Shop Software for Small Defense Subcontractors: Owned, On-Site, Unlimited Users
A small defense subcontractor carries a prime contractor's paperwork in a smaller building. The PO arrives with a page of flow-down clauses: specialty metals, traceability, certificates of conformance, and on CUI work, DFARS 252.204-7012 and an SPRS score. The drawings may be ITAR-controlled. The software sold to handle all of that is mostly priced and staffed for much larger companies.
Traveler is designed for the 2 to 20 person version of this shop. The Shop Server puts quoting, travelers, floor tracking, and material traceability on a box in your building with unlimited users. Shop Server Defense ($6,500 one time) adds the hardening, encrypted backups, 800-171 documentation, and US-persons-only support that defense work calls for. Both are pre-launch and planned to ship after Traveler Cloud. You can reserve one at /shop-server.
“Every prime PO comes with flow-downs, and I have to prove each one on every shipment.”
Receiving ties each heat lot and its mill cert to the job, so a specialty metals question about melt source is answered from the job record. Certificates of conformance generate from each customer's template at shipping and are archived per job, and trace runs job to lot to cert to supplier PO in two clicks.
“Primes keep asking for our SPRS score, and I'm not sure what the software has to do with it.”
Your SPRS score reflects how your shop implements NIST SP 800-171, not what any one product does. Shop Server Defense is designed to help with the shop-system part: it keeps CUI on hardware you own and ships with a control mapping and SSP template excerpt describing what the box covers and what stays your job.
“Defense-ready software is priced for defense-sized companies.”
ProShop's published FedCloud price is $37,870 a year for 10 users on AWS GovCloud. Shop Server Defense is $6,500 one time with unlimited users and an optional $99 a month continuity plan. ProShop is a mature product in production and Traveler is not, so weigh that too.
“Half our work is commercial. I don't want two systems.”
It's one system. The Shop Server runs the same software for every job, so defense and commercial work share one quoting history, one schedule, and one set of travelers, all on the box in your building.
“I can't shut the shop down for a three-month implementation.”
There's no implementation project. The box arrives preloaded: plug in power and ethernet, scan a QR code, create the owner account, and import customers and parts from CSV.
What a small defense sub actually has to show
Most of it is traceability and paperwork. Specialty metals clauses follow the metal down the supply chain, so you keep the mill cert that shows the melt source. Primes want a certificate of conformance in their format and material trace on demand. If you manufacture defense articles, ITAR registration and control over who sees technical data apply even if you never ship overseas.
If you receive CUI, DFARS 252.204-7012 and NIST SP 800-171 Rev 2 apply, along with an SPRS self-assessment score where the contract calls for one. As of October 2026, CMMC Phase 2 requirements are suspended pending a DoD review, but those underlying obligations are not.
Where Shop Server Defense fits, and where it doesn't
Keeping the shop system on a box you own means no third-party cloud holds your job data. That sidesteps the FedRAMP Moderate equivalency requirement for cloud services storing covered defense information, and it keeps ITAR drawings away from any outside provider's staff.
It doesn't make the rest of your environment compliant. The box itself is in your CUI scope, and you still own the controls: accounts, network, physical access, email, the PCs that open drawings, and your written policies. If you grant a vendor remote access, that vendor can become an external service provider in your scope. Shop Server Defense is designed to make its own piece easy to document, and to keep vendor access off unless you turn it on.
Availability
Traveler is in early access. Cloud comes first, with the Shop Server and Shop Server Defense planned to ship after it. Pricing is committed launch pricing: $4,250 one time for Shop Server and $6,500 one time for Defense, each with an optional continuity plan ($59 or $99 a month). Either box keeps working if you never pay us another dollar.
The security features the Defense edition depends on, including FIPS-validated encryption, MFA, audit logs, and customer-held backup keys, are designed and not yet shipped. Ask for the control mapping before you count on it in your own documentation.
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: 5-Year Cost: Cloud vs On-Prem Shop Software →
Straight answers
▸Will Traveler make my shop CMMC or ITAR compliant?
No. Both are obligations on your company and its whole environment. Shop Server Defense is designed to support your NIST SP 800-171 controls and keep CUI and technical data off third-party clouds, as one part of your program.
▸What does Shop Server Defense add over the standard Shop Server?
Mirrored SSDs and a small UPS, an encrypted USB backup drive with customer-held keys, a hardened configuration designed around FIPS-validated encryption, MFA, and audit logging, a NIST SP 800-171 control mapping with an SSP template excerpt, and support from US persons only. It's $6,500 one time versus $4,250.
▸Can I use Traveler Cloud for defense work instead?
For commercial work, yes. For CUI, a cloud service storing covered defense information has to meet FedRAMP Moderate or equivalent, and Traveler Cloud makes no such claim. Shops handling CUI should look at Shop Server Defense.
▸Do I need a deposit to reserve a Shop Server?
No. Reserving one at /shop-server is a free form with no deposit.