diff --git a/index.html b/index.html
index 4f2b84c..6f75def 100644
--- a/index.html
+++ b/index.html
@@ -164,27 +164,50 @@
What we do not collect
billing a customer requires an email address, and a privacy claim that is convenient
but false is worse than none.
- Pricing
+ Pricing
+ Per product. Free is the full product.
- | Free | Team | Business |
+ | Free | Team | Business | Compliance |
- | The full cache server, MIT-licensed, self-hosted. Forever free. |
- $49/month — access control, metrics UI, email support. |
- $199/month — SSO, HA/replication, analytics, priority support with the CVE-response SLA. |
+ The full cache server, MIT-licensed, self-hosted. Every security patch, the
+ -fips image, and all release evidence, free. |
+ $49/month — multi-user access control, SSO (OIDC), per-project usage analytics,
+ email support (1-business-day target). |
+ $199/month — everything in Team, plus HA/replication and priority support with
+ the CVE-response target. |
+ $499/month, billed annually — everything in Business, plus the FIPS 140-3
+ applicability statement, signed per-release attestation letters addressed to you,
+ security-questionnaire support up to 8 hours per year (async), and named-version
+ LTS. Who this is for. |
+ No sales call. No per-seat tax. No enterprise pricing mystery.
+
+ The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA
+ provenance, signatures, VEX statements, and the FIPS 140-3 validated module
+ (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier
+ sells is the authored analysis — a FIPS applicability statement mapping the
+ validated module boundary onto this product — plus per-release attestation letters
+ signed by FosterStack LLC, and time on your security questionnaires. FosterStack
+ Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service
+ and your organization, never to a component you deploy. It is validated crypto and
+ publishable evidence for your compliance program.
+
- Self-serve, credit card, cancel anytime. Priced so an engineering manager can expense it
+ Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual
+ term. Priced so an engineering manager can expense it
without a procurement cycle.
Roadmap honesty
Gradle and Maven both run against the same server today; we maintain the cache
- server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — the same server restoring node_modules,
- ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral CI
- agents stop re-downloading the world — is next on the list, npm first. What is
- not on the list yet is a Helm chart and the paid tiers below; those are described so you
- know where this is going, not sold as available. If you need something sooner,
+ server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache —
+ the same server restoring node_modules, ~/.m2, and
+ ~/.gradle/caches by lockfile key, so ephemeral CI agents stop
+ re-downloading the world — is next on the list, npm first. What is
+ not on the list yet is a Helm chart and the paid tiers above — Team, Business, and
+ Compliance are described so you know where this is going, not sold as available; Free
+ is real and complete today. If you need something sooner,
open an issue — that is what
moves the roadmap.
@@ -196,7 +219,7 @@ Roadmap honesty
of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the
Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not
ours.
- © 2026 FosterStack · github.com/fosterstack/cache · hello@fosterstack.com
+ © 2026 FosterStack · For regulated markets · github.com/fosterstack/cache · hello@fosterstack.com
+
+
+ For teams entering regulated markets
+
+
+ It usually starts with one customer. A contract lands on the table with
+ federal or compliance requirements attached — FIPS-validated cryptography,
+ SBOMs, provenance, a security questionnaire with two hundred rows — and
+ suddenly every tool in your build pipeline needs paperwork it has never
+ had. Big vendors sell their way through that pile with compliance teams
+ and six-figure contracts. Small teams mostly just lose the deal.
+
+
+ The cost of compliance shouldn't determine who gets to
+ compete.
+
+ What our piece does — and does not do
+
+ FosterStack Cache is one component in your pipeline: a self-hosted remote
+ build cache. For that component, we do the evidence work a compliance
+ program needs: the -fips build links Go's FIPS 140-3
+ validated cryptographic module (CMVP certificate #5247), and every
+ release ships with an SBOM, SLSA provenance, keyless signatures, and
+ published VEX statements. Our requirements and their evidence are public
+ in the repository, criterion by criterion.
+
+
+ What it does not do: make you compliant. FedRAMP and CMMC attach to your
+ service and your organization, never to a component you deploy. What a
+ component can be is evidence and validated crypto for your
+ program — one row of that questionnaire where the answer is written,
+ signed, and checkable instead of a shrug.
+
+
+ The Compliance tier
+
+ The evidence underneath is public and free — SBOMs, SLSA provenance,
+ signatures, VEX statements, the FIPS 140-3 validated module and its
+ certificate number — verifiable by anyone, no account, no purchase. What
+ the Compliance tier sells is the authored work on
+ top: a FIPS applicability statement mapping the validated module boundary
+ onto this product, per-release attestation letters addressed to you and
+ signed by FosterStack LLC, security-questionnaire support up to 8 hours
+ per year (async), and named-version LTS.
+
+
+ Verify everything for free first
+
+ Before spending anything: pull the -fips image (public, no
+ login), run the signature and provenance verification commands in
+ RELEASING.md,
+ read the scan posture in
+ SECURITY.md
+ — including what it says is not yet proven — and check the
+ requirements
+ matrix that maps every product promise to its evidence. If the free
+ evidence doesn't hold up under your audit, the paid tier wouldn't either.
+ That's the test we invite.
+
+
+
+
diff --git a/llms.txt b/llms.txt
index 810b0cf..624e4c1 100644
--- a/llms.txt
+++ b/llms.txt
@@ -58,9 +58,14 @@ Not yet shipped:
- Production use beyond the project's own CI. Nobody runs this in a real build
pipeline yet except the maintainer.
- A Helm chart. Deploying to Kubernetes today means applying plain manifests.
-- The paid tiers. Single sign-on, high-availability replication, and the license
- key that unlocks them are not built. Everything in the repository is the free
- MIT core.
+- The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project
+ analytics, email support), Business ($199/mo: adds HA/replication, priority
+ support with the CVE-response target), and Compliance ($499/mo billed
+ annually: adds the FIPS applicability statement, signed per-release
+ attestation letters, questionnaire hours, named-version LTS) are described,
+ not yet purchasable; the license key that unlocks them is not built.
+ Everything in the repository is the free MIT core, including the -fips image
+ and all release evidence.
- A CVE patch commitment that can be relied on. The project aims to ship fixes for
dependency CVEs within 48 hours of public disclosure; that is a stated intention,
not a contractual promise.
diff --git a/regulated/index.html b/regulated/index.html
new file mode 100644
index 0000000..a229035
--- /dev/null
+++ b/regulated/index.html
@@ -0,0 +1,145 @@
+
+
+