For teams entering regulated markets

It usually starts with one customer. A contract lands on the table with federal or compliance requirements attached — FIPS-validated cryptography, SBOMs, provenance, a security questionnaire with two hundred rows — and suddenly every tool in your build pipeline needs paperwork it has never had. Big vendors sell their way through that pile with compliance teams and six-figure contracts. Small teams mostly just lose the deal.

The cost of compliance shouldn't determine who gets to compete.

What our piece does — and does not do

FosterStack Cache is one component in your pipeline: a self-hosted remote build cache. For that component, we do the evidence work a compliance program needs: the -fips build links Go's FIPS 140-3 validated cryptographic module (CMVP certificate #5247), and every release ships with an SBOM, SLSA provenance, keyless signatures, and published VEX statements. Our requirements and their evidence are public in the repository, criterion by criterion.

What it does not do: make you compliant. FedRAMP and CMMC attach to your service and your organization, never to a component you deploy. What a component can be is evidence and validated crypto for your program — one row of that questionnaire where the answer is written, signed, and checkable instead of a shrug.

The Compliance tier

The evidence underneath is public and free — SBOMs, SLSA provenance, signatures, VEX statements, the FIPS 140-3 validated module and its certificate number — verifiable by anyone, no account, no purchase. What the Compliance tier sells is the authored work on top: a FIPS applicability statement mapping the validated module boundary onto this product, per-release attestation letters addressed to you and signed by FosterStack LLC, security-questionnaire support up to 8 hours per year (async), and named-version LTS.

Verify everything for free first

Before spending anything: pull the -fips image (public, no login), run the signature and provenance verification commands in RELEASING.md, read the scan posture in SECURITY.md — including what it says is not yet proven — and check the requirements matrix that maps every product promise to its evidence. If the free evidence doesn't hold up under your audit, the paid tier wouldn't either. That's the test we invite.