Appearance

Export Control Notice ​

Effective Date: 2026-07-09 · Document ID: ECN-MMA-001 · Contact: info@mapsted.com · Contact UsVersion: 1.0

Plain-language summary (non-binding): The Mapsted Maps JavaScript API (@mapsted/maps-js-api) is a publicly available JavaScript and WebAssembly package developed in Canada by Mapsted Corp. It does not itself implement cryptographic primitives — it relies on the browser's built-in TLS stack. Mapsted's good-faith position is that the Software falls outside the scope of Canada's Export Control List and is classified EAR99 under US export law, meaning no export permit is required for most ordinary commercial use. However, the Software must not be downloaded, installed, or used in sanctioned jurisdictions — including Cuba, Iran, North Korea, Syria, and certain regions of Ukraine — or by persons on applicable sanctions lists. This notice describes Mapsted's classification positions, the list of prohibited destinations, and what Licensees are responsible for. It is informational only; it is not legal advice. Licensees are solely responsible for their own export compliance.

1. Introduction ​

Mapsted Corp., together with its subsidiaries, affiliates, and related entities (collectively, "Mapsted"), publishes the @mapsted/maps-js-api package (the "Software") on the npm registry and via CDN at mapi.mapsted.com. Because the npm registry is globally accessible, downloads of the Software may cross international borders and may be subject to Canadian and United States export control laws, as well as applicable sanctions regimes.

This Export Control Notice ("Notice") describes:

  • the export control classification Mapsted asserts for the Software;
  • the jurisdictions and persons to which or for whom the Software may not be exported; and
  • the compliance obligations that apply to each Licensee.

This Notice is informational in nature. It is not legal advice. Mapsted Corp. does not advise on the Licensee's own export obligations. Licensees should obtain independent legal counsel if they have questions about export compliance in their specific circumstances.

2. Scope ​

This Notice applies to all versions of the Software as of the date shown in the version header above, including:

  • the @mapsted/maps-js-api npm package in all distribution formats (ESM, CommonJS, IIFE/CDN);
  • the WebAssembly binary distributed within or alongside the npm package;
  • the CDN-distributed bundle served at mapi.mapsted.com; and
  • any documentation or other materials distributed within the npm package tarball.

The backend services operated by Mapsted (maps.mapsted.com, deploy.mapsted.com, filer.mapsted.com) are not distributed to Licensees and are separately governed by the signed commercial agreement. This Notice covers the Software as distributed, not Mapsted's backend infrastructure.

This Notice applies to Licensees as defined in the Terms of Service (TOS-MMA-001) §2. All capitalized terms not defined here have the meanings given in the Licence Agreement (LA-MMA-001).

3. Country of Origin ​

The Software was developed in Canada. Mapsted Corp. is a federally incorporated Canadian corporation headquartered in Ontario, Canada. For the purposes of Canadian and US export control law, the Software's country of origin is Canada.

4. Canadian Export Control — Primary Jurisdiction ​

4.1 Governing framework ​

As a Canadian company, Mapsted's primary export control obligations arise under:

  • the Export and Import Permits Act (R.S.C. 1985, c. E-19) ("EIPA");
  • the Export Control List ("ECL") established under the EIPA and administered by Global Affairs Canada;
  • the Area Control List ("ACL") administered by Global Affairs Canada; and
  • Canadian autonomous sanctions regulations enacted under the Special Economic Measures Act (S.C. 1992, c. 17) ("SEMA") and the United Nations Act (R.S.C. 1985, c. U-2), collectively administered by Global Affairs Canada.

4.2 Classification assertion ​

Mapsted's good-faith position is that the Software does not appear on the Canadian Export Control List (ECL) and therefore does not require an export permit from Global Affairs Canada for ordinary commercial export to most destinations.

This position is based on the following product characteristics:

  • The Software is a publicly available commercial JavaScript and WebAssembly package;
  • The Software does not itself implement cryptographic algorithms or cryptographic primitives — it relies exclusively on the browser's native TLS stack (TLS 1.2 minimum; TLS 1.3 preferred) for encrypted transport, which is inherent to the HTTPS protocol and built into every modern browser;
  • The Software does not perform radio-frequency operations, generate controlled signals, or incorporate dual-use technology in any ECL-controlled category;
  • The Software is publicly available on the npm registry without restriction (subject to commercial licence requirements) and is not subject to restricted publication.

Mapsted's good-faith assessment is that the Software is not listed on Canada's Export Control List. Should Global Affairs Canada publish a determination contradicting this assessment, this Notice will be revised.

