by HashiCorp, an IBM companySecrets management
Managed single-tenant Vault clusters with dynamic secrets and rotation on every tier, billed per cluster-hour plus $72.92 per client a month.
Vault run for you by HashiCorp: dynamic credentials, rotation and fine-grained policies on a single-tenant cluster you do not operate.
HCP Vault Dedicated is a managed, single-tenant Vault cluster with most Vault Enterprise features. Every tier includes dynamic secrets, auto-rotating secrets, versioned key/value storage and path-based policies, and Essentials adds audit logs with streaming, high availability and snapshots. You pay per cluster-hour plus a monthly fee per client, so the cost follows how many people, apps and pipelines authenticate rather than how many secrets you keep.
Against 3 other products we reviewed in Secrets management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | HCP Vault Dedicated | Google Secret Manager | Doppler | AWS Secrets Manager |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeVault run for you by HashiCorp: dynamic credentials, rotation and fine-grained policies on a single-tenant cluster you do not operate. | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. |
| Overall score | 5.2 | 8.5Best | 7.3 | 7.0 |
| Free option | Free trial | Free plan | Free plan | Free trial |
| Card to start | No card needed | –Not measured | No card needed | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.62/cluster-hour | $0.06/secret version/mo | $21/user/mo | $0.40/secret/mo |
| Pricing model | Usage-based | Usage-based | Per seat | Usage-based |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per cluster-hour by tier and size, plus per client per month | Per active secret version per location and per 10,000 access operations | Per human user per month; no secret, API or usage fees | Per secret per month and per 10,000 API calls |
| Free option | No free tier; $500 of trial credit for 6 months, no card | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts |
| Machine identities | Billed as clients, like people, at $