diff --git a/index.html b/index.html index 4f2b84c..6f75def 100644 --- a/index.html +++ b/index.html @@ -164,27 +164,50 @@

What we do not collect

billing a customer requires an email address, and a privacy claim that is convenient but false is worse than none.

-

Pricing

+

Pricing

+

Per product. Free is the full product.

- + - - - + + + +
FreeTeamBusiness
FreeTeamBusinessCompliance
The full cache server, MIT-licensed, self-hosted. Forever free.$49/month — access control, metrics UI, email support.$199/month — SSO, HA/replication, analytics, priority support with the CVE-response SLA.The full cache server, MIT-licensed, self-hosted. Every security patch, the + -fips image, and all release evidence, free.$49/month — multi-user access control, SSO (OIDC), per-project usage analytics, + email support (1-business-day target).$199/month — everything in Team, plus HA/replication and priority support with + the CVE-response target.$499/month, billed annually — everything in Business, plus the FIPS 140-3 + applicability statement, signed per-release attestation letters addressed to you, + security-questionnaire support up to 8 hours per year (async), and named-version + LTS. Who this is for.
+

No sales call. No per-seat tax. No enterprise pricing mystery.

+

+ The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA + provenance, signatures, VEX statements, and the FIPS 140-3 validated module + (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier + sells is the authored analysis — a FIPS applicability statement mapping the + validated module boundary onto this product — plus per-release attestation letters + signed by FosterStack LLC, and time on your security questionnaires. FosterStack + Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service + and your organization, never to a component you deploy. It is validated crypto and + publishable evidence for your compliance program. +

- Self-serve, credit card, cancel anytime. Priced so an engineering manager can expense it + Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual + term. Priced so an engineering manager can expense it without a procurement cycle.

Roadmap honesty

Gradle and Maven both run against the same server today; we maintain the cache - server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — the same server restoring node_modules, - ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral CI - agents stop re-downloading the world — is next on the list, npm first. What is - not on the list yet is a Helm chart and the paid tiers below; those are described so you - know where this is going, not sold as available. If you need something sooner, + server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — + the same server restoring node_modules, ~/.m2, and + ~/.gradle/caches by lockfile key, so ephemeral CI agents stop + re-downloading the world — is next on the list, npm first. What is + not on the list yet is a Helm chart and the paid tiers above — Team, Business, and + Compliance are described so you know where this is going, not sold as available; Free + is real and complete today. If you need something sooner, open an issue — that is what moves the roadmap.

@@ -196,7 +219,7 @@

Roadmap honesty

of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not ours.

-

© 2026 FosterStack · github.com/fosterstack/cache · hello@fosterstack.com

+

© 2026 FosterStack · For regulated markets · github.com/fosterstack/cache · hello@fosterstack.com

diff --git a/llms.txt b/llms.txt index 810b0cf..624e4c1 100644 --- a/llms.txt +++ b/llms.txt @@ -58,9 +58,14 @@ Not yet shipped: - Production use beyond the project's own CI. Nobody runs this in a real build pipeline yet except the maintainer. - A Helm chart. Deploying to Kubernetes today means applying plain manifests. -- The paid tiers. Single sign-on, high-availability replication, and the license - key that unlocks them are not built. Everything in the repository is the free - MIT core. +- The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project + analytics, email support), Business ($199/mo: adds HA/replication, priority + support with the CVE-response target), and Compliance ($499/mo billed + annually: adds the FIPS applicability statement, signed per-release + attestation letters, questionnaire hours, named-version LTS) are described, + not yet purchasable; the license key that unlocks them is not built. + Everything in the repository is the free MIT core, including the -fips image + and all release evidence. - A CVE patch commitment that can be relied on. The project aims to ship fixes for dependency CVEs within 48 hours of public disclosure; that is a stated intention, not a contractual promise. diff --git a/regulated/index.html b/regulated/index.html new file mode 100644 index 0000000..a229035 --- /dev/null +++ b/regulated/index.html @@ -0,0 +1,145 @@ + + + + + +FosterStack for teams entering regulated markets + + + + + + + +
+ +
Infrastructure worth keeping.
+
+
+

For teams entering regulated markets

+ +

+ It usually starts with one customer. A contract lands on the table with + federal or compliance requirements attached — FIPS-validated cryptography, + SBOMs, provenance, a security questionnaire with two hundred rows — and + suddenly every tool in your build pipeline needs paperwork it has never + had. Big vendors sell their way through that pile with compliance teams + and six-figure contracts. Small teams mostly just lose the deal. +

+ +

The cost of compliance shouldn't determine who gets to + compete.

+ +

What our piece does — and does not do

+

+ FosterStack Cache is one component in your pipeline: a self-hosted remote + build cache. For that component, we do the evidence work a compliance + program needs: the -fips build links Go's FIPS 140-3 + validated cryptographic module (CMVP certificate #5247), and every + release ships with an SBOM, SLSA provenance, keyless signatures, and + published VEX statements. Our requirements and their evidence are public + in the repository, criterion by criterion. +

+

+ What it does not do: make you compliant. FedRAMP and CMMC attach to your + service and your organization, never to a component you deploy. What a + component can be is evidence and validated crypto for your + program — one row of that questionnaire where the answer is written, + signed, and checkable instead of a shrug. +

+ +

The Compliance tier

+

+ The evidence underneath is public and free — SBOMs, SLSA provenance, + signatures, VEX statements, the FIPS 140-3 validated module and its + certificate number — verifiable by anyone, no account, no purchase. What + the Compliance tier sells is the authored work on + top: a FIPS applicability statement mapping the validated module boundary + onto this product, per-release attestation letters addressed to you and + signed by FosterStack LLC, security-questionnaire support up to 8 hours + per year (async), and named-version LTS. +

+ +

Verify everything for free first

+

+ Before spending anything: pull the -fips image (public, no + login), run the signature and provenance verification commands in + RELEASING.md, + read the scan posture in + SECURITY.md + — including what it says is not yet proven — and check the + requirements + matrix that maps every product promise to its evidence. If the free + evidence doesn't hold up under your audit, the paid tier wouldn't either. + That's the test we invite. +

+
+ + + diff --git a/sitemap.xml b/sitemap.xml index 837c21a..8c1e470 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -6,6 +6,10 @@ file and keeps its noindex tag until then. --> + + https://fosterstack.com/regulated/ + 2026-09-11 + https://fosterstack.com/ 2026-08-18