Compliance copy: monthly attestation letter

index.html

@@ -178,7 +178,7 @@ <h2>What we do not collect</h2>
 
   <h2 id="pricing">Pricing</h2>
   <p>Per product. Free is the full product.</p>
-  <p>Paid tiers are described here, not sold: checkout is not open, and SSO, multi-user access control, usage analytics, HA/replication and named-version LTS are not built.</p>
+  <p>Paid tiers are coming; checkout isn't open yet.</p>
   <div class="table-scroll" role="region" aria-label="Scrollable table" tabindex="0"><table>
     <tr><th>Free</th><th>Team</th><th>Business</th><th>Compliance</th></tr>
     <tr>
@@ -189,9 +189,9 @@ <h2 id="pricing">Pricing</h2>
       <td>$199/month — everything in Team, plus HA/replication and priority support with
       the CVE-response target.</td>
       <td>$499/month, billed annually — everything in Business, plus the FIPS 140-3
-      applicability statement, signed per-release attestation letters addressed to you,
-      security-questionnaire support up to 8 hours per year (async), and named-version
-      LTS. <a href="/regulated/">Who this is for.</a></td>
+      applicability statement, a signed monthly attestation letter addressed to you, covering every release that month,
+      and security-questionnaire support up to 8 hours per year (async).
+      <a href="/regulated/">Who this is for.</a></td>
     </tr>
   </table></div>
   <p><strong>No sales call. No per-seat tax. No enterprise pricing mystery.</strong></p>
@@ -200,8 +200,8 @@ <h2 id="pricing">Pricing</h2>
     provenance, signatures, VEX statements, and the FIPS 140-3 validated module
     (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier
     describes is the authored analysis — a FIPS applicability statement mapping the
-    validated module boundary onto this product — plus per-release attestation letters
-    signed by FosterStack LLC, and time on your security questionnaires. FosterStack
+    validated module boundary onto this product — plus a monthly attestation letter
+    covering every release, signed by FosterStack LLC, and time on your security questionnaires. FosterStack
     Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service
     and your organization, never to a component you deploy. It is validated crypto and
     publishable evidence <em>for</em> your compliance program.

llms.txt

@@ -110,8 +110,8 @@ Not yet shipped:
 - The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project
   analytics, email support), Business ($199/mo: adds HA/replication, priority
   support with the CVE-response target), and Compliance ($499/mo billed
-  annually: adds the FIPS applicability statement, signed per-release
-  attestation letters, questionnaire hours, named-version LTS) are described,
+  annually: adds the FIPS applicability statement, a monthly
+  attestation letter covering every release, questionnaire hours) are described,
   not yet purchasable; the license key that unlocks them is not built.
   Everything in the repository is the free MIT core, including the -fips image
   and all release evidence.