For teams entering regulated markets
+ ++ It usually starts with one customer. A contract lands on the table with + federal or compliance requirements attached — FIPS-validated cryptography, + SBOMs, provenance, a security questionnaire with two hundred rows — and + suddenly every tool in your build pipeline needs paperwork it has never + had. Big vendors sell their way through that pile with compliance teams + and six-figure contracts. Small teams mostly just lose the deal. +
+ +The cost of compliance shouldn't determine who gets to + compete.
+ +What our piece does — and does not do
+
+ FosterStack Cache is one component in your pipeline: a self-hosted remote
+ build cache. For that component, we do the evidence work a compliance
+ program needs: the -fips build links Go's FIPS 140-3
+ validated cryptographic module (CMVP certificate #5247), and every
+ release ships with an SBOM, SLSA provenance, keyless signatures, and
+ published VEX statements. Our requirements and their evidence are public
+ in the repository, criterion by criterion.
+
+ What it does not do: make you compliant. FedRAMP and CMMC attach to your + service and your organization, never to a component you deploy. What a + component can be is evidence and validated crypto for your + program — one row of that questionnaire where the answer is written, + signed, and checkable instead of a shrug. +
+ +The Compliance tier
++ The evidence underneath is public and free — SBOMs, SLSA provenance, + signatures, VEX statements, the FIPS 140-3 validated module and its + certificate number — verifiable by anyone, no account, no purchase. What + the Compliance tier sells is the authored work on + top: a FIPS applicability statement mapping the validated module boundary + onto this product, per-release attestation letters addressed to you and + signed by FosterStack LLC, security-questionnaire support up to 8 hours + per year (async), and named-version LTS. +
+ +Verify everything for free first
+
+ Before spending anything: pull the -fips image (public, no
+ login), run the signature and provenance verification commands in
+ RELEASING.md,
+ read the scan posture in
+ SECURITY.md
+ — including what it says is not yet proven — and check the
+ requirements
+ matrix that maps every product promise to its evidence. If the free
+ evidence doesn't hold up under your audit, the paid tier wouldn't either.
+ That's the test we invite.
+