DRAFT-HOLD: launch copy (pricing page, hero tagline, meta/og). Do not merge until launch

index.html

@@ -177,8 +177,7 @@ <h2>What we do not collect</h2>
   but false is worse than none.</p>
 
   <h2 id="pricing">Pricing</h2>
-  <p>Per product. Free is the full product.</p>
-  <p>Paid tiers are described here, not sold: checkout is not open, and SSO, multi-user access control, usage analytics, HA/replication and named-version LTS are not built.</p>
+  <p>Per product. Free is the full product. <a href="/pricing/">Full pricing</a>.</p>
   <div class="table-scroll" role="region" aria-label="Scrollable table" tabindex="0"><table>
     <tr><th>Free</th><th>Team</th><th>Business</th><th>Compliance</th></tr>
     <tr>
@@ -189,19 +188,19 @@ <h2 id="pricing">Pricing</h2>
       <td>$199/month — everything in Team, plus HA/replication and priority support with
       the CVE-response target.</td>
       <td>$499/month, billed annually — everything in Business, plus the FIPS 140-3
-      applicability statement, signed per-release attestation letters addressed to you,
-      security-questionnaire support up to 8 hours per year (async), and named-version
-      LTS. <a href="/regulated/">Who this is for.</a></td>
+      applicability statement, a signed monthly attestation letter addressed to you, covering every release that month,
+      and security-questionnaire support up to 8 hours per year (async).
+      <a href="/regulated/">Who this is for.</a></td>
     </tr>
   </table></div>
   <p><strong>No sales call. No per-seat tax. No enterprise pricing mystery.</strong></p>
   <p style="color:var(--muted); font-size:.95rem">
     The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA
     provenance, signatures, VEX statements, and the FIPS 140-3 validated module
     (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier
-    describes is the authored analysis — a FIPS applicability statement mapping the
-    validated module boundary onto this product — plus per-release attestation letters
-    signed by FosterStack LLC, and time on your security questionnaires. FosterStack
+    sells is the authored analysis — a FIPS applicability statement mapping the
+    validated module boundary onto this product — plus a monthly attestation letter
+    covering every release, signed by FosterStack LLC, and time on your security questionnaires. FosterStack
     Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service
     and your organization, never to a component you deploy. It is validated crypto and
     publishable evidence <em>for</em> your compliance program.

llms.txt

@@ -49,6 +49,7 @@ verifiable against the CI run that produced them.
 - [FIPS 140-3 build cache](https://fosterstack.com/fips-140-3-build-cache/): run the FIPS image and confirm FIPS mode.
 - [Reset a build cache](https://fosterstack.com/reset-gradle-build-cache/): how to empty it.
 - [Changelog](https://fosterstack.com/changelog/): release notes for v0.1.0, v0.2.1 and v0.2.2.
+- [Pricing](https://fosterstack.com/pricing/): what each tier includes; the paid tiers are described, not yet purchasable.
 - [For regulated markets](https://fosterstack.com/regulated/): the FIPS build and the public release evidence.
 - [Build cache size limit, eviction and a full disk](https://fosterstack.com/build-cache-eviction-size-limit/): What a self-hosted build cache does when it reaches its size cap: least-recently-used eviction, real numbers from a 0.2.1 server, and what an oversized entry gets.
 - [Your first 15 minutes with a self-hosted build cache](https://fosterstack.com/first-15-minutes-build-cache/): A checklist from nothing to your first FROM-CACHE with a self-hosted Gradle build cache, with the commands timed on a GitHub-hosted machine, release 0.2.2.
@@ -110,8 +111,8 @@ Not yet shipped:
 - The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project
   analytics, email support), Business ($199/mo: adds HA/replication, priority
   support with the CVE-response target), and Compliance ($499/mo billed
-  annually: adds the FIPS applicability statement, signed per-release
-  attestation letters, questionnaire hours, named-version LTS) are described,
+  annually: adds the FIPS applicability statement, a monthly
+  attestation letter covering every release, questionnaire hours) are described,
   not yet purchasable; the license key that unlocks them is not built.
   Everything in the repository is the free MIT core, including the -fips image
   and all release evidence.

