Secrets management · Comparison
Doppler vs Infisical vs HCP Vault Dedicated: Doppler leads at 7.3; the scenario costs $210 to $2,245.73 a month
We read the pricing, trust, legal and documentation pages of three secrets managers on the same day and scored them on the same six indicators. What 10 engineers and 5 machine identities cost, where rotation, dynamic secrets, SSO and SCIM sit, and who should pick which.
On this page9 sections
On six indicators read from each vendor's public pages, Doppler scores 7.3 out of 10, Infisical 6.8 and HCP Vault Dedicated 5.2. For our reference scenario, 10 engineers and 5 machine identities managing 200 secrets across 3 environments, with 1,000,000 reads a month and a 30-day audit log, Doppler Team comes to $210 a month, Infisical Pro to $300 and HCP Vault Dedicated Essentials to $2,245.73. Doppler stands out for free machine identities and a free plan with integrations; Infisical for rotation and dynamic secrets on self-serve plans, an EU region and an MIT core to self-host; HCP Vault Dedicated for dynamic secrets, SCIM and audit streaming on its entry production tier.
Doppler and Infisical are in the Good band, HCP Vault Dedicated in the Fair band. The scores measure what the public pages commit to, not how well each product works in practice, and we did not sign up for any of them.
At a glance
| Doppler | Infisical | HCP Vault Dedicated | |
|---|---|---|---|
| What you pay for | One secrets source synced to CI and hosting, billed per engineer | An open-source secrets platform, in the cloud or self-hosted | Managed single-tenant Vault clusters |
| Billing unit | Per human user; machine identities free | Per identity, human or machine | Per cluster-hour plus per client |
| Free option | Developer: 3 users free; 14-day Team trial, no card | Free: 5 identities; 30-day trial, no card | $500 of trial credit for 6 months, no card |
| Reference scenario (monthly) | $210 on Team, computed | $300 on Pro (annual), computed | $2,245.73 on Essentials Small, computed |
| Audit log on that plan | 90 days | 30 days | 30 days, plus streaming |
| Dynamic secrets | Enterprise | Advanced ($40 per identity) | Every tier |
| SAML SSO / SCIM | Team / Enterprise | Pro / Enterprise | No plan gate stated for either |
| HIPAA BAA | Not described | By agreement, plan not stated | Not supported |
| EU data storage | No EU region | EU cloud region | EU cluster regions; snapshots in the US |
| Self-hosting | Doppler On-prem, Enterprise | MIT-licensed core, free | Vault Community (BSL 1.1), free |
| Score (public pages) | 7.3 Good | 6.8 Good | 5.2 Fair |
What the public pages show
Doppler bills only human users and says machine identities are free, with no per-secret or API fees. Developer is free for 3 users ($8 for each additional user up to 25) with 5 config syncs and 3 days of activity logs. Team, at $21 per user a month, adds SAML SSO, automatic rotation, access per environment and 90 days of logs. Dynamic secrets, SCIM, SIEM forwarding, customer-managed keys and Doppler On-prem are Enterprise features. The cloud runs in GCP us-central1.
Infisical bills per identity, any human or machine that authenticates. Free covers 5 identities with 10 syncs and no audit log. Pro, at $20 per identity a month billed annually ($23 monthly), adds SAML SSO, point-in-time recovery, rotation for public databases and 30 days of audit logs; Advanced, at $40, adds dynamic secrets, full rotation and 90 days of logs. The core is MIT-licensed, and the cloud has US and EU regions.
HCP Vault Dedicated bills a cluster-hour fee plus $72.92 a month for each client, anything that authenticates. Every tier has dynamic and auto-rotating secrets and Vault's path-based policies; Essentials adds audit logs, streaming and high availability, and Standard adds push secrets sync and replication. SAML SSO and SCIM are set up at the HCP organization with no plan gate stated. The managed service supports no HIPAA BAA or customer-managed keys.
Strengths and things to know
Doppler. Strengths: machine identities and secrets are not billed; a free plan with 3 users and integrations; SAML SSO and 90-day logs on Team; syncs to GitHub Actions, Vercel and cloud secret stores. Things to know: dynamic secrets, SCIM and SIEM forwarding are on Enterprise; no EU region for the cloud service; no HIPAA BAA described; prices are monthly only.
Infisical. Strengths: an MIT core you can self-host; rotation for many databases and APIs; dynamic secrets on a self-serve plan; an EU cloud region. Things to know: every identity is billed, machines included; audit logs start on Pro with 30 days; SCIM and SIEM streaming are on Enterprise; the pricing page and docs place custom roles and gateways on different plans.
HCP Vault Dedicated. Strengths: dynamic secrets and rotation on every tier; SSO, SCIM and audit streaming without a sales contract; Vault policies and namespaces; a free self-managed edition. Things to know: cluster-hours and per-client fees make it the most expensive here for a small team; push syncs are on Standard and bill each synced secret as a client; secrets export per path; no HIPAA BAA or customer-managed keys.
