Vault vs Doppler vs Infisical: Count Your Machines First
Twelve engineers and forty CI identities run about $252 a month on one of these and about $5,800 on another. The unit printed on the invoice is most of the comparison. The rest is which directory the audit log lives in.
Three vendors, three units. Doppler bills per human seat and says on its own pricing page that “AI agents and non-human identities ride free.” Infisical bills per identity, and its pricing page defines that as “any human or machine that authenticates to Infisical.” HCP Vault Dedicated bills a cluster by the hour, then bills again for every client that authenticated at any point during the month.
Those are not three prices for one product. They are three different questions about your infrastructure, and the answer is a number you already have.
Take a team of twelve engineers with forty machine identities: CI runners, a couple of Kubernetes operators, some background workers, a handful of deploy jobs. Fifty-two things that authenticate. Here is what each vendor charges for exactly that, using prices I pulled on 23 August 2026.
That is a factor of twenty-three between the cheapest and the most expensive way to hold the same secrets for the same team. Before anyone argues about feature depth, it is worth knowing that the spread comes almost entirely from one decision each vendor made about what a billable thing is.
Where those numbers come from
Doppler publishes $21 per user per month on Team, and the Developer plan is free for three users with $8 per month for each one after that. Service accounts appear on Team with no per-unit charge, and the page headline is literally about not charging agent fees. Twelve seats, $252.
Infisical publishes $20 per identity per month billed annually on Pro, $23 monthly. The free tier stops at five identities. Fifty-two identities, $1,040 a year-committed month.
HashiCorp no longer publishes Vault pricing on its own pricing page, which now covers Terraform tiers and sends you to sales for everything else. The numbers still exist in the HashiCorp Flex consumption pricing table, a PDF that lists every unit rate. A small Standard Edition cluster with Silver support is $1.578 per hour in every listed AWS and Azure region, or $1,151.94 over a 730-hour month. Clients are billed monthly on a sliding scale: $112.168 each for the first nine, $86.826 for the next fifteen, $83.599 for the next twenty-five, $80.599 after that. Fifty-two clients works out to $4,643.67, and the total lands at $5,795.61.
Two details in that document are worth more than the rates. A client that authenticates to two clusters counts as two clients. And the same table carries a notice that HCP Vault Secrets, the lightweight SaaS tier, was retired as of 30 June 2026. If you were waiting to evaluate it, that window closed.
Vault: the license line runs through the binary
Vault’s LICENSE file is Business Source License 1.1 with International Business Machines Corporation on the Licensor line. The Additional Use Grant permits production use as long as you are not offering Vault to third parties in competition with IBM’s paid versions, and it says that hosting or using it internally is not a competitive offering. The Change Date is four years from publication and the Change License is MPL 2.0, so each release converts on its own clock. That is the same arrangement Terraform carries, and I wrote about how the four-year clock actually behaves when this came up there.
The license is not what limits you. The edition is. Namespaces, replication, HSM support and seal wrapping, FIPS builds, control group authorization, policy as code, and automated credential rotation are all Vault Enterprise features, and an Enterprise license has to be applied to the cluster before any of them turn on. Self-hosting the community binary is free in the sense that nobody sends you an invoice.
The community binary is not standing still, incidentally. Vault went to 2.0.0 on 14 April 2026 and 2.0.4 on 4 August 2026, and the repository was last pushed two days before I checked. The 2.0 release notes are mostly CVE remediation and one breaking change to a Docker test helper, which is a reassuring thing for a major version bump to be.
Infisical: the license line runs through a directory
Infisical gets described as MIT-licensed, and the top of its LICENSE file is where that comes from. Read the three lines above it. Everything under any ee/ directory is governed by a separate enterprise license, everything else is MIT Expat.
So the question is what is in ee/. On 23 August 2026 the repository has 67 service directories under backend/src/ee/services. The list includes dynamic-secret, audit-log, audit-log-stream, secret-rotation-v2, saml-config, oidc, ldap-config, scim, secret-approval-policy, hsm, kmip, and the whole pam-* family. That is not a fringe of add-ons. It is most of what an auditor asks about.
The enterprise license text itself is stricter than the shape of the repository suggests. It permits copying and modifying for development and testing, and says production use requires a valid subscription for the correct number of seats. Self-hosting those features means setting a LICENSE_KEY environment variable, and the instance has to reach Infisical’s license server to validate it. If you were picking Infisical specifically so that nothing phones home, check that requirement against your network policy before you build on it.
The cloud tiers split along similar lines. Pro at $20 gets you SAML SSO, 30-day audit log retention, and secret rotation for public databases only. Advanced at $40 per identity per month adds dynamic secrets, 90-day retention, and SSO enforcement. Approval workflows, SCIM, LDAP, audit log streaming to a SIEM, KMIP, and external KMS all sit in Enterprise, which is quoted.
Doppler: no license line, because there is no source
Doppler is closed and hosted, so the license question does not arise and neither does the self-hosting escape hatch. Enterprise offers an on-prem deployment; Team does not.
What you get for $21 a seat is a clean per-user model with the machines excluded, 90 days of activity logs, SAML SSO, change requests, role-based access control, and API-based secret rotation. Team caps at 500 users, 500 service tokens, and 250 projects. The free Developer plan keeps three days of activity logs, which is the number I would look at hardest: an incident you notice on Monday about something that happened on Thursday is already outside the window.
Two things sit further up the price than you might expect. Dynamic secrets are Enterprise-only, so the feature Vault has shipped in its free binary for a decade is behind a sales call here. And Team has add-ons at $9 per seat per month each for custom roles, user groups, and higher integration sync limits, which are the sort of thing that quietly turns $21 into $30.
If the license is the actual problem, OpenBao exists
OpenBao is the MPL-2.0 fork of Vault under Linux Foundation governance, and it is alive: v2.6.2 on 18 August 2026, last push 21 August 2026, 7,127 stars against Vault’s 36,154. The star gap tells you about mindshare, not health. The release cadence is the thing to watch, and right now it is fine.
I would not move an existing Vault deployment to it for license reasons alone if you are a normal company running Vault internally, because the BUSL grant already covers that case. The reason to look is if you want features that are Enterprise-gated in Vault and are not gated in OpenBao, or if a customer contract makes you attest to an OSI-approved license on everything you run.
What to count before you sign
Count the non-human authenticators first, not the engineers. That single number moves the bill more than anything else on any of these pricing pages, and it is the number nobody has ready when the evaluation starts. Run the count against your CI configs and your cluster, then multiply it three ways.
Then decide whether you need dynamic secrets at all. If the honest answer is that you want to rotate a few static database passwords on a schedule, that is rotation, not per-request credential issuance, and it is available two tiers cheaper on both SaaS options. If you genuinely need a Postgres credential that exists for ninety seconds and revokes itself, Vault Community does that for free and everyone else charges for it.
The last thing is retention. Every vendor here has a number of days attached to its audit trail, and the cheap tiers are all shorter than the time it takes most teams to notice something. Whatever tier you land on, check that number against how long your last incident took to surface.
Prices and license terms above came off the vendor pricing pages, the HashiCorp Flex consumption table, and the GitHub repositories on 23 August 2026. Every one of these vendors has restructured tiers in the past year, and the Vault numbers in particular now live only in a PDF, which is not a format that suggests stability.