Secrets management · Comparison
Google Secret Manager vs HCP Vault Dedicated
2 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | Google Secret Manager | HCP Vault Dedicated |
|---|---|---|
| What you're paying for | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Saves engineering timeVault run for you by HashiCorp: dynamic credentials, rotation and fine-grained policies on a single-tenant cluster you do not operate. |
| Overall score | 8.5Best | 5.2 |
| Free option | Free plan | Free trial |
| Card to start | –Not measured | No card needed |
| Getting access | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.06/secret version/mo | $0.62/cluster-hour |
| Pricing model | Usage-based | Usage-based |
| Pricing page | Public prices | Public prices |
| Billing unit | Per active secret version per location and per 10,000 access operations | Per cluster-hour by tier and size, plus per client per month |
| Free option | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | No free tier; $500 of trial credit for 6 months, no card |
| Machine identities | Service accounts and IAM principals, not billed | Billed as clients, like people, at $72.92 a month |
| Audit log retention | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | 30 days for download from Essentials; none on Development |
| Dynamic secrets | Not offered | Every tier |
| Database rotation | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Every tier (database static roles) |
| Kubernetes | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Vault Secrets Operator and CSI provider |
| SAML SSO / SCIM | Through Cloud Identity Free; Entra ID provisioning guide | HCP SAML or OIDC SSO and SCIM, no plan gate stated |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | Restricted-use SOC 2 report, type not stated; ISO 27001 and 27017 |
| HIPAA BAA | Covered by the Google Cloud BAA, every account | Not supported |
| EU data storage | Regional secrets or user-managed replication in EU locations | EU regions on AWS and Azure; snapshots in the US |
| Self-hosting | Not offered | Vault Community (BSL 1.1); Vault Enterprise through sales |
| Secret export | One version at a time | Per path via CLI or API; no bulk export |
| Bottom line | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, HCP Vault Dedicated puts the most secret-lifecycle features on its entry production tier, with SSO, SCIM and audit streaming self-serve. At $2,245.73 a month it costs the most for our scenario, and it offers no HIPAA BAA or customer-managed keys. |
Evidence: Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; HCP Vault Dedicated: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- Google Secret ManagerPay as you go$0.06/version/moPer active version per location; $0.03 per 10,000 access operations; $0.05 per rotation notification
- Management operations free; destroyed versions free
- Automatic replication billed as one location
- CMEK through Cloud KMS
- Custom quote on request
- HCP Vault DedicatedDevelopment$0.62/cluster-hourExtra Small, single node; $0.61644 on IBM’s list; up to 25 clients, no per-client fee
- Dynamic and auto-rotating secrets
- No audit logging or secrets sync
- For exploring features in a limited environment
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: Google Secret Manager 2026-10-16, HCP Vault Dedicated 2026-10-16.
Which one fits
- If you need to start today without a sales call
- Google Secret ManagerSelf-serve sign-up; the highest score of the 2 self-serve products here (8.5/10).
- If you want to try it without entering a card
- HCP Vault DedicatedFree trial, no card needed; scored 5.2/10.
- Lowest starter price
- Google Secret Manager$0.06/secret version/mo for the Pay as you go (plus $0.03 per 10,000 access operations) plan. HCP Vault Dedicated lists no comparable paid price.
- Highest overall score
- Google Secret Manager8.5/10 (Excellent). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score
Full reviews
More in Secrets management
Add a product
Search by product name or by what it does, such as “email” or “feature flags”. 2 more fit in this comparison.