Pricing reality
Reference scenario: 10 engineers (human users) and 5 machine identities (a CI pipeline and production services) managing 200 secrets across 3 environments, with 1,000,000 secret reads a month and an audit log kept at least 30 days, on the cheapest self-serve, production-supported plan that covers all of it, billed annually where a self-serve annual price exists, else month to month or pay as you go, at US list prices before tax.
| Service | Plan | Monthly cost | Where the number comes from |
|---|---|---|---|
| Doppler | Team | $210 | Computed: 10 users × $21; machine identities free; Developer keeps only 3 days of logs |
| Infisical | Pro | $300 | Computed: 15 identities × $20 billed annually; $345 month to month |
| HCP Vault Dedicated | Essentials Small | $2,245.73 | Computed: 730 cluster-hours × $1.57799 + 15 clients × $72.92 (IBM list) |
The billing unit decides who pays most as a team grows. More machines cost nothing extra on Doppler, $20 each on Infisical Pro and $72.92 each on HCP Vault Dedicated, while more secrets cost nothing extra on any of the three, except that each secret synced by HCP Vault Dedicated's Standard tier counts as a client. Infisical's docs let machines with identical permissions share one identity, which lowers its count. For dynamic secrets, Infisical needs Advanced ($600 a month for 15 identities, computed), Doppler needs an Enterprise contract, and HCP Vault Dedicated includes them at the price above.
How we scored them
Every product in this category is scored on the same six indicators, read from the vendor's own pricing, trust, legal and documentation pages, with fixed formulas. The overall score is the plain mean. Our methodology page explains how these scores work.
| Indicator | Doppler | Infisical | HCP Vault Dedicated |
|---|---|---|---|
| Pricing clarity | 7 | 6 | 5 |
| Free tier and trial | 10 | 8.5 | 4 |
| Price for the reference scenario | 4.7 | 4 | 0.5 |
| Secret lifecycle and delivery | 8.6 | 9.2 | 10 |
| Compliance and trust | 5.5 | 5.6 | 3.5 |
| Access control and exit | 8.3 | 7.5 | 8.3 |
| Overall | 7.3 | 6.8 | 5.2 |
Pricing clarity loses a point for each price a page leaves out or each pair of pages that disagree: three for Doppler, four for Infisical and five for HCP Vault Dedicated. HCP Vault Dedicated's lead on secret lifecycle comes from dynamic secrets and rotation on its entry production tier; its price and compliance items pull it down. Doppler's lead over Infisical comes from its free plan, fewer pricing gaps, 90-day logs on the scenario plan and a lower scenario cost; Infisical gains on lifecycle features, and on compliance its EU region roughly offsets Doppler's ISO 27001.
Also in this category
Google Secret Manager scores 8.5: a permanent free tier, $14.61 a month for our scenario (computed) and Google Cloud's compliance coverage, while rotation is mostly notifications for your own code and there are no dynamic secrets or push syncs. AWS Secrets Manager scores 7.0: $85 a month for our scenario (computed), managed RDS rotation and broad compliance coverage, with no free tier of its own and no dynamic secrets.
Who should choose which
- Choose Doppler if you have more machines than people and want them free, with syncs to CI and hosting and SAML SSO on one self-serve plan. Look elsewhere if you need an EU region, dynamic secrets without Enterprise, or a HIPAA BAA.
- Choose Infisical if you want an MIT core you can self-host, an EU cloud region, or rotation and dynamic secrets on self-serve plans. Look elsewhere if you have many machine identities that cannot share permissions and want them free.
- Choose HCP Vault Dedicated if you already use Vault or need dynamic database and cloud credentials, with SSO, SCIM and audit streaming self-serve. Look elsewhere if a small team's budget is a few hundred dollars a month, or if you need a HIPAA BAA or customer-managed keys.
Bottom line
From public pages alone, Doppler leads these three at 7.3 with the simplest bill: $210 a month for 10 engineers, machines free, SSO and 90-day logs included. Infisical, 6.8, costs $300 a month for the scenario and puts rotation and dynamic secrets on self-serve plans, with an open-source exit. HCP Vault Dedicated, 5.2, has the deepest secret lifecycle on its entry tier, but $2,245.73 a month for the scenario. Count your machine identities before comparing prices: the billing unit matters more than the list price.
How we checked
We read the vendors' pricing pages and plan tables, trust and security pages, legal terms, billing docs and product documentation on Oct 16, 2026. HashiCorp's site answered our requests with a bot check, so its Vault pricing tab was read from the Internet Archive copy of June 6, 2026, and the scenario uses IBM's live US price list. We did not sign up, start a trial or call an API. Facts the pages did not state, such as which Infisical plan carries a HIPAA BAA or the type of HashiCorp's SOC 2 report, are left out rather than guessed. Every figure is on the vendors' pages as of that date or, where marked, computed from them.
