Per product. Free is the full product.
| Free | Team | Business | ||||
|---|---|---|---|---|---|---|
| Free | Team | Business | Compliance | |||
| The full cache server, MIT-licensed, self-hosted. Forever free. | -$49/month — access control, metrics UI, email support. | -$199/month — SSO, HA/replication, analytics, priority support with the CVE-response SLA. | +The full cache server, MIT-licensed, self-hosted. Every security patch, the
+ -fips image, and all release evidence, free. |
+ $49/month — multi-user access control, SSO (OIDC), per-project usage analytics, + email support (1-business-day target). | +$199/month — everything in Team, plus HA/replication and priority support with + the CVE-response target. | +$499/month, billed annually — everything in Business, plus the FIPS 140-3 + applicability statement, signed per-release attestation letters addressed to you, + security-questionnaire support up to 8 hours per year (async), and named-version + LTS. |
No sales call. No per-seat tax. No enterprise pricing mystery.
++ The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA + provenance, signatures, VEX statements, and the FIPS 140-3 validated module + (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier + sells is the authored analysis — a FIPS applicability statement mapping the + validated module boundary onto this product — plus per-release attestation letters + signed by FosterStack LLC, and time on your security questionnaires. FosterStack + Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service + and your organization, never to a component you deploy. It is validated crypto and + publishable evidence for your compliance program. +
- Self-serve, credit card, cancel anytime. Priced so an engineering manager can expense it + Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual + term. Priced so an engineering manager can expense it without a procurement cycle. (For scale: the incumbent's median platform contract — Develocity, the full product suite, of which the cache node is one component — runs about $57k/year. That is not the price of a cache, and we are not @@ -185,8 +206,9 @@
Gradle and Maven both run against the same server today; we maintain the cache server, while the Maven client side is Apache's own Build Cache Extension. An npm remote cache for CI — same core, a third protocol — is the next protocol on the list. What is - not on the list yet is a Helm chart and the paid tiers below; those are described so you - know where this is going, not sold as available. If you need something sooner, + not on the list yet is a Helm chart and the paid tiers above — Team, Business, and + Compliance are described so you know where this is going, not sold as available; Free + is real and complete today. If you need something sooner, open an issue — that is what moves the roadmap.
diff --git a/llms.txt b/llms.txt index 810b0cf..624e4c1 100644 --- a/llms.txt +++ b/llms.txt @@ -58,9 +58,14 @@ Not yet shipped: - Production use beyond the project's own CI. Nobody runs this in a real build pipeline yet except the maintainer. - A Helm chart. Deploying to Kubernetes today means applying plain manifests. -- The paid tiers. Single sign-on, high-availability replication, and the license - key that unlocks them are not built. Everything in the repository is the free - MIT core. +- The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project + analytics, email support), Business ($199/mo: adds HA/replication, priority + support with the CVE-response target), and Compliance ($499/mo billed + annually: adds the FIPS applicability statement, signed per-release + attestation letters, questionnaire hours, named-version LTS) are described, + not yet purchasable; the license key that unlocks them is not built. + Everything in the repository is the free MIT core, including the -fips image + and all release evidence. - A CVE patch commitment that can be relied on. The project aims to ship fixes for dependency CVEs within 48 hours of public disclosure; that is a stated intention, not a contractual promise. From 359459c881482685bd02778e7cb58e7658f98698 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Sat, 12 Sep 2026 08:58:19 -0400 Subject: [PATCH 2/4] Roadmap: the Node cache, described as what it is MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner correction (Sep 11, business-model work order): 'an npm remote cache — a third protocol' misled — it read as a package-registry cache or a new wire protocol and it is neither. Replaced with the approved sentence: the same server caching node_modules, test caches, and build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the world on every run. 'Node cache', never 'npm cache', from now on. No timelines. --- index.html | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/index.html b/index.html index 44ac966..a1c48ca 100644 --- a/index.html +++ b/index.html @@ -204,8 +204,10 @@Gradle and Maven both run against the same server today; we maintain the cache
- server, while the Maven client side is Apache's own Build Cache Extension. An npm remote
- cache for CI — same core, a third protocol — is the next protocol on the list. What is
+ server, while the Maven client side is Apache's own Build Cache Extension. A Node
+ cache for CI — the same server caching node_modules, test caches, and
+ build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the
+ world on every run — is next on the list. What is
not on the list yet is a Helm chart and the paid tiers above — Team, Business, and
Compliance are described so you know where this is going, not sold as available; Free
is real and complete today. If you need something sooner,
From b894fd4e619670a55a1dc92a7c5bbf4ad1e1eeaf Mon Sep 17 00:00:00 2001
From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:53:55 -0400
Subject: [PATCH 3/4] Roadmap: the dependency cache, final vocabulary (register
row 32)
The Sep 12 product definition supersedes the Node-cache wording: the
feature is the dependency cache - the same server restoring
node_modules, ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral
CI agents stop re-downloading the world - npm first. Public vocabulary
from now on: 'build cache' (Gradle, Maven) and 'dependency cache'
(Gradle, Maven, npm); never 'npm cache', never 'Node cache'.
---
index.html | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/index.html b/index.html
index a1c48ca..60d51e8 100644
--- a/index.html
+++ b/index.html
@@ -204,10 +204,10 @@
Gradle and Maven both run against the same server today; we maintain the cache
- server, while the Maven client side is Apache's own Build Cache Extension. A Node
- cache for CI — the same server caching node_modules, test caches, and
- build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the
- world on every run — is next on the list. What is
+ server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache —
+ the same server restoring node_modules, ~/.m2, and
+ ~/.gradle/caches by lockfile key, so ephemeral CI agents stop
+ re-downloading the world — is next on the list, npm first. What is
not on the list yet is a Helm chart and the paid tiers above — Team, Business, and
Compliance are described so you know where this is going, not sold as available; Free
is real and complete today. If you need something sooner,
From 0e3d1a9f7441510a1cc2a8570f9ddd6091774b1e Mon Sep 17 00:00:00 2001
From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:53:55 -0400
Subject: [PATCH 4/4] Pricing: no competitor price, ever (register row 31)
The whole $57k parenthetical is deleted, not softened - the owner's hard
rule is that no competitor price appears on any customer-visible
surface. 'Priced so an engineering manager can expense it without a
procurement cycle.' stands on its own. Because this PR's stack rewrites
the same paragraph, the older '$57k/year' clause on main is replaced by
this text when the stack merges.
---
index.html | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/index.html b/index.html
index 60d51e8..b85f00d 100644
--- a/index.html
+++ b/index.html
@@ -196,10 +196,7 @@
Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual term. Priced so an engineering manager can expense it - without a procurement cycle. (For scale: the incumbent's median platform - contract — Develocity, the full product suite, of which the cache node is one - component — runs about $57k/year. That is not the price of a cache, and we are not - claiming it is; it is the procurement class this pricing deliberately avoids.) + without a procurement cycle.