Secrets management · Comparison

AWS Secrets Manager vs Doppler vs HCP Vault Dedicated

3 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.

Side by side

AWS Secrets Manager vs Doppler vs HCP Vault Dedicated: value, access facts, plan limits and bottom lines
Metric	AWS Secrets Manager	Doppler	HCP Vault Dedicated
What you're paying for	Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail.	Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free.	Saves engineering timeVault run for you by HashiCorp: dynamic credentials, rotation and fine-grained policies on a single-tenant cluster you do not operate.
Overall score	7.0	7.3Best	5.2
Free option	Free trial	Free plan	Free trial
Card to start	–Not measured	No card needed	No card needed
Getting access	Self-serve	Self-serve	Self-serve
Starter priceCheapest paid plan	$0.40/secret/mo	$21/user/mo	$0.62/cluster-hour
Pricing model	Usage-based	Per seat	Usage-based
Pricing page	Public prices	Public prices	Public prices
Billing unit	Per secret per month and per 10,000 API calls	Per human user per month; no secret, API or usage fees	Per cluster-hour by tier and size, plus per client per month
Free option	No free tier of its own; up to $200 of AWS Free Tier credit for new accounts	Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card	No free tier; $500 of trial credit for 6 months, no card
Machine identities	IAM roles and users, not billed	Free; service accounts from Team	Billed as clients, like people, at $72.92 a month
Audit log retention	CloudTrail event history, 90 days; trails to S3 for longer	3 days on Developer, 90 days on Team, custom on Enterprise	30 days for download from Essentials; none on Development
Dynamic secrets	Not offered	Enterprise (AWS IAM, Azure Service Principal)	Every tier
Database rotation	Managed rotation for RDS, Aurora, DocumentDB and Redshift	Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise	Every tier (database static roles)
Kubernetes	Secrets Store CSI provider (ASCP), EKS add-on	Doppler Kubernetes Operator and External Secrets provider, all plans	Vault Secrets Operator and CSI provider
SAML SSO / SCIM	IAM Identity Center, no extra charge	SAML on Team; SCIM on Enterprise	HCP SAML or OIDC SSO and SCIM, no plan gate stated
SOC 2 / ISO 27001	SOC 1, 2, 3; ISO 27001, 27017, 27018	SOC 2 Type II; ISO 27001	Restricted-use SOC 2 report, type not stated; ISO 27001 and 27017
HIPAA BAA	HIPAA-eligible under a BAA with AWS	Not described	Not supported
EU data storage	Any EU region you choose	No EU region; GCP us-central1	EU regions on AWS and Azure; snapshots in the US
Self-hosting	Not offered	Doppler On-prem, Enterprise only	Vault Community (BSL 1.1); Vault Enterprise through sales
Secret export	One secret, or up to 20 per batch call	CLI and API download as JSON, .env or YAML	Per path via CLI or API; no bulk export
Bottom line	From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS.	From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only.	From its public pages, HCP Vault Dedicated puts the most secret-lifecycle features on its entry production tier, with SSO, SCIM and audit streaming self-serve. At $2,245.73 a month it costs the most for our scenario, and it offers no HIPAA BAA or customer-managed keys.

Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; HCP Vault Dedicated: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.

When to pick each

In the words of each review, with the date its facts were checked.

From our AWS Secrets Manager review
Checked Oct 16, 2026
Pick AWS Secrets Manager when
You want AWS’s compliance programs and KMS keys at $85 a month for the scenario.
Pick Doppler when
You want push syncs to GitHub Actions, Vercel and other clouds, and environments for every project in one UI.
From our Doppler review
Checked Oct 16, 2026
Pick Doppler when
You want one place for secrets across clouds and hosting, synced to GitHub Actions, Vercel and others.
Pick AWS Secrets Manager when
Your workloads run on AWS and you want $85 a month for the scenario, a HIPAA BAA and customer-managed KMS keys.
From our Doppler review
Checked Oct 16, 2026
Pick Doppler when
You want a seat-priced service at $210 a month for the scenario rather than a cluster billed by the hour.
Pick HCP Vault Dedicated when
You need dynamic database credentials, Vault policies and SCIM without an Enterprise contract.
From our HCP Vault Dedicated review
Checked Oct 16, 2026
Pick HCP Vault Dedicated when
You need dynamic credentials, Vault policies and SCIM without an Enterprise contract.
Pick Doppler when
You want seat pricing at $210 a month for the scenario, free machine identities and syncs on the same plan.
From our HCP Vault Dedicated review
Checked Oct 16, 2026
Pick HCP Vault Dedicated when
You need dynamic secrets and one Vault across several clouds.
Pick AWS Secrets Manager when
Your apps run on AWS and you want $85 a month for the scenario, a HIPAA BAA and customer-managed KMS keys.

Entry price

Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.

AWS Secrets Manager
Pay as you go
$0.40/secret/mo
Plus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
Doppler
Team
$21/user/mo
Billed per seat per month, prorated; 14-day trial, no card; machine identities free
- SAML SSO and role-based access per project and environment
- Automatic secret rotation and 100 config syncs
- 90 days of activity logs
- Add-ons at $9/seat/mo: custom roles, user groups, 500 syncs
HCP Vault Dedicated
Development
$0.62/cluster-hour
Extra Small, single node; $0.61644 on IBM’s list; up to 25 clients, no per-client fee
- Dynamic and auto-rotating secrets
- No audit logging or secrets sync
- For exploring features in a limited environment

Prices as listed on each pricing page, in USD per month, excluding tax. Observed: AWS Secrets Manager 2026-10-16, Doppler 2026-10-16, HCP Vault Dedicated 2026-10-16.

Which one fits

If you need to start today without a sales call: DopplerSelf-serve sign-up, no card needed; the highest score of the 3 self-serve products here (7.3/10).
If you want to try it without entering a card: DopplerFree plan, no card needed; scored 7.3/10.
Lowest starter price: AWS Secrets Manager$0.40/secret/mo for the Pay as you go (plus $0.05 per 10,000 API calls) plan. HCP Vault Dedicated lists no comparable paid price.
Highest overall score: Doppler7.3/10 (Good). The review shows the score breakdown and the run behind it.

Picked by fixed rules from the table above, not by hand. How we score

Full reviews

Add a product

Search by product name or by what it does, such as “email” or “feature flags”. 1 more fits in this comparison.