diff --git a/index.html b/index.html index 9869a9e..f40dc80 100644 --- a/index.html +++ b/index.html @@ -177,8 +177,7 @@

What we do not collect

but false is worse than none.

Pricing

-

Per product. Free is the full product.

-

Paid tiers are described here, not sold: checkout is not open, and SSO, multi-user access control, usage analytics, HA/replication and named-version LTS are not built.

+

Per product. Free is the full product. Full pricing.

@@ -189,9 +188,9 @@

Pricing

+ applicability statement, a signed monthly attestation letter addressed to you, covering every release that month, + and security-questionnaire support up to 8 hours per year (async). + Who this is for.
FreeTeamBusinessCompliance
$199/month — everything in Team, plus HA/replication and priority support with the CVE-response target. $499/month, billed annually — everything in Business, plus the FIPS 140-3 - applicability statement, signed per-release attestation letters addressed to you, - security-questionnaire support up to 8 hours per year (async), and named-version - LTS. Who this is for.

No sales call. No per-seat tax. No enterprise pricing mystery.

@@ -199,9 +198,9 @@

Pricing

The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA provenance, signatures, VEX statements, and the FIPS 140-3 validated module (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier - describes is the authored analysis — a FIPS applicability statement mapping the - validated module boundary onto this product — plus per-release attestation letters - signed by FosterStack LLC, and time on your security questionnaires. FosterStack + sells is the authored analysis — a FIPS applicability statement mapping the + validated module boundary onto this product — plus a monthly attestation letter + covering every release, signed by FosterStack LLC, and time on your security questionnaires. FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service and your organization, never to a component you deploy. It is validated crypto and publishable evidence for your compliance program. diff --git a/llms.txt b/llms.txt index ef2fe97..d03ab80 100644 --- a/llms.txt +++ b/llms.txt @@ -49,6 +49,7 @@ verifiable against the CI run that produced them. - [FIPS 140-3 build cache](https://fosterstack.com/fips-140-3-build-cache/): run the FIPS image and confirm FIPS mode. - [Reset a build cache](https://fosterstack.com/reset-gradle-build-cache/): how to empty it. - [Changelog](https://fosterstack.com/changelog/): release notes for v0.1.0, v0.2.1 and v0.2.2. +- [Pricing](https://fosterstack.com/pricing/): what each tier includes; the paid tiers are described, not yet purchasable. - [For regulated markets](https://fosterstack.com/regulated/): the FIPS build and the public release evidence. - [Build cache size limit, eviction and a full disk](https://fosterstack.com/build-cache-eviction-size-limit/): What a self-hosted build cache does when it reaches its size cap: least-recently-used eviction, real numbers from a 0.2.1 server, and what an oversized entry gets. - [Your first 15 minutes with a self-hosted build cache](https://fosterstack.com/first-15-minutes-build-cache/): A checklist from nothing to your first FROM-CACHE with a self-hosted Gradle build cache, with the commands timed on a GitHub-hosted machine, release 0.2.2. @@ -110,8 +111,8 @@ Not yet shipped: - The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project analytics, email support), Business ($199/mo: adds HA/replication, priority support with the CVE-response target), and Compliance ($499/mo billed - annually: adds the FIPS applicability statement, signed per-release - attestation letters, questionnaire hours, named-version LTS) are described, + annually: adds the FIPS applicability statement, a monthly + attestation letter covering every release, questionnaire hours) are described, not yet purchasable; the license key that unlocks them is not built. Everything in the repository is the free MIT core, including the -fips image and all release evidence. diff --git a/pricing/index.html b/pricing/index.html new file mode 100644 index 0000000..6e71762 --- /dev/null +++ b/pricing/index.html @@ -0,0 +1,121 @@ + + + + + +Pricing: Free, Team, Business and Compliance + + + + + + + + +
+ +
Infrastructure worth keeping — and kept patched.
+
+
+

Pricing: Free, Team, Business and Compliance

+

Prices are per product. Free is the full product. Paid tiers add things a team or a company needs, never the security patches.

+ + + + + + + +
TierPriceWhat you get
Free$0, MIT licenceThe full cache server, self-hosted. Public images including the -fips image. Every security patch, never withheld. Basic Auth with a read-write and a read-only login, /metrics, the status page, all docs, and all public release evidence. Support through GitHub issues, best effort.
Team$49 a month, or $490 a yearA licence key that adds multi-user access control, SSO (OIDC), per-project usage analytics, and email support with a one-business-day target.
Business$199 a month, or $1,990 a yearEverything in Team, plus HA and replication across nodes, and priority support with the 24 to 48 hour CVE-response target.
Compliance$499 a month, billed annually ($5,988 a year)Everything in Business, plus a FIPS applicability statement, a monthly attestation letter covering every release that month, signed by FosterStack LLC and addressed to you, and security-questionnaire support up to 8 hours a year (async, with a 10-business-day turnaround).
+ +

What stays free

+

Security patches are never withheld from the free tier. The security evidence underneath is public and free too: SBOMs, build provenance, signatures, vulnerability statements and the FIPS module certificate number. Anyone can check it with no account and no purchase.

+ +

What Compliance sells

+

Not access to files or evidence, which are free. It sells the written analysis that maps the validated crypto module onto this product, the letters signed by us, and our time on your questionnaires. FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organisation, never to a component you deploy. This is validated crypto and publishable evidence for your compliance program. See who this is for.

+ +

How billing works

+

Self-serve, by credit card, with no sales call and no per-seat charge. Team and Business can be cancelled any time. Compliance is an annual term. Existing customers keep their price if prices rise.

+ +

Support, in plain words

+

The CVE-response target is a target, not a contractual penalty clause.

+ +
+ Start free on GitHub + FosterStack home +
+
+ + + diff --git a/regulated/index.html b/regulated/index.html index 5518bfd..1e4a3f0 100644 --- a/regulated/index.html +++ b/regulated/index.html @@ -129,9 +129,14 @@

More than kept patched.

How we build · Security policy · Verify a release

- The evidence underneath is public: SBOMs, build provenance, signatures, - VEX statements, and the FIPS 140-3 validated module and its certificate - number. Anyone can verify it, with no account. + The evidence underneath is public and free — SBOMs, SLSA provenance, + signatures, VEX statements, the FIPS 140-3 validated module and its + certificate number — verifiable by anyone, no account, no purchase. What + the Compliance tier sells is the authored work on + top: a FIPS applicability statement mapping the validated module boundary + onto this product, a monthly attestation letter covering every release, signed by FosterStack LLC + and addressed to you, and security-questionnaire support up to 8 hours + per year (async).

Verify everything yourself first

diff --git a/sitemap.xml b/sitemap.xml index 3d5cc56..c409864 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -7,6 +7,10 @@ weekly 1.0 + + https://fosterstack.com/pricing/ + 2026-10-08 + https://fosterstack.com/air-gapped-build-cache-install/ 2026-10-08