Traveler · travelererp.com/shop-server
Shop Server spec sheet
On-premises appliance running Traveler Cloud's full software on the customer's LAN. Pre-launch: specifications below are design targets and may change before the first units ship (after Traveler Cloud).
Builds
Shop Server · $4,250 one-time
Optional continuity plan $59/mo. Box keeps working without it.
Shops that want to own their system outright and keep running when the internet drops.
Shop Server Defense · $6,500 one-time
Optional continuity plan $99/mo. Box keeps working without it.
Defense and ITAR subcontractors handling CUI or export-controlled drawings.
Hardware design targets
| Shop Server | Shop Server Defense | |
|---|---|---|
| Form factor | Fanless mini-server, N150-class CPU | Same |
| Memory | 16 GB | 16 GB |
| Storage | Single SSD | Mirrored SSDs |
| TPM | Yes (disk encryption keys) | Yes (disk encryption keys) |
| Power protection | Bring your own UPS | Small UPS included, clean auto-shutdown |
| Backup | Local snapshots; optional encrypted off-site | Encrypted USB backup drive, customer-held keys |
| Configuration | Standard | Hardened, FIPS-mode configuration |
| Documentation | Install notes | NIST SP 800-171 control mapping + SSP template excerpt |
| Support personnel | Support team | US persons only, customer-granted sessions |
Network posture
Serves the app over the local network (browser, floor kiosks, TV board). Supports a LAN-only mode with no internet connection. No inbound ports need to be opened. When allowed, outbound connections are limited to:
- License check-in: Periodic, small, no shop data. Missing check-ins never disable the box.
- Updates (optional): Signed update packages; you choose when to install.
- Off-site backup (optional): Encrypted before it leaves the box.
- QuickBooks Online sync (optional): Only if you connect QuickBooks Online; sends invoice and customer records you choose to sync.
Security design
- Encryption at rest with TPM-held keys; Defense build designed around FIPS-validated cryptographic modules
- Multi-factor sign-in for every account
- Audit log of views, changes and exports
- Role-based access inside the app
- No standing vendor remote access: support sessions opened by the customer, one at a time
- Customer-held backup encryption keys (Defense)
What the shop is still responsible for
- System Security Plan, POA&M and SPRS score
- Network segmentation, firewall rules and Wi-Fi security
- Physical security of the box and backup drive
- User accounts, access reviews and offboarding
- Endpoint security on the PCs and tablets that connect
- Security awareness training and incident response
- Deciding which outbound connections to allow
Scope notes for assessors
- The box is customer-owned and on-premises. It is not an external cloud service provider, so FedRAMP Moderate equivalency for cloud-stored covered defense information does not apply to it.
- The box is in the shop's CUI scope and should appear in the SSP as an in-scope asset.
- Vendor remote access can make the vendor an External Service Provider. Support access is off by default and granted per session by the customer.
- The product is designed to support NIST SP 800-171 controls. It does not by itself make a shop CMMC certified or ITAR compliant.