FittingsOS Subprocessors

Effective date: October 6, 2026
Version: 2026.10.06-1

This page identifies the third parties that Montes Software LLC, a California limited liability company doing business as FittingsOS (“Provider,” “we,” “us,” or “our”), may engage to deliver hosted FittingsOS, and explains how we add or change them. It is the subprocessor list referred to in Section 7 of the FittingsOS Data Processing Agreement (the “DPA”) and in Section 7 of the Privacy Policy, and it is summarized on our Security page. Capitalized terms not defined here have the meanings given in the DPA and the Terms of Service.

1. Definitions

“Subprocessor” means a third party engaged by Provider to Process Personal Data on behalf of Customer.
“Personal Data” means any Customer Data relating to an identified or identifiable natural person that Provider processes on behalf of Customer in connection with the Software.
“Customer Data” has the meaning given in the Terms of Service and the Privacy Policy, and includes job records, quality records, employee time, customer and vendor files, and other shop content a Customer organization stores in FittingsOS.
“Service provider” and “contractor” have the meanings given in the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code § 1798.140(ag) and (j)). Provider acts as a service provider to each Customer as to Customer Data, and each Subprocessor acts as Provider’s service provider for the services it performs.

2. Current subprocessors

Vendor	Role	Status
Vercel	Hosts the shop UI on fittingsos.com (SSR region iad1)	In use
Cloudflare	DNS, WAF, Tunnel to the shop API, and Turnstile on hosted login	In use
GitHub	Source control and CI for the product	In use
Tailscale	Remote access to a shop origin when that shop uses it	As applicable
Resend	Transactional email (invites, MFA codes, password messages, and related transactional mail)	In use
Intuit / QuickBooks Online	Optional accounting sync when a shop enables it	Available / when enabled
Plaid	Optional bank linking when a shop enables it	Available / when enabled

Status meanings. “In use” means the vendor currently performs the stated role for hosted FittingsOS. “As applicable” means the vendor performs the stated role only for a shop that uses that function. “Available / when enabled” means the integration code is live and may Process Personal Data only after a Customer enables the feature for that shop (the feature flag is off by default).

Hosting and processing for the shop UI SSR and shop-origin API are oriented to the United States (Vercel SSR region iad1; API traffic reaches the Customer/shop origin via Cloudflare Tunnel). Global CDN and edge points of presence may terminate TLS in transit. Provider does not claim that every byte in transit resides only in the United States. See Section 12 of the DPA and the Security page.

3. What this list does not include

Customer-controlled systems. On customer-hosted (on-premises or LAN) and hybrid deployments, the shop origin and any vendors the Customer chooses for its own systems are the Customer’s, not Provider’s Subprocessors. Customer must classify and keep controlled technical data and gold NC programs on the shop origin and off public uploads to fittingsos.com. Provider is not the Empowered Official.
Customer-selected third-party services. Third-party AI model providers or other services a Customer elects to enable are governed by their own terms, as described in the Terms of Service. Cloud AI features in the Software are off by default.
Provider’s own business data. Personal information Provider collects as a business (for example, website inquiries) is described in the Privacy Policy. The vendors above may also process that information in the same roles.

4. Subprocessor obligations

As provided in the DPA, Provider:

imposes written confidentiality and data-protection terms on each Subprocessor that are no less protective of Personal Data than the DPA in all material respects, given the service each performs;
requires that Subprocessors not sell Personal Data or use it for purposes other than performing services for Provider; and
remains responsible for each Subprocessor’s performance of Provider’s processor obligations under the DPA.

5. Notice of changes

Provider keeps this list current. When Provider adds a Subprocessor that will Process Personal Data, or changes a listed Subprocessor’s role or status, Provider will update this page and the effective date above, and will reflect the change in the summary on the Security page. Material additions that process personal information will be reflected here. The fifteen (15) day objection period in Section 6 runs from the date a change is posted on this page.

Customers that want to follow changes should review this page periodically. Questions about the list may be sent to security@fittingsos.com.

6. Objection to a new subprocessor

Under Section 7 of the DPA, if Customer objects to a new Subprocessor on reasonable data-protection grounds in writing within fifteen (15) days of posting, the parties will discuss a commercially reasonable alternative. If none exists, Customer’s sole remedy is to stop using the affected feature or terminate the affected hosted service under the Terms of Service. Continued use of the Software after a posted Subprocessor update, without a timely objection, constitutes authorization of that Subprocessor.

Send objections to security@fittingsos.com with the subject line “Subprocessor objection,” identifying the Customer organization, the Subprocessor, and the data-protection grounds for the objection. Do not include export-controlled technical data, prints, or NC programs.

An executed MSA or a DPA attached to an MSA, if any, controls over this page to the extent of conflict, as provided in the DPA.

7. Related pages

Montes Software LLC, doing business as FittingsOS · 5392 Corradi Ter, Acton, CA 93510, United States · security@fittingsos.com