Export & Sanctions Statement

Notice. This Statement is included because OXXON software is distributed internationally, including into markets subject to export control and sanctions regimes. It is not legal advice, and it is not an export classification. The classification statements in Section 3 are OXXON's preliminary assessment and must be confirmed by qualified export control counsel before publication. No obligation is asserted here that OXXON has not been able to verify against the implemented product.

1. Scope

This Statement applies to OXXON AUDIT, OXXON VERIFY and OXXON FAST, to the Licence Files that enable them, and to any documentation OXXON supplies.

It forms part of OXL-03 Desktop End User Licence Agreement and OXL-05 Commercial Licence Agreement.

2. What the software is

OXXON software analyses the structure of spreadsheet financial models. It performs deterministic structural checks and produces reports about them.

It has no defence, military, dual-use, intelligence, surveillance, interception, nuclear, chemical, biological or missile-technology application. It does not control physical equipment, does not process communications, and does not perform any function of the kind ordinarily subject to strategic export control.

3. Cryptography — preliminary classification

The software contains cryptographic functionality, and this is stated rather than glossed over because cryptography is the one respect in which ordinary business software commonly attracts export classification.

3.1 What cryptography is present

OXXON AUDIT for Windows contains:

• Ed25519 signature verification only. Used to verify licence tokens and update manifests. Implemented from RFC 8032's reference implementation. There is no key generation and no signing capability in the client; the client never holds a private key.
• SHA-256 and BLAKE3 hashing. Used for file integrity, canonical representation and the machine fingerprint digest.

The desktop application contains no encryption capability. It cannot encrypt or decrypt anything, and links no third-party cryptography library.

The OXXON web platform additionally relies on standard transport layer security provided by its hosting infrastructure, and on cryptographic primitives within its dependency tree used for signing session tokens and for document processing.

3.2 Preliminary assessment

OXXON's preliminary assessment is that this functionality is limited to digital signature verification, authentication and hashing, and that encryption for confidentiality is absent from the distributed desktop product. Functionality of that character is treated differently from encryption functionality under the principal export control regimes, and standard transport-layer security in a commercial web application is likewise ordinarily treated as ancillary.

This is an assessment, not a classification. OXXON has not obtained a formal classification ruling from any authority, has not self-classified under any specific control list entry, and does not represent that no licence requirement arises in any jurisdiction.

Confirmation by qualified export control counsel is required before this Statement is published, and is recorded as an outstanding item in PUBLIC_LAUNCH_LEGAL_READINESS.md.

4. OXXON's compliance position

OXXON complies with the export control and sanctions laws applicable to it, including those of India, and observes the sanctions regimes of the jurisdictions in which it does business.

OXXON will not knowingly supply software, Licence Files, support or documentation to:

• a person, entity or vessel designated under an applicable sanctions regime, or an entity owned or controlled by such a person;
• a government, entity or person located in, or ordinarily resident in, a jurisdiction subject to comprehensive territorial sanctions applicable to OXXON; or
• any recipient where OXXON knows, or has reason to believe, that the supply would breach an applicable export control or sanctions law.

OXXON screens quotation requests and licence issuance against these criteria before issuing a Licence File. Because licence issuance is a manual step — there is no self-service purchase path and no automatic fulfilment — this screening occurs before every supply, without exception.

5. Customer obligations

The Customer represents and undertakes, on each occasion it acquires or uses the software, that:

1. it is not a designated person under any applicable sanctions regime, and is not owned or controlled by such a person;
2. it is not located in, and will not use or install the software in, a jurisdiction subject to comprehensive territorial sanctions applicable to OXXON;
3. it will not export, re-export, transfer or make the software available, by any means, in breach of any applicable export control or sanctions law;
4. it will not make the software available to any designated person; and
5. it will not use the software for any prohibited end use, including any military, nuclear, chemical, biological or missile-technology end use.

A breach of this Section is a material breach of OXL-05 Commercial Licence Agreement and entitles OXXON to terminate immediately under Section 17.2 of that Agreement.

6. Consequences

Where OXXON becomes aware that a supply would breach, or has breached, an applicable law, OXXON may without liability:

• decline to issue or renew a Licence File;
• suspend or terminate a Commercial Licence;
• suspend access to website-delivered products; and
• decline to provide support.

No refund arises in these circumstances. OXL-09 Refund Policy applies.

Suspension or termination under this Section does not affect any report, findings dataset or Technical Manifest the Customer has already produced, which remain the Customer's property.

7. Restricted jurisdictions

OXXON does not publish a list of restricted jurisdictions in this document. Sanctions designations change frequently, and a list published here would be out of date and would be relied upon.

Customers with a question about a specific jurisdiction should contact partners@oxxonadvisors.com before placing an order.

8. No advice

This Statement is not export control advice. A Customer is responsible for determining its own obligations under the laws applicable to it, including those of its own jurisdiction and of any jurisdiction into which it moves or installs the software.

Where a Customer's own compliance function requires an export classification statement, a country-of-origin declaration or a supplier declaration, OXXON will respond to a written request at partners@oxxonadvisors.com with the information it holds, subject to Section 3.2.

9. Governing law

This Statement is governed by the laws of India, and Section 19 of OXL-05 Commercial Licence Agreement governs jurisdiction. Nothing in this Statement limits the application of any mandatory export control or sanctions law of any other jurisdiction.

Related documents

• OXL-03 Desktop End User Licence Agreement
• OXL-05 Commercial Licence Agreement
• OXL-09 Refund Policy
• OXL-11 Security & Privacy Statement
• OXL-14 Third-party Software Notices
• OXL-16 Acceptable Use Policy