrix is subject to change without notice.

Embargoed Destinations

ASF software and/or technical data may NOT be exported/reexported, either directly or indirectly, to any destination subject to U.S. embargoes or trade sanctions unless formally authorized by the U.S. Government. Note that said embargoed destinations are subject to change and the scope of what technology is included in the embargo is specific to each embargoed country. For the most current information on U.S. embargoed and sanctioned countries, see the U.S. and .

Denied Parties Lists

U.S. export regulations require that all international and domestic transactions be screened against the U.S. Government listing of prohibited end users. Shipments to certain individuals, organizations, or institutions who have violated U.S. export laws are prohibited. The United States government maintains , including but not limited to the and .

ASF Product Classification Matrix

The Apache Software Foundation (ASF) makes NO WARRANTY or representation that the information contained in the ASF Product Classification Matrix is accurate, current, or complete. It is your obligation as the exporter to comply with the current applicable requirements of United States export rules and regulations. Any use of such information by you is without recourse to the ASF and is at your own risk. The ASF is in no way responsible for any damages, whether direct, consequential, incidental, or otherwise, suffered by you as a result of using or relying upon such information for any purpose.

Each ASF product is with an Export Control Classification Number (ECCN) if it is believed to correspond to an entry in the Commerce Control List (CCL) and subject to the EAR. All ASF software is published in a publicly available source code form. Since software classified as ECCN 5d002 or 5D992 is , all ASF software product versions that do not fit those two classifications are noted as ECCN "Not determined" or not included in the matrix.

Products classified as , are exported by the ASF under the publicly available exempton found in EAR Section 742.15(b), which applies to software containing or designed for use with encryption software that is publicly available as open source. Note that exporters other than the ASF within the U.S. may or may not be eligible for the publicly available exemption in section 742.15(b), and it is each specific exporter's responsibility to understand and comply with all export regulations applicable within their jurisdiction.

