Montes Software LLC d/b/a FittingsOS
FittingsOS Security
Customer-facing posture · Updated September 12, 2026 · Not an audit report
Not SOC 2 certified
Montes Software LLC is building toward SOC 2 Type I (Security). We are not currently SOC 2 certified. This page describes current hosted posture. It is not an attestation report.
FittingsOS does not claim SOC 2, ISO 27001, or HITRUST certification. FittingsOS does not claim Nadcap.
Hosted surfaces
| Host | Role | Where |
|---|---|---|
| https://fittingsos.com | Shop UI | Vercel |
| https://api.fittingsos.com | Shop API | Cloudflare Tunnel to the customer/shop origin |
Controls in plain language
- TLS
Public traffic to the shop UI and API is served over HTTPS.
- CSP and security headers
The hosted UI and API send Content-Security-Policy plus standard browser hardening headers (frame deny, nosniff, referrer policy, HSTS on the public edge).
- httpOnly sessions
Hosted sign-in uses an httpOnly session cookie. The access token is not stored in JavaScript on fittingsos.com.
- Turnstile on login
Hosted Sign-in uses Cloudflare Turnstile when the shop has it enabled.
- Tenant isolation
Shop data is scoped by organization. One tenant cannot write another tenant's records.
- ITAR / gold NC off public cloud
ITAR and other export-controlled technical data, plus gold NC programs, stay off the public cloud. They remain on the customer/shop origin.
Subprocessors
Third parties Montes Software LLC may use for hosted FittingsOS. Resend is listed as planned until outbound email is turned on for a shop.
| Vendor | Role | Status |
|---|---|---|
| Vercel | Hosts the shop UI on fittingsos.com | In use |
| Cloudflare | DNS, WAF, Tunnel to the shop API, and Turnstile on hosted login | In use |
| GitHub | Source control and CI for the product | In use |
| Tailscale | Remote access to a shop origin when that shop uses it | As applicable |
| Resend | Transactional email (invites, password messages, and public inquiries) when outbound email is enabled | Planned — when email is enabled |
Report a security issue
Email security@fittingsos.com.
security@fittingsos.com is the stated address for security reports. The DNS mailbox may forward to the operator inbox later. Do not send gold NC, prints, or ITAR technical data in the report.