FittingsOS Security

Customer-facing posture statement · Not an audit report

Effective date: October 6, 2026
Version: 2026.10.06-1

This page describes the current hosted security posture of FittingsOS, operated by Montes Software LLC, a California limited liability company doing business as FittingsOS (“Provider,” “we,” “us,” or “our”). It is referenced in the Privacy Policy and Section 10 of the Data Processing Agreement. It describes posture; it is not an attestation report, a certification, or a warranty. The warranty disclaimer and limitation of liability in the Terms of Service apply.

1. Certifications: what we do and do not claim

Montes Software LLC is building toward SOC 2 Type I (Security). We are not currently SOC 2 certified. This page describes current hosted posture. It is not an attestation report.

FittingsOS does not claim SOC 2, ISO 27001, or HITRUST certification. FittingsOS does not claim AS9100, Nadcap, ISO, FAA, or EASA certification or approval, and it does not replace a shop certificate. Quality modules in the Software are tools, as described in Exhibit B of the Terms of Service.

2. Hosted surfaces

Global CDN and edge points of presence may terminate TLS in transit. Provider does not claim United States–only data residency for all bytes in transit. See the Subprocessors page and Section 12 of the Data Processing Agreement.

3. Controls in plain language

• TLS. Public traffic to the shop UI and API is served over HTTPS. Edge and CDN points of presence may terminate TLS in transit.
• CSP and security headers. The hosted UI and API send Content-Security-Policy plus standard browser hardening headers (frame deny, nosniff, referrer policy, HSTS on the public edge).
• httpOnly sessions. Hosted sign-in uses an httpOnly session cookie. The access token is not stored in JavaScript on fittingsos.com. See the Cookie and Tracking Notice.
• Turnstile on login. Hosted sign-in uses Cloudflare Turnstile when the shop has it enabled.
• Email multi-factor authentication. Hosted sign-in supports email multi-factor codes, which are short-lived and are not kept as recoverable plaintext.
• Password storage. Account passwords are stored as one-way password hashes, never as recoverable plaintext.
• Tenant isolation (between shops). Shop data is scoped by organization identifier, with row-level security on org-scoped tables. One Customer organization (tenant) cannot write another organization’s records. Provider does not promise isolation between end-customers *inside* a single shop’s customer portal. Until portal per-customer controls are complete, the Customer organization is responsible for who it invites and which customer records a portal login may see.
• Rate limiting and abuse controls. Hosted surfaces apply rate limiting and abuse-prevention controls, which may automatically throttle or refuse traffic that appears to be an attack.
• Audit trail. The Software keeps an append-only record of Terms acceptance and security logs of sign-in events.
• Controlled technical data and gold NC. Customer must classify its data under ITAR/EAR and keep controlled technical data and gold NC programs on the shop origin and off public uploads to fittingsos.com. Public cloud UI, CDN, and edge paths may see stubs, metadata, or transit TLS; they are not a designated controlled channel. Provider is not the Empowered Official. See Article IX of the Terms of Service.
• Customer portal uploads. Every customer-portal upload asks whether the file is ITAR or EAR controlled technical data. If the uploader answers yes, or if the filename or title contains “ITAR” or “EAR,” fittingsos.com refuses the upload and points the uploader to the shop’s controlled channel. After an uploader answers no, any on-screen label reflects that person’s own declaration only. Provider does not classify the file as cleared, not ITAR, or commercial.
• AI off by default. Cloud AI features in the Software are off by default and must not receive gold NC, production G-code, prints, or export-controlled technical data.

These controls may change as the product evolves. The overall level of protection for Personal Data will not be materially reduced without notice through a DPA / TERMS_VERSION update where the change is material, as provided in the DPA.

4. Subprocessors

Third parties Montes Software LLC may use for hosted FittingsOS. The authoritative list, definitions, change notice, and Customer objection process are on the Subprocessors page.

5. Change control and production deploys

Merges to the main branch currently build and auto-assign the production aliases for fittingsos.com and www.fittingsos.com (auto-deploy). Provider does not operate a separate manual promote gate for those aliases today. Independent pull-request review is a development practice when used; it is not a contractual guarantee of review on every change. If a Customer requires a promote gate or other release controls, that commitment must appear in an Order Form or MSA when such controls are implemented.

6. Shared responsibility

Security of FittingsOS is shared between Provider and each Customer.

Provider is responsible for the hosted surfaces listed above, the controls described on this page, Subprocessor oversight, and Security Incident notification under the DPA.

Each Customer is responsible for:

• issuing, reviewing, and promptly disabling accounts, including when personnel leave;
• protecting credentials, device tokens, and any biometric or passkey unlock it enables;
• avoiding shared generic logins where individual accountability is required;
• securing shop-origin systems, endpoints, and customer-hosted (on-premises or LAN) deployments, including backups, patching, and physical security;
• classifying export-controlled data, answering portal upload declarations truthfully, and keeping controlled technical data and gold NC off public uploads;
• configuring who may use the customer portal and understanding that isolation is between shops/tenants, not yet between end-customers inside one shop; and
• its own quality system, records-retention program, and notices to its employees.

7. Security incidents

If Provider confirms a Security Incident affecting Personal Data that Provider hosts, Provider will notify the affected Customer without undue delay, and in any event within seventy-two (72) hours of confirmed awareness unless a shorter period is required by law, as provided in Section 8 of the Data Processing Agreement. Where personal information Provider holds as a business is affected, Provider will notify individuals and authorities as required by Cal. Civ. Code § 1798.82 and other applicable law.

8. Report a security issue

Email security@fittingsos.com.

security@fittingsos.com is the stated address for security reports. Do not send gold NC, prints, or ITAR technical data in a report.

Please include a description of the issue, the affected URL or feature, steps to reproduce, and how we can reach you. When researching a potential issue, act in good faith: do not access, modify, or delete another tenant’s data; do not degrade service for others; do not run unapproved load tests against hosted components; and do not publicly exploit a vulnerability. These expectations are consistent with Articles X and XVII of the Terms of Service.

9. Related pages

• Terms of Service
• Privacy Policy
• Data Processing Agreement
• Subprocessors
• Cookie and Tracking Notice
• Accessibility Statement

Montes Software LLC, doing business as FittingsOS · 5392 Corradi Ter, Acton, CA 93510, United States · security@fittingsos.com