Product NameVersionsECCNControlled Source
Apache Accumulo Projectdevelopment5D002,
1.6.0 and on5D002,
1.5.x5D002
Product NameVersionsECCNControlled Source
Apache ActiveMQdevelopment5D002
4.1 and later5D002
Apache Cameldevelopment5D002
1.0.0 and later5D002
Product NameVersionsECCNControlled Source
Apache Antdevelopment5D002
1.1 and later5D002
Apache Ivydevelopment5D002
2.0.0-alpha-*-incubating5D002
2.0.0-alpha-*-incubating-bin-with-deps5D002,
2.0.0-beta1-* and later5D002
2.0.0-beta1-bin-with-deps and later5D002,
Product NameVersionsECCNControlled Source
Apache Cassandradevelopment5D002, ,
0.8 and later5D002,
Product NameVersionsECCNControlled Source
Apache Cayennedevelopment5D002,
3.2.M2 and later5D002,
Product NameVersionsECCNControlled Source
Apache Commons Compressdevelopment5D002
1.6 and later5D002
Apache Commons Cryptodevelopment5D002, ,
1.0.0 and later5D002ASF, ,
Apache Commons OpenPGPdevelopment5D002
Product NameVersionsECCNControlled Source
Apache CouchDBdevelopment5D002
0.9.0 and later5D002,
Product NameVersionsECCNControlled Source
Apache CXFdevelopment5D002, , Bouncy Castle
all 2.*5D002, , Bouncy Castle
all 2.*-incubating5D002, , Bouncy Castle
Product NameVersionsECCNControlled Source
Apache Derbydevelopment5D002
derby-10.*5D002
Apache DdlUtilsdevelopment5D002
ddlutils-1.0 and higher5D002
Apache ObjectRelationalBridge - OJBdevelopment5D002
ojb-1.0.0 and higher5D002
Apache Torquedevelopment5D002
torque-3.1 and later5D002
Product NameVersionsECCNControlled Source
Apache Directory Serverdevelopment5D002
1.0 and later5D002
1.5 and later5D002,
Apache Directory Studio1.2 and later5D002,
Product NameVersionsECCNControlled Source
Apache Drill1.2 and later5D002, , , , ,
Product NameVersionsECCNControlled Source
Apache Forrestdevelopment5D002
apache-forrest-0.6 and later5D002,
Product NameVersionsECCNControlled Source
Apache Geodedevelopment5D002, , , ,
all releases5D002, , , ,
Product NameVersionsECCNControlled Source
Apache Geronimodevelopment5D002
1.0 and later5D002
Product NameVersionsECCNControlled Source
Apache Hadoopdevelopment5D002
17.0 and later5D002
Product NameVersionsECCNControlled Source
Apache Harmonydevelopment5D002
5.0M1 and later5D002,
Product NameVersionsECCNControlled Source
Apache HAWQ (incubating) Projectdevelopment5D002
Product NameVersionsECCNControlled Source
Apache Hivedevelopment5D002
1.3.0 and on5D002
Product NameVersionsECCNControlled Source
Apache HttpComponents Coredevelopment5D002
4.0 and later5D002
Apache HttpComponents Clientdevelopment5D002
4.0 and later5D002
1.x, 2.x, 3.x5D002
Product NameVersionsECCNControlled Source
Apache HTTP Serverdevelopment5D002
apache_1.3.xn/a
httpd-2.0.x5D002
httpd-2.2.x5D002
apache_2.2.x-win32-*-openssl-*5D002,
httpd-2.4.x5D002
Apache Flooddevelopment5D002
flood-0.45D002
Apache libapreqdevelopment5D002
libapreq25D002
libapreqn/a
Apache mod_ftpdevelopment5D002
Apache mod_pythondevelopment5D002
mod_python-*5D002
Product NameVersionsECCNControlled Source
Apache Abderadevelopment5D002
all 0.*-incubating5D002, , ,
Apache Airavatadevelopment5D002, , , ,
Apache CloudStackdevelopment5D002, , , , , ,
Apache Impaladevelopment5D002
2.7.0 and later5D002
Apache MilagroDevelopment - C Library5D002
Development - JavaScript Library5D002
Development - Rust Library5D002
Libraries and Servers 0.0.1 and later5D002
Apache NiFidevelopment5D002, , , ,
0.0.1-incubating and later5D002, , , ,
Apache PDFBoxdevelopment5D002, ,
Apache Pirkdevelopment5D002
0.1.0-incubating and later5D002
Apache Pulsardevelopment5D002, Bouncy Castle
1.20-incubating and greater5D002, Bouncy Castle
Apache Shindigdevelopment5D002
Apache Sliderdevelopment5D002, ,
0.30-incubating5D002,
0.40-incubating and later5D002, ,
Apache Tavernadevelopment5D002, , , , , , , , , , , , , , , , , ASF, , , , , , , ,
all releases5D002, , , , ASF, , , , , , , ,
Apache Trafodiondevelopment5D002, ,
all releases5D002, ,
Apache Tuwenidevelopment5D002, ,
all releases5D002, ,
Apache Whirrdevelopment5D002
all 0.*-incubating5D002, , ,
Product NameVersionsECCNControlled Source
Apache Jakarta JMeter1.0 and later5D002
Product NameVersionsECCNControlled Source
Apache JAMES Serverdevelopment5D002,
2.3.0 and later5D002,
Apache JAMES jDKIM0.1 and later5D002,
Apache JAMES Mailet Crypto0.1 and later5D002,
Apache JAMES Mime4J0.4 and later5D002
