First, Crypto.SE is not a forum of attorneys, and is definitely not your attorney, and cannot provide legal advice. So don't make your business decisions on the basis of queer pseudonymous feathery strangers on the internet!
That said, the Bureau of Industry and Security's current web site (archived 2017-11-03 because it changes all the time) claims that ‘open source encryption source code available for free online’ is not subject to the Export Administration Regulations once you send email to email@example.com and firstname.lastname@example.org notifying them that you have published it per 15 C.F.R. §742.15(b)(2).
You should always publish your source code, and provide ways for users to verify that it is being used (e.g., let users build it from source, and if you provide a binary distribution, also provide the tools for reproducible builds), because sensible users will reject secret proprietary crypto algorithms and implementations that they cannot study and audit or ask their friends to study and audit.
(Say what you will about the insanity of US crypto export controls, the BIS rules provide additional incentive to do the right thing about publishing crypto source code by giving you mountains of bureaucratic paperwork if you don't.)