pricing/index.html

@@ -0,0 +1,121 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Pricing: Free, Team, Business and Compliance</title>
+<meta name="description" content="FosterStack Cache pricing. Free is the full product under MIT. Team $49 a month, Business $199 a month, Compliance $499 a month billed annually. Security patches are never withheld from Free.">
+<link rel="canonical" href="https://fosterstack.com/pricing/">
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="icon" href="/favicon.ico" sizes="any">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<style>
+  :root {
+    --bg: #ffffff; --fg: #16181d; --muted: #5b6472; --line: #e4e7ec;
+    --accent: #0d7a5f; --accent-fg: #ffffff; --card: #f6f8f9; --warn-bg: #fff7ed; --warn-line: #fdba74;
+    --mark: #0f4d66;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #101318; --fg: #e8eaf0; --muted: #98a2b3; --line: #262c36;
+      --accent: #2fbf95; --accent-fg: #08110e; --card: #171c23; --warn-bg: #241a10; --warn-line: #7c4a12;
+      --mark: #e8eaf0;
+    }
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body {
+    background: var(--bg); color: var(--fg);
+    font: 16px/1.6 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  main { max-width: 44rem; margin: 0 auto; padding: 0 1.25rem 4rem; }
+  header.site { max-width: 44rem; margin: 0 auto; padding: 1.25rem; display: flex; align-items: baseline; gap: .6rem; }
+  .logo { font-weight: 700; font-size: 1.05rem; letter-spacing: -.01em; }
+  .logo span { color: var(--accent); }
+  .logo .mark { width: 1.2em; height: 1.2em; vertical-align: -.24em; margin-right: .4em; }
+  .tag { color: var(--muted); font-size: .85rem; }
+  .notice {
+    background: var(--warn-bg); border: 1px solid var(--warn-line); border-radius: 8px;
+    padding: .7rem 1rem; font-size: .92rem; margin: 1.5rem 0 2.5rem;
+  }
+  h1 { font-size: 2rem; line-height: 1.2; letter-spacing: -.02em; margin-bottom: 1rem; }
+  .lede { font-size: 1.12rem; color: var(--muted); margin-bottom: 2rem; }
+  h2 { font-size: 1.25rem; margin: 3rem 0 .9rem; letter-spacing: -.01em; }
+  p + p { margin-top: .8rem; }
+  .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: .8rem; margin-top: 1rem; }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 1rem 1.1rem; }
+  .card h3 { font-size: .98rem; margin-bottom: .35rem; }
+  .card p { font-size: .9rem; color: var(--muted); }
+  ul.trust { list-style: none; margin-top: .5rem; }
+  ul.trust li { padding: .45rem 0 .45rem 1.6rem; position: relative; }
+  ul.trust li::before { content: "✓"; position: absolute; left: .2rem; color: var(--accent); font-weight: 700; }
+  code, pre { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: .88em; }
+  code { background: var(--card); border: 1px solid var(--line); border-radius: 5px; padding: .1em .35em; }
+  pre code { background: none; border: 0; padding: 0; color: inherit; font-size: 1em; }
+  button {
+    padding: .7rem 1.3rem; font-size: 1rem; font-weight: 600; cursor: pointer;
+    background: var(--accent); color: var(--accent-fg); border: 0; border-radius: 8px;
+  }
+  button:disabled { opacity: .6; cursor: default; }
+  table { width: 100%; border-collapse: collapse; font-size: .92rem; margin-top: 1rem; }
+  th, td { text-align: left; padding: .55rem .6rem; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { font-size: .8rem; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
+  pre { background: #0f172a; color: #e2e8f0; padding: .9rem 1rem; border-radius: 8px;
+        overflow-x: auto; font-size: .9rem; line-height: 1.5; }
+  .cta-row { display: flex; gap: .6rem; flex-wrap: wrap; margin-top: 1.1rem; }
+  .btn { display: inline-block; padding: .55rem 1rem; border-radius: 8px; font-weight: 600;
+         text-decoration: none; background: var(--accent); color: #fff; }
+  .btn-secondary { background: transparent; color: inherit; border: 1px solid #cbd5e1; }
+  .muted-note { color: var(--muted); font-size: .93rem; margin-top: 1.1rem; }
+  footer { border-top: 1px solid var(--line); margin-top: 4rem; padding: 1.5rem 1.25rem 3rem; }
+  footer div { max-width: 44rem; margin: 0 auto; color: var(--muted); font-size: .82rem; }
+  a { color: var(--accent); }
+</style>
+</head>
+<body>
+<header class="site">
+  <div class="logo"><svg class="mark" viewBox="0 0 96 96" aria-hidden="true" focusable="false"><rect x="12" y="14" width="72" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="39" width="48" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="64" width="26" height="18" rx="5" fill="var(--accent)"/></svg>foster<span>stack</span></div>
+  <div class="tag">Infrastructure worth keeping — and kept patched.</div>
+</header>
+<main>
+  <h1>Pricing: Free, Team, Business and Compliance</h1>
+  <p class="lede">Prices are per product. Free is the full product. Paid tiers add things a team or a company needs, never the security patches.</p>
+
+  <table>
+    <tr><th>Tier</th><th>Price</th><th>What you get</th></tr>
+    <tr><td><strong>Free</strong></td><td>$0, MIT licence</td><td>The full cache server, self-hosted. Public images including the <code>-fips</code> image. Every security patch, never withheld. Basic Auth with a read-write and a read-only login, <code>/metrics</code>, the status page, all docs, and all public release evidence. Support through GitHub issues, best effort.</td></tr>
+    <tr><td><strong>Team</strong></td><td>$49 a month, or $490 a year</td><td>A licence key that adds multi-user access control, SSO (OIDC), per-project usage analytics, and email support with a one-business-day target.</td></tr>
+    <tr><td><strong>Business</strong></td><td>$199 a month, or $1,990 a year</td><td>Everything in Team, plus HA and replication across nodes, and priority support with the 24 to 48 hour CVE-response target.</td></tr>
+    <tr><td><strong>Compliance</strong></td><td>$499 a month, billed annually ($5,988 a year)</td><td>Everything in Business, plus a FIPS applicability statement, a monthly attestation letter covering every release that month, signed by FosterStack LLC and addressed to you, and security-questionnaire support up to 8 hours a year (async, with a 10-business-day turnaround).</td></tr>
+  </table>
+
+  <h2>What stays free</h2>
+  <p>Security patches are never withheld from the free tier. The security evidence underneath is public and free too: SBOMs, build provenance, signatures, vulnerability statements and the FIPS module certificate number. Anyone can check it with no account and no purchase.</p>
+
+  <h2>What Compliance sells</h2>
+  <p>Not access to files or evidence, which are free. It sells the written analysis that maps the validated crypto module onto this product, the letters signed by us, and our time on your questionnaires. FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organisation, never to a component you deploy. This is validated crypto and publishable evidence <em>for</em> your compliance program. See <a href="/regulated/">who this is for</a>.</p>
+
+  <h2>How billing works</h2>
+  <p>Self-serve, by credit card, with no sales call and no per-seat charge. Team and Business can be cancelled any time. Compliance is an annual term. Existing customers keep their price if prices rise.</p>
+
+  <h2>Support, in plain words</h2>
+  <p>The CVE-response target is a target, not a contractual penalty clause.</p>
+
+  <div class="cta-row">
+    <a class="btn" href="https://github.com/fosterstack/cache">Start free on GitHub</a>
+    <a class="btn btn-secondary" href="/">FosterStack home</a>
+  </div>
+</main>
+<footer>
+  <div>
+    <p>FosterStack is not affiliated with, endorsed by, or sponsored by Gradle Inc.
+    "Gradle" and "Develocity" are trademarks of Gradle Inc., used here only to identify
+    compatibility. FosterStack contains no Gradle Inc. code; it is a clean-room implementation
+    of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the
+    Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not
+    ours.</p>
+    <p style="margin-top:.6rem">© 2026 FosterStack · <a href="/regulated/">For regulated markets</a> · <a href="https://github.com/fosterstack/cache">github.com/fosterstack/cache</a> · <a href="mailto:hello@fosterstack.com">hello@fosterstack.com</a></p>
+  </div>
+</footer>
+</body>
+</html>