Product NameVersionsECCNControlled Source
Apache Jena (distribution)development5D002
binary distribution5D002,
Product NameVersionsECCNControlled Source
Apache Kafkadevelopment5D002,
0.10.2 and later5D002,
0.9.0 and later5D002,
Product NameVersionsECCNControlled Source
Apache Kududevelopment5D002
1.1.0 and later5D002
Product NameVersionsECCNControlled Source
Apache BaDCAdevelopment5D002
Apache Vysperdevelopment5D002,
Product NameVersionsECCNControlled Source
Apache Nutchdevelopment5D002
0.7 and later5D002ASF,
Apache Solrdevelopment5D002
1.4 and later5D002ASF,
Apache Tikadevelopment5D002
0.2-incubating and later5D002ASF, ,
Product NameVersionsECCNControlled Source
Apache MyFacesdevelopment5D002
1.1.2 and later5D002
Product NameVersionsECCNControlled Source
Apache Mynewtdevelopment5D002, ,
Product NameVersionsECCNControlled Source
Apache Oltudevelopment5D002
Product NameVersionsECCNControlled Source
Apache Open For Businessdevelopment5D002
4.0 release branch5D002
Product NameVersionsECCNControlled Source
Apache OpenEJBdevelopment5D002
1.0 and later5D002
All 0.xn/a
Product NameVersionsECCNControlled Source
Apache ORCdevelopment5D002,
1.6.0 and on5D002,
Product NameVersionsECCNControlled Source
mod_perlPerl-*-win32-bin-*.exe5D002,
Product NameVersionsECCNControlled Source
Apache POIdevelopment5D002
3.5 and later5D002
Product NameVersionsECCNControlled Source
Apache Polygenedevelopment5D002, Bouncy Castle
2.15D002, Bouncy Castle
Product NameVersionsECCNControlled Source
Apache Shirodevelopment5D002
1.1 and later5D002
1.05D002ASF
All 0.xn/a
Product NameVersionsECCNControlled Source
Apache ServiceMix 3.xdevelopment5D002, , Bouncy Castle
All 3.x versions5D002, , Bouncy Castle
Apache ServiceMix 4.xdevelopment5D002
4.0-m1n/a
Apache ServiceMix NMRdevelopment5D002
1.0-m1, 1.0-m2n/a
Apache ServiceMix Kerneldevelopmentn/a
All 1.0 milestonesn/a
Product NameVersionsECCNControlled Source
Apache ServiceComb Java-Chassisdevelopment5D002, ,
1.0.0-m1 and later5D002, ,
Apache ServiceComb Service-Centerdevelopment5D002,
1.0.0-m1 and later5D002,
Apache ServiceComb Packdevelopment5D002, ,
0.2.0 and later5D002, ,
Product NameVersionsECCNControlled Source
Apache RocketMQdevelopment5D002, ,
rocketmq-4.0.0-incubating and later5D002, ,
Apache RocketMQ ONSdevelopment5D002,
1.8.0 and later5D002,
Product NameVersionsECCNControlled Source
APRdevelopment5D002
APR-Utildevelopment5D002
0.9.x, 1.2.xn/a
1.4.x and later5D002
Product NameVersionsECCNControlled Source
Apache XML Security for Javadevelopment5D002
1.5.x5D002
Apache XML Security for C++development5D002
Product NameVersionsECCNControlled Source
Apache SpamAssassindevelopment5D002, ,
3.0.x and later5D002, ,
Product NameVersionsECCNControlled Source
Apache Spark2.2.0 through 2.3.x5D002,
2.4.0 and later5D002
Product NameVersionsECCNControlled Source
Apache Tomcatdevelopment5D002
3.x and later5D002
Apache Tomcat native connectordevelopment5D002,
1.x and later5D002,
Product NameVersionsECCNControlled Source
Apache UIMA-ASdevelopment5D002
all releases starting with 2.2.2-incubating5D002
Apache UIMA Addonsdevelopment5D002
2.3.0 and later5D002
Apache UIMA Addon Tika Annotatordevelopment5D002
2.3.0 and later5D002
Apache UIMA-DUCCdevelopment5D002
all releases starting with 1.05D002
Product NameVersionsECCNControlled Source
Apache VCLdevelopment5D002
2.1 to 2.2.25D002
2.3 and later5D002,
Product NameVersionsECCNControlled Source
Apache WSS4Jdevelopment5D002, Bouncy Castle, ASF
1.65D002, Bouncy Castle, ASF
1.0 to 1.55D002, , ,
Apache Rampart/Javadevelopment5D002, , ,
1.1 and later5D002, , ,
Apache Rampart/Cdevelopment5D002,
0.09 and later5D002,
Apache Synapse1.0, 1.1, 1.1.1, 1.2, 2.0.05D002, , , , ,
Product NameVersionsECCNControlled Source
Apache Synapsedevelopment5D002, , , , ,
1.1.1 and later5D002, , ,
Product NameVersionsECCNControlled Source
Apache Wicket1.3, development5D002
Product NameVersionsECCNControlled Source
Apache MINAdevelopment5D002
1.0, 1.1, 2.05D002
Apache Vysperdevelopment5D002,
Apache FtpServerdevelopment5D002
1.05D002
Apache SSHDdevelopment5D002,
Product NameVersionsECCNControlled Source
Apache Wookiedevelopment5D002,
0.13 and later5D002,
Product NameVersionsECCNControlled Source
Apache Ignitedevelopment5D002, , , , , ,
2.5.0 - latest5D002, , , , , ,
2.4.05D002, , , , ,
1.0.0 - 2.3.05D002, , ,