Pricing: Free, Team, Business and Compliance
Prices are per product. Free is the full product. Paid tiers add things a team or a company needs, never the security patches.
| Tier | Price | What you get |
|---|---|---|
| Free | $0, MIT licence | The full cache server, self-hosted. Public images including the -fips image. Every security patch, never withheld. Basic Auth with a read-write and a read-only login, /metrics, the status page, all docs, and all public release evidence. Support through GitHub issues, best effort. |
| Team | $49 a month, or $490 a year | A licence key that adds multi-user access control, SSO (OIDC), per-project usage analytics, and email support with a one-business-day target. |
| Business | $199 a month, or $1,990 a year | Everything in Team, plus HA and replication across nodes, and priority support with the 24 to 48 hour CVE-response target. |
| Compliance | $499 a month, billed annually ($5,988 a year) | Everything in Business, plus a FIPS applicability statement, a monthly attestation letter covering every release that month, signed by FosterStack LLC and addressed to you, and security-questionnaire support up to 8 hours a year (async, with a 10-business-day turnaround). |
What stays free
Security patches are never withheld from the free tier. The security evidence underneath is public and free too: SBOMs, build provenance, signatures, vulnerability statements and the FIPS module certificate number. Anyone can check it with no account and no purchase.
What Compliance sells
Not access to files or evidence, which are free. It sells the written analysis that maps the validated crypto module onto this product, the letters signed by us, and our time on your questionnaires. FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organisation, never to a component you deploy. This is validated crypto and publishable evidence for your compliance program. See who this is for.
How billing works
Self-serve, by credit card, with no sales call and no per-seat charge. Team and Business can be cancelled any time. Compliance is an annual term. Existing customers keep their price if prices rise.
Support, in plain words
The CVE-response target is a target, not a contractual penalty clause.