regulated/index.html

@@ -129,9 +129,14 @@ <h2>More than kept patched.</h2>
   <p><a href="/how-we-build/">How we build</a> · <a href="/security/">Security policy</a> · <a href="/verify-a-release/">Verify a release</a></p>
 
   <p>
-    The evidence underneath is public: SBOMs, build provenance, signatures,
-    VEX statements, and the FIPS 140-3 validated module and its certificate
-    number. Anyone can verify it, with no account.
+    The evidence underneath is public and free — SBOMs, SLSA provenance,
+    signatures, VEX statements, the FIPS 140-3 validated module and its
+    certificate number — verifiable by anyone, no account, no purchase. What
+    the <a href="/#pricing">Compliance tier</a> sells is the authored work on
+    top: a FIPS applicability statement mapping the validated module boundary
+    onto this product, a monthly attestation letter covering every release, signed by FosterStack LLC
+    and addressed to you, and security-questionnaire support up to 8 hours
+    per year (async).
   </p>
 
   <h2>Verify everything yourself first</h2>

sitemap.xml

@@ -7,6 +7,10 @@
     <changefreq>weekly</changefreq>
     <priority>1.0</priority>
   </url>
+  <url>
+    <loc>https://fosterstack.com/pricing/</loc>
+    <lastmod>2026-10-08</lastmod>
+  </url>
   <url>
     <loc>https://fosterstack.com/air-gapped-build-cache-install/</loc>
     <lastmod>2026-10-08</lastmod>