4.3 Canadian sanctions ​

Regardless of the ECL classification, the Software must not be exported to destinations or persons subject to Canadian autonomous sanctions administered by Global Affairs Canada under SEMA or the United Nations Act. See §6 (Sanctioned Jurisdictions) and §7 (Sanctioned Persons and Entities) below for Mapsted's current prohibited-destination and prohibited-person lists.

5. US Export Control — Secondary Jurisdiction ​

5.1 Basis for US applicability ​

The npm registry is operated by npm, Inc., a US entity. Downloads of the Software from the npm registry may constitute "exports" or "re-exports" under US law. Accordingly, US export regulations are a secondary governing framework for the Software.

5.2 Governing framework ​

US export control obligations relevant to the Software arise under:

  • the Export Administration Regulations ("EAR"), 15 C.F.R. Parts 730–774, administered by the Bureau of Industry and Security ("BIS") of the US Department of Commerce; and
  • sanctions regulations administered by the US Treasury Department's Office of Foreign Assets Control ("OFAC"), including the Specially Designated Nationals and Blocked Persons List ("SDN List").

5.3 Classification assertion — EAR99 ​

Mapsted asserts in good faith that the Software is classified EAR99 under the Commerce Control List ("CCL"): that is, the Software does not appear on the CCL and is not subject to a licensing requirement for export to most destinations.

This assertion is based on the following:

  • The Software is mass-market, publicly available software downloadable by any person from the npm registry and the CDN without restriction (subject to commercial licence terms);
  • Under EAR §734.3(b)(3), software that is published and available online without restriction is generally excluded from the EAR as "publicly available" technology;
  • The Software does not implement encryption algorithms. It relies on the browser's native TLS stack, which constitutes "encryption items" controlled under ECCNs 5E002 and 5D002 in certain configurations. However, because the Software does not itself incorporate encryption source code or object code, and because browser-inherent TLS is the transport layer for all ordinary web software, Mapsted's position is that this does not bring the Software within an ECCN-5xxx classification. Mapsted's good-faith assessment is that the Software is EAR99 (no CCL classification), based on §734.3(b)(3) publicly-available-software exclusion and the absence of controlled cryptographic content. Mapsted has not obtained a formal BIS CCATS classification; should doubt arise (for example following any addition of controlled cryptography to the Software), a CCATS filing will be pursued.
  • The WebAssembly binary performs map rendering and geometry operations. It does not, to Mapsted's knowledge, incorporate any cryptographic library or implement any encryption, decryption, or key-management function. Mapsted's current wasm distribution does not link or embed cryptographic primitives; the Software relies entirely on the user agent's TLS stack.

Important: The EAR99 assertion is Mapsted's good-faith position based on an internal review of the Software's current feature set. Mapsted has not obtained a formal written classification from BIS (a CCATS determination) as of this draft. If Mapsted Legal or BIS-qualified counsel determines that a formal classification filing is required or advisable, this Notice will be updated and a CCATS filing will be initiated before public launch.

5.4 US sanctions ​

Regardless of the EAR99 position, the Software must not be exported, re-exported, or transferred (in-country or otherwise) to any destination or person subject to OFAC-administered sanctions. See §6 and §7 below.

6. Sanctioned Jurisdictions — Prohibited Destinations ​

The Software must not be downloaded, installed, accessed, operated, or redistributed in, or for the benefit of, any of the following jurisdictions (collectively, the "Prohibited Destinations"):

JurisdictionPrimary Sanctions Authority
CubaOFAC (Cuban Assets Control Regulations); Canadian SEMA/UN Act
IranOFAC (Iranian Transactions and Sanctions Regulations); Canadian SEMA/UN Act
North Korea (Democratic People's Republic of Korea)OFAC; UN Security Council sanctions; Canadian SEMA/UN Act
SyriaOFAC (Syrian Sanctions Regulations); Canadian SEMA/UN Act
Crimea region of Ukraine (non-government-controlled)OFAC (Ukraine-/Russia-Related Sanctions); Canadian SEMA
Donetsk People's Republic (DNR) and Luhansk People's Republic (LNR) regions of Ukraine (non-government-controlled)OFAC; Canadian SEMA
RussiaThe Russian Federation is subject to substantial and evolving Canadian, US, UK, and EU sanctions. Licensees located in or doing business with entities in the Russian Federation must independently verify that use of the Software is permitted under all applicable sanctions regimes at the time of use. Mapsted does not warrant or confirm permissibility for any Russian destination; Licensees bear sole compliance responsibility.
Any other jurisdiction added to the Canadian Area Control List or subject to comprehensive Canadian autonomous sanctions under SEMAGlobal Affairs Canada
Any other jurisdiction subject to comprehensive US embargo under OFAC-administered regulationsOFAC
Any other jurisdiction subject to a binding UN Security Council comprehensive arms embargo or technology-transfer restrictionUN Security Council

This list reflects Mapsted's understanding of applicable sanctions regimes as of the draft date shown in the version header. Sanctions regimes change frequently. Mapsted does not guarantee that this list is complete or current at any future date. Licensees are solely responsible for monitoring applicable sanctions regimes and ensuring their use of the Software is lawful.

