From d62d612c9459fcd57db2459697d85eafa4d8e63b Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Fri, 11 Sep 2026 15:11:07 -0400 Subject: [PATCH 1/5] Pricing: the Compliance tier lands; four columns, per-product, honest line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Business-model work order §2, authority business-model-and-marketing.md §4/§4a. Free drops 'Forever free' and states what free includes (every patch, the -fips image, all release evidence); Team retires 'metrics UI' (the status page is free) and gains SSO (OIDC), per-project analytics and the 1-business-day email target; Business says 'CVE-response target', never SLA; Compliance is $499/month billed annually with the checklist nouns loud and the Sep 5 honesty line: the evidence underneath is public and free, what is paid is the authored analysis, the vendor signature, and the hours. Never 'FedRAMP compliant'/'CMMC compliant'. 'No sales call. No per-seat tax. No enterprise pricing mystery.' under the table; self-serve sentence updated (monthly tiers cancel anytime; Compliance is an annual term); roadmap-honesty lists all the tiers it describes. llms.txt tier list matches. Stacked on the phase3/www-claims branch — both touch the self-serve paragraph. --- index.html | 46 +++++++++++++++++++++++++++++++++++----------- llms.txt | 11 ++++++++--- 2 files changed, 43 insertions(+), 14 deletions(-) diff --git a/index.html b/index.html index 4f2b84c..44ac966 100644 --- a/index.html +++ b/index.html @@ -165,26 +165,50 @@

What we do not collect

but false is worse than none.

Pricing

+

Per product. Free is the full product.

- + - - - + + + +
FreeTeamBusiness
FreeTeamBusinessCompliance
The full cache server, MIT-licensed, self-hosted. Forever free.$49/month — access control, metrics UI, email support.$199/month — SSO, HA/replication, analytics, priority support with the CVE-response SLA.The full cache server, MIT-licensed, self-hosted. Every security patch, the + -fips image, and all release evidence, free.$49/month — multi-user access control, SSO (OIDC), per-project usage analytics, + email support (1-business-day target).$199/month — everything in Team, plus HA/replication and priority support with + the CVE-response target.$499/month, billed annually — everything in Business, plus the FIPS 140-3 + applicability statement, signed per-release attestation letters addressed to you, + security-questionnaire support up to 8 hours per year (async), and named-version + LTS.
+

No sales call. No per-seat tax. No enterprise pricing mystery.

+

+ The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA + provenance, signatures, VEX statements, and the FIPS 140-3 validated module + (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier + sells is the authored analysis — a FIPS applicability statement mapping the + validated module boundary onto this product — plus per-release attestation letters + signed by FosterStack LLC, and time on your security questionnaires. FosterStack + Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service + and your organization, never to a component you deploy. It is validated crypto and + publishable evidence for your compliance program. +

- Self-serve, credit card, cancel anytime. Priced so an engineering manager can expense it - without a procurement cycle. + Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual + term. Priced so an engineering manager can expense it + without a procurement cycle. (For scale: the incumbent's median platform + contract — Develocity, the full product suite, of which the cache node is one + component — runs about $57k/year. That is not the price of a cache, and we are not + claiming it is; it is the procurement class this pricing deliberately avoids.)

Roadmap honesty

Gradle and Maven both run against the same server today; we maintain the cache - server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — the same server restoring node_modules, - ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral CI - agents stop re-downloading the world — is next on the list, npm first. What is - not on the list yet is a Helm chart and the paid tiers below; those are described so you - know where this is going, not sold as available. If you need something sooner, + server, while the Maven client side is Apache's own Build Cache Extension. An npm remote + cache for CI — same core, a third protocol — is the next protocol on the list. What is + not on the list yet is a Helm chart and the paid tiers above — Team, Business, and + Compliance are described so you know where this is going, not sold as available; Free + is real and complete today. If you need something sooner, open an issue — that is what moves the roadmap.

