Software for ITAR Machine Shops: Keep Your Shop Data On-Premise
Shops that make defense articles handle technical data controlled under ITAR: drawings, models, and specifications that can't be shared with foreign persons without authorization. Many of these shops are uneasy about putting that data, or the job records around it, on someone else's cloud. Owners say so directly, and cloud anxiety is one of the documented reasons small defense suppliers stay on paper and spreadsheets.
Traveler offers a different option. The Shop Server is the entire system on a small fanless computer that ships to your shop, sits on your network, and works with the internet unplugged. It's $4,250 one time, you own it, and in LAN-only mode your shop data stays in your building. Shop Server Defense, at $6,500 one time, is the edition designed for ITAR and CUI work: a hardened configuration, an encrypted backup drive with keys only you hold, and support from US persons only. Both are planned to ship after Traveler Cloud, and you can reserve one at /shop-server.
“I'm not putting customer drawings on somebody's cloud.”
With the Shop Server you don't have to. The database, drawings, and documents live on the box in your building. In LAN-only mode it never contacts the outside world beyond a documented license check-in.
“Every vendor wants a subscription forever, and I want to own my tools.”
The Shop Server is a one-time $4,250 purchase with 12 months of updates included. An optional $59 a month continuity plan adds signed updates, nightly encrypted offsite backup, remote app access, and support. Shop Server Defense is $6,500 one time with an optional $99 a month continuity plan. Without a plan, either box keeps working.
“I don't want some vendor's support people, wherever they are, able to open our drawings.”
Shop Server Defense support is designed to come from US persons only, and only when you grant access. By default nobody outside your building has a way in, because the data never leaves it.
“If the vendor goes away, my records go with them.”
Every edition has one-click full export in CSV and PDF with a documented schema. On the Shop Server, the data is physically yours already.
“Our quality and traceability records have to be airtight for the prime.”
The Shop Server runs the full software, compliance suite included: material traceability to the heat lot, certificates of conformance, FAI forms, NCR and corrective action, and audit binder export.
What software can and can't do for ITAR
ITAR compliance is a set of obligations on your company: registration with the State Department's Directorate of Defense Trade Controls when you manufacture defense articles, controlling who can access technical data, licensing exports, and keeping records. No piece of software makes a shop ITAR compliant, and Traveler doesn't claim to.
What the Shop Server is designed to help with is one specific question: where your job data lives and who can reach it. Keeping the system on hardware inside your building, on your own network, makes that answer simple to explain to a customer or an auditor. Talk to your export compliance counsel about how it fits your own program.
ITAR doesn't ban the cloud, so why keep data in the building?
It's a common belief that ITAR forbids cloud storage. It doesn't. Under the carve-out in 22 CFR 120.54, technical data that is end-to-end encrypted with FIPS 140-2 validated cryptography, where the cloud provider never holds the keys, is not treated as an export just because it sits on that provider's servers. What the rule does not change is foreign-person access: letting a foreign person reach the data is still an export, whoever's servers it's on.
So the real question with any cloud system is who holds the keys and who could reach the data, including the vendor's support staff and their subcontractors. The Shop Server answers it by taking the third party out: the data stays on a box in your building, so there's no outside provider to vet. That doesn't remove your own duties. You still decide which employees can see which drawings, and the box is part of the environment your compliance program covers.
How the Shop Server works
The box arrives preloaded. Plug in power and ethernet, scan a QR code with your phone, and create the owner account on a local page. Floor tablets and office computers on your network connect to it directly.
If you turn on the continuity plan, updates are signed and can roll back, backups are encrypted nightly and stored offsite, and a relay lets the mobile app reach the box from outside the shop. If you leave it off, the box runs LAN-only. That choice is yours, and it's presented plainly during setup.
Availability
Traveler is in early access, with the cloud edition first and both Shop Server editions shipping after it. Pricing shown is committed launch pricing, and reserving a box at /shop-server is free, with no deposit.
The Shop Server runs the same software as the cloud edition, so nothing is held back for owning the box: quoting, travelers, floor tracking, material traceability, and the compliance suite are all included. QuickBooks Online sync needs an outbound connection, so in strict LAN-only mode you'd handle that handoff another way.
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: 5-Year Cost: Cloud vs On-Prem Shop Software →
Straight answers
▸Does Traveler make my shop ITAR compliant?
No. ITAR compliance depends on your registration, access controls, licensing, and recordkeeping. The Shop Server is designed to help by keeping your shop system and its data on hardware in your building. It is one part of a compliance program, not a substitute for one.
▸Does the Shop Server work without internet?
Yes. It runs on your local network and works with the WAN cable unplugged. LAN-only mode never phones home beyond a documented license check-in.
▸Is Traveler Cloud an option for ITAR work?
That's a decision for your export compliance program. ITAR doesn't ban cloud storage outright: 22 CFR 120.54 excludes properly end-to-end encrypted data where the provider holds no keys, but foreign-person access is still an export. Shops that don't want controlled technical data or related job records in a third-party cloud at all should look at the Shop Server.
▸What's the difference between Shop Server and Shop Server Defense?
Both run the full Traveler software with unlimited users. Shop Server Defense ($6,500 one time) adds mirrored SSDs and a small UPS, an encrypted USB backup drive with customer-held keys, a hardened configuration designed around FIPS-validated encryption, MFA, and audit logging, a NIST SP 800-171 control mapping with an SSP template excerpt, and support from US persons only. These are planned features of a product that hasn't shipped yet.
▸What about CMMC?
As of October 2026, CMMC Phase 2 requirements are suspended: a DoD CIO memo on July 13, 2026 paused them pending a program review. DFARS 252.204-7012, NIST SP 800-171 Rev 2, and SPRS self-assessment scores still apply where they're in your contracts. CMMC assesses your whole environment, not a single application, so keeping data on-premise can simplify the scope conversation but doesn't satisfy it by itself. Work with a qualified assessor or consultant.