7. Sanctioned Persons and Entities — Screening Obligations ​

The Software must not be provided, transferred, or made accessible to any individual or entity that appears on any of the following lists:

  • Canada — Consolidated Canadian Autonomous Sanctions List: maintained by Global Affairs Canada at international.gc.ca.
  • Canada — United Nations Security Council Sanctions Roster: incorporated under Canada's United Nations Act.
  • US — Specially Designated Nationals and Blocked Persons (SDN) List: administered by OFAC at ofac.treas.gov.
  • US — Entity List, Denied Persons List, Unverified List: administered by BIS at bis.gov.
  • Any other list of sanctioned or prohibited persons or entities maintained by a sanctions authority applicable to the Licensee's jurisdiction of operation.

Each Licensee is responsible for conducting reasonable due diligence to ensure that its end users, sub-licensees, and downstream recipients of the Software (or applications built with the Software) are not listed on any of the above lists before granting access.

8. Prohibited End-Uses ​

Regardless of the Licensee's location or the destination of the Software, the Software must not be used — and must not be provided to any person for use — in connection with any of the following activities:

  1. Nuclear applications: design, development, production, stockpiling, or use of nuclear explosive devices or any facility capable of supporting or preparing for such activities, in violation of applicable law.
  2. Biological and chemical weapons: design, development, production, stockpiling, or use of biological, chemical, or toxin weapons, in violation of applicable law.
  3. Missile technology: design, development, or production of ballistic missiles, rockets, or related delivery systems capable of delivering weapons of mass destruction.
  4. Maritime nuclear propulsion: any end-use involving nuclear propulsion in maritime vessels without applicable governmental authorisation.
  5. Any other end-use prohibited by applicable export-control law: including without limitation the EAR "catch-all" end-use and end-user controls at 15 C.F.R. Part 744 and equivalent Canadian controls under the EIPA.

9. Licensee Compliance Obligations ​

Each Licensee, by downloading, installing, or using the Software, represents and warrants to Mapsted that:

  1. No prohibited destination: the Licensee is not physically located in, incorporated under the laws of, or operating under the control of a government of any Prohibited Destination listed in §6.
  2. No listed person: the Licensee, and to the Licensee's knowledge each of its officers, directors, and controlling shareholders, is not designated on any sanctions list referenced in §7.
  3. Lawful end-use: the Licensee will not use or permit use of the Software for any prohibited end-use described in §8.
  4. Downstream screening: before granting any end user, sub-licensee, or third party access to the Software or to any application built with the Software, the Licensee will conduct reasonable due diligence to verify that the recipient is not a Prohibited Person or located in a Prohibited Destination.
  5. Change notification: if the Licensee becomes aware that any of the representations in this §9 are or have become inaccurate, the Licensee will notify Mapsted promptly at info@mapsted.com and immediately suspend the relevant use or access.
  6. Compliance with applicable law: the Licensee will comply with all export control and sanctions laws applicable to the Licensee's own jurisdiction of incorporation and operation, in addition to the Canadian and US frameworks described in this Notice.

Compliance with the obligations in this §9 is a material term of the Licence Agreement (LA-MMA-001) and the Terms of Service (TOS-MMA-001). Breach of these obligations constitutes a material breach and will result in immediate termination of any licence granted with respect to the Software, without notice or opportunity to cure, pursuant to the termination provisions of the Licence Agreement.

10. Re-Export and Remote-Access Restrictions ​

The Licensee must not re-export, re-transfer, or otherwise make the Software available (including via remote access or hosted deployment accessible over the internet) to any person located in a Prohibited Destination or to any Prohibited Person, without Mapsted's prior written consent.

For the avoidance of doubt, deploying an application that embeds the Software on a server accessible from a Prohibited Destination — including offering a publicly accessible web application or SaaS product that end users in a Prohibited Destination could access — may constitute a re-export under applicable law. Licensees are responsible for implementing appropriate geographic access controls if their deployment could otherwise reach Prohibited Destinations.

11. Cryptographic-Content Notice ​

Current negative declaration: As of the version of this Notice shown in the version header, the Software does not itself implement cryptographic primitives. Specifically:

  • The JavaScript and TypeScript source code of @mapsted/maps-js-api does not incorporate any cryptographic library (including but not limited to OpenSSL, libsodium, TweetNaCl, WebCrypto wrappers, forge, node-forge, crypto-js, or equivalent).
  • The WebAssembly binary distributed with the Software performs map rendering and geometric computation. To Mapsted's knowledge, it does not incorporate cryptographic code.
  • All encrypted transport between the Software and Mapsted's backend services is handled by the end user's browser via the browser's native TLS stack (TLS 1.2 minimum; TLS 1.3 preferred). The Software passes data to and from the browser's built-in HTTPS implementation; it does not implement or expose any encryption, decryption, key-generation, or key-management function.

Mapsted's current wasm distribution does not link or embed cryptographic primitives; the Software relies entirely on the user agent's TLS stack. Mapsted will revise this Notice and, where required, pursue a BIS CCATS classification before releasing any wasm distribution that links cryptographic libraries.

Future-change trigger: If any future release of the Software incorporates cryptographic functionality — including but not limited to WebCrypto API wrappers, Web Authentication (WebAuthn) support, cryptographic token validation, embedded encryption in the WebAssembly binary, or any other implementation or wrapping of cryptographic primitives — this Notice must be updated before that release is published. Depending on the nature of the cryptographic functionality added, a formal BIS classification filing (CCATS under 15 C.F.R. §748.3) and/or a Global Affairs Canada ECL review may be required before that release may be distributed outside Canada.

12. Contact for Export-Control Questions ​

For questions about the export control classification of the Software, or to notify Mapsted of a potential compliance issue:

Mapsted does not provide legal advice on any Licensee's export control obligations. Licensees requiring legal guidance on their own compliance obligations should consult qualified export-control counsel in their applicable jurisdictions.

13. Change Management and Review Cadence ​

This Notice is reviewed by Mapsted Corp. on the following schedule:

  • Annual review: at least once per calendar year, regardless of product changes, to verify that the sanctioned jurisdiction list and classification positions remain accurate.
  • Triggered review: whenever a material change to the Software occurs that may affect the export control classification, including (without limitation): (a) addition of cryptographic functionality to the JavaScript source or WebAssembly binary; (b) addition of new backend capabilities involving dual-use technology; (c) significant change in the Software's distribution model or end-user base; (d) material change to Canadian or US export control regulations applicable to software of this type.
  • Sanctions list updates: the Prohibited Destination list in §6 reflects Mapsted's understanding of applicable sanctions regimes as of the version date. Mapsted will update this list on a best-efforts basis when material changes to applicable sanctions regimes occur. Licensees must independently monitor applicable sanctions regimes; Mapsted's failure to update §6 promptly does not relieve any Licensee of its compliance obligations.

Material changes to this Notice will be reflected in an updated version number and draft date in the version header above, and will be published to the documentation site. Where such changes expand Licensee obligations materially, Mapsted will use commercially reasonable efforts to provide advance notice to Licensees under a current commercial agreement.

14. Disclaimers ​

  1. Not legal advice: This Notice is provided for informational purposes only. It is not legal advice and does not create an attorney-client relationship. Mapsted Corp. does not advise on any Licensee's compliance obligations under applicable export control or sanctions law.

  2. Licensee's sole responsibility: The Licensee is solely responsible for ensuring that its downloading, installation, use, redistribution, and deployment of the Software complies with all applicable export control laws, sanctions regulations, and other applicable laws in every jurisdiction in which the Licensee operates or makes the Software available.

  3. Good-faith positions: The classification positions in this Notice (EAR99; outside Canadian ECL) represent Mapsted's good-faith assessment based on an internal review of the Software's current feature set and applicable regulations. Mapsted has not obtained a formal written classification determination from the BIS (CCATS) or a formal opinion from Global Affairs Canada as of this draft. These positions do not constitute a guarantee that the Software is uncontrolled under all applicable export regimes or for all end-uses, destinations, or end-users.

  4. No guarantee of completeness: Sanctions regimes, export control lists, and applicable regulations change frequently. Mapsted does not warrant that this Notice is complete or current at any date after the version date shown above. Licensees must independently verify applicable requirements.

  5. Amendment: Mapsted Corp. may amend this Notice at any time. The current version will always be published at the documentation site (docs.mapsted.com/maps-js-api/legal/export-control-notice). Continued use of the Software after an updated Notice is published constitutes acceptance of the updated terms, subject to the change-management provisions in §13.