diff --git a/llms.txt b/llms.txt index 810b0cf..624e4c1 100644 --- a/llms.txt +++ b/llms.txt @@ -58,9 +58,14 @@ Not yet shipped: - Production use beyond the project's own CI. Nobody runs this in a real build pipeline yet except the maintainer. - A Helm chart. Deploying to Kubernetes today means applying plain manifests. -- The paid tiers. Single sign-on, high-availability replication, and the license - key that unlocks them are not built. Everything in the repository is the free - MIT core. +- The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project + analytics, email support), Business ($199/mo: adds HA/replication, priority + support with the CVE-response target), and Compliance ($499/mo billed + annually: adds the FIPS applicability statement, signed per-release + attestation letters, questionnaire hours, named-version LTS) are described, + not yet purchasable; the license key that unlocks them is not built. + Everything in the repository is the free MIT core, including the -fips image + and all release evidence. - A CVE patch commitment that can be relied on. The project aims to ship fixes for dependency CVEs within 48 hours of public disclosure; that is a stated intention, not a contractual promise. From 31c2c705e82afa63b08ca6922a55d0c69aced21c Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Sat, 12 Sep 2026 08:58:19 -0400 Subject: [PATCH 2/5] Roadmap: the Node cache, described as what it is MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner correction (Sep 11, business-model work order): 'an npm remote cache — a third protocol' misled — it read as a package-registry cache or a new wire protocol and it is neither. Replaced with the approved sentence: the same server caching node_modules, test caches, and build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the world on every run. 'Node cache', never 'npm cache', from now on. No timelines. --- index.html | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/index.html b/index.html index 44ac966..a1c48ca 100644 --- a/index.html +++ b/index.html @@ -204,8 +204,10 @@

Pricing

Roadmap honesty

Gradle and Maven both run against the same server today; we maintain the cache - server, while the Maven client side is Apache's own Build Cache Extension. An npm remote - cache for CI — same core, a third protocol — is the next protocol on the list. What is + server, while the Maven client side is Apache's own Build Cache Extension. A Node + cache for CI — the same server caching node_modules, test caches, and + build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the + world on every run — is next on the list. What is not on the list yet is a Helm chart and the paid tiers above — Team, Business, and Compliance are described so you know where this is going, not sold as available; Free is real and complete today. If you need something sooner, From 338e3ec0c7ff367ba8e5b180cec412122de17ed7 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Sat, 12 Sep 2026 10:53:55 -0400 Subject: [PATCH 3/5] Roadmap: the dependency cache, final vocabulary (register row 32) The Sep 12 product definition supersedes the Node-cache wording: the feature is the dependency cache - the same server restoring node_modules, ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral CI agents stop re-downloading the world - npm first. Public vocabulary from now on: 'build cache' (Gradle, Maven) and 'dependency cache' (Gradle, Maven, npm); never 'npm cache', never 'Node cache'. --- index.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/index.html b/index.html index a1c48ca..60d51e8 100644 --- a/index.html +++ b/index.html @@ -204,10 +204,10 @@

Pricing

Roadmap honesty

Gradle and Maven both run against the same server today; we maintain the cache - server, while the Maven client side is Apache's own Build Cache Extension. A Node - cache for CI — the same server caching node_modules, test caches, and - build outputs by lockfile key, so Jenkins and GitLab jobs stop reinstalling the - world on every run — is next on the list. What is + server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — + the same server restoring node_modules, ~/.m2, and + ~/.gradle/caches by lockfile key, so ephemeral CI agents stop + re-downloading the world — is next on the list, npm first. What is not on the list yet is a Helm chart and the paid tiers above — Team, Business, and Compliance are described so you know where this is going, not sold as available; Free is real and complete today. If you need something sooner, From b4d4cb50b6447fa323789c44ede903b9314ab4ac Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Sat, 12 Sep 2026 10:53:55 -0400 Subject: [PATCH 4/5] Pricing: no competitor price, ever (register row 31) The whole $57k parenthetical is deleted, not softened - the owner's hard rule is that no competitor price appears on any customer-visible surface. 'Priced so an engineering manager can expense it without a procurement cycle.' stands on its own. Because this PR's stack rewrites the same paragraph, the older '$57k/year' clause on main is replaced by this text when the stack merges. --- index.html | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/index.html b/index.html index 60d51e8..b85f00d 100644 --- a/index.html +++ b/index.html @@ -196,10 +196,7 @@

Pricing

Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual term. Priced so an engineering manager can expense it - without a procurement cycle. (For scale: the incumbent's median platform - contract — Develocity, the full product suite, of which the cache node is one - component — runs about $57k/year. That is not the price of a cache, and we are not - claiming it is; it is the procurement class this pricing deliberately avoids.) + without a procurement cycle.

Roadmap honesty

From 2288ee17dacbee5920a4c740672507e09928a719 Mon Sep 17 00:00:00 2001 From: fosterstack-admin Date: Sat, 12 Sep 2026 13:01:30 -0400 Subject: [PATCH 5/5] Wedge page: for teams entering regulated markets (#13) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Business-model work order §3, in the ordered shape: the situation (one customer, the pile), the mission sentence - the cost of compliance shouldn't determine who gets to compete - what our piece does and does not do (evidence and validated crypto FOR your program; never makes you compliant), the Compliance tier and its nouns, and verify-everything- free-first ending on the test we invite. No claims beyond what the cache does today; the evidence links point at RELEASING, SECURITY (including its not-yet-proven statements) and the requirements matrix. Linked from the Compliance column and the footer; added to the sitemap. Co-authored-by: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> --- index.html | 6 +- regulated/index.html | 145 +++++++++++++++++++++++++++++++++++++++++++ sitemap.xml | 4 ++ 3 files changed, 152 insertions(+), 3 deletions(-) create mode 100644 regulated/index.html diff --git a/index.html b/index.html index b85f00d..6f75def 100644 --- a/index.html +++ b/index.html @@ -164,7 +164,7 @@

What we do not collect

billing a customer requires an email address, and a privacy claim that is convenient but false is worse than none.

-

Pricing

+

Pricing

Per product. Free is the full product.

@@ -178,7 +178,7 @@

Pricing

+ LTS. Who this is for.
FreeTeamBusinessCompliance
$499/month, billed annually — everything in Business, plus the FIPS 140-3 applicability statement, signed per-release attestation letters addressed to you, security-questionnaire support up to 8 hours per year (async), and named-version - LTS.

No sales call. No per-seat tax. No enterprise pricing mystery.

@@ -219,7 +219,7 @@

Roadmap honesty

of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not ours.

-

© 2026 FosterStack · github.com/fosterstack/cache · hello@fosterstack.com

+

© 2026 FosterStack · For regulated markets · github.com/fosterstack/cache · hello@fosterstack.com

diff --git a/regulated/index.html b/regulated/index.html new file mode 100644 index 0000000..a229035 --- /dev/null +++ b/regulated/index.html @@ -0,0 +1,145 @@ + + + + + +FosterStack for teams entering regulated markets + + + + + + + +
+ +
Infrastructure worth keeping.
+
+
+

For teams entering regulated markets

+ +

+ It usually starts with one customer. A contract lands on the table with + federal or compliance requirements attached — FIPS-validated cryptography, + SBOMs, provenance, a security questionnaire with two hundred rows — and + suddenly every tool in your build pipeline needs paperwork it has never + had. Big vendors sell their way through that pile with compliance teams + and six-figure contracts. Small teams mostly just lose the deal. +

+ +

The cost of compliance shouldn't determine who gets to + compete.

+ +

What our piece does — and does not do

+

+ FosterStack Cache is one component in your pipeline: a self-hosted remote + build cache. For that component, we do the evidence work a compliance + program needs: the -fips build links Go's FIPS 140-3 + validated cryptographic module (CMVP certificate #5247), and every + release ships with an SBOM, SLSA provenance, keyless signatures, and + published VEX statements. Our requirements and their evidence are public + in the repository, criterion by criterion. +

+

+ What it does not do: make you compliant. FedRAMP and CMMC attach to your + service and your organization, never to a component you deploy. What a + component can be is evidence and validated crypto for your + program — one row of that questionnaire where the answer is written, + signed, and checkable instead of a shrug. +

+ +

The Compliance tier

+

+ The evidence underneath is public and free — SBOMs, SLSA provenance, + signatures, VEX statements, the FIPS 140-3 validated module and its + certificate number — verifiable by anyone, no account, no purchase. What + the Compliance tier sells is the authored work on + top: a FIPS applicability statement mapping the validated module boundary + onto this product, per-release attestation letters addressed to you and + signed by FosterStack LLC, security-questionnaire support up to 8 hours + per year (async), and named-version LTS. +

+ +

Verify everything for free first

+

+ Before spending anything: pull the -fips image (public, no + login), run the signature and provenance verification commands in + RELEASING.md, + read the scan posture in + SECURITY.md + — including what it says is not yet proven — and check the + requirements + matrix that maps every product promise to its evidence. If the free + evidence doesn't hold up under your audit, the paid tier wouldn't either. + That's the test we invite. +

+
+ + + diff --git a/sitemap.xml b/sitemap.xml index 837c21a..8c1e470 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -6,6 +6,10 @@ file and keeps its noindex tag until then. --> + + https://fosterstack.com/regulated/ + 2026-09-11 + https://fosterstack.com/ 2026-08-18