by Doppler Technologies, Inc.Secrets management
A secrets platform billed per engineer, with machine identities free, syncs to CI and hosting, and SSO with 90-day logs on Team at $21 a user.
One place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free.
Doppler keeps each project’s secrets per environment and delivers them where apps run: the CLI, a Kubernetes operator and syncs to GitHub Actions, Vercel, AWS, GCP and Azure stores. It bills only human users, so CI pipelines and services add no cost, and the free Developer plan covers 3 users. Team, at $21 per user a month, adds SAML SSO, automatic rotation, role-based access per environment and 90 days of activity logs.
Against 3 other products we reviewed in Secrets management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Doppler | Google Secret Manager | AWS Secrets Manager | Infisical |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself. |
| Overall score | 7.3 | 8.5Best | 7.0 | 6.8 |
| Free option | Free plan | Free plan | Free trial | Free plan |
| Card to start | No card needed | –Not measured | –Not measured | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $21/user/mo | $0.06/secret version/mo | $0.40/secret/mo | $20/identity/mo |
| Pricing model | Per seat | Usage-based | Usage-based | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per human user per month; no secret, API or usage fees | Per active secret version per location and per 10,000 access operations | Per secret per month and per 10,000 API calls | Per identity (human or machine) per month |
| Free option | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card |
| Reference scenario (monthly) | $210 on Team (10 × $21), computed | $14.61 (194 × $0.06 + 99 × $0.03), computed | $85 (200 × $0.40 + 100 × $0.05), computed | $300 on Pro (15 × $20, annual), computed |
| Machine identities | Free; service accounts from Team | Service accounts and IAM principals, not billed | IAM roles and users, not billed | Billed like users; machines with identical permissions can share one |
| Audit log retention | 3 days on Developer, 90 days on Team, custom on Enterprise | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | CloudTrail event history, 90 days; trails to S3 for longer | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise |
| Dynamic secrets | Enterprise (AWS IAM, Azure Service Principal) | Not offered | Not offered | Advanced ($40 per identity) |
| Database rotation | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Pro for public databases; full rotation on Advanced |
| Kubernetes | Doppler Kubernetes Operator and External Secrets provider, all plans | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Secrets Store CSI provider (ASCP), EKS add-on | Operator, Agent Injector and CSI provider; External Secrets provider |
| SAML SSO / SCIM | SAML on Team; SCIM on Enterprise | Through Cloud Identity Free; Entra ID provisioning guide | IAM Identity Center, no extra charge | SAML on Pro; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 2 Type II; ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; no ISO 27001 stated |
| HIPAA BAA | Not described | Covered by the Google Cloud BAA, every account | HIPAA-eligible under a BAA with AWS | HIPAA compliance stated; BAA by agreement, plan not stated |
| EU data storage | No EU region; GCP us-central1 | Regional secrets or user-managed replication in EU locations | Any EU region you choose | EU cloud region (eu.infisical.com) |
| Self-hosting | Doppler On-prem, Enterprise only | Not offered | Not offered | MIT-licensed core free; enterprise features need a license |
| Secret export | CLI and API download as JSON, .env or YAML | One version at a time | One secret, or up to 20 per batch call | CLI export as dotenv, CSV, JSON or YAML |
| Bottom line | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise. |
Evidence: Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Doppler's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read Doppler's pricing page with its plan comparison and FAQ, the docs on platform limits, rotation, dynamic secrets, Kubernetes, integrations, versioning, workplace settings, permissions and the security fact sheet, the security page, the terms of service, DPA and sub-processor list on Oct 16, 2026; we did not sign up, start a trial or call the API. The pricing page served the US English site in US dollars.
The model is simple: Doppler charges per human seat per month and says machine identities are free. Developer is free for 3 users ($8 for each additional user up to 25) and keeps 3 days of activity logs. Team is $21 per user a month with SAML SSO, 90 days of activity logs, automatic rotation and access per project and environment. Enterprise is priced by sales. No annual price is shown.
A few points need a question to Doppler. The plan card says Developer is free for 3 users, while the FAQ allows switching back to free only with fewer than 3 seats. The custom roles doc says it can be added to a Team plan, but its requirements list an Enterprise subscription. The pricing page lists unlimited config syncs on Enterprise, while the platform limits doc says 1,000. The pricing page's description says SOC 2 Type II and the security page says SOC 2 certified; no HIPAA BAA is described. The cloud service runs in GCP us-central1.
Doppler bills only human seats; service accounts and machine identities cost nothing on plans that support them, and there are no per-secret or API fees.
vs Infisical: Infisical bills every identity, human or machine, at the same per-identity price.
Developer allows 3 free users, 10 projects, 50 service tokens, 5 config syncs and 3 days of activity logs, with no secret cap beyond 1,200 per config.
Compared: Google Secret Manager’s free tier covers 6 active secret versions a month.
Team includes 100 config syncs to targets such as GitHub Actions, Vercel and AWS Secrets Manager, rotation of GCP Cloud SQL databases and cloud keys through their APIs, and the Kubernetes operator.
Team includes SAML SSO and keeps activity logs for 90 days, with Slack, Teams and Discord notifications.
vs Infisical: Infisical keeps audit logs 30 days on Pro and 90 days on Advanced.
Dynamic secrets (AWS IAM and Azure), SCIM, log forwarding to Splunk, Datadog and Sumo Logic, proxied AWS database rotation and customer-managed keys are Enterprise features, priced by sales.
The security fact sheet places Doppler’s servers in GCP us-central1, and no EU region is offered for the cloud service.
Workaround: Doppler markets Doppler On-prem, an Enterprise option, for data residency requirements.
SOC 2 Type II and ISO 27001 are stated; the security, legal and pricing pages do not describe a HIPAA BAA or FIPS validation.
Workaround: Reports are requested through the trust center at trust.doppler.com.
Prices are per seat per month; no annual price or annual discount is published outside Enterprise contracts.
Doppler bills each human user per month; machine identities, secrets and API calls are not billed. For our scenario, 10 engineers on Team cost 10 × $21 = $210 a month ($2,520 a year, computed), and the 5 machine identities are free. Developer would cost 7 × $8 = $56 a month for 10 users (computed), but it keeps 3 days of activity logs, short of the 30 days the scenario asks for. Team add-ons are $9 per seat a month each for custom roles, user groups and 500 syncs instead of 100. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise. Proxied rotation runs AWS Lambda functions in your own AWS account. Non-profits and students can ask for a 33% discount.
The CLI command doppler secrets download and the download API export a config as JSON, .env, YAML or Docker formats, and the terms let you download your secrets at any time. After termination you can request an export within 30 days; a deleted workplace cannot be recovered. Activity logs can be read through the API.
From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only.
| Limit | As recorded |
|---|---|
| Billing unit | Per human user per month; no secret, API or usage fees |
| Free option | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card |
| Reference scenario (monthly) | $210 on Team (10 × $21), computed |
| Machine identities | Free; service accounts from Team |
| Audit log retention | 3 days on Developer, 90 days on Team, custom on Enterprise |
| Dynamic secrets | Enterprise (AWS IAM, Azure Service Principal) |
| Database rotation | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise |
| Kubernetes | Doppler Kubernetes Operator and External Secrets provider, all plans |
| SAML SSO / SCIM | SAML on Team; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 2 Type II; ISO 27001 |
| HIPAA BAA | Not described |
| EU data storage | No EU region; GCP us-central1 |
| Self-hosting | Doppler On-prem, Enterprise only |
| Secret export | CLI and API download as JSON, .env or YAML |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Doppler yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Doppler yet.
Doppler lists 3 plans. The cheapest paid plan, Team, costs $21/user/mo.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: doppler.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal and documentation pages of three secrets managers on the same day and scored them on the same six indicators. What 10 engineers and 5 machine identities cost, where rotation, dynamic secrets, SSO and SCIM sit, and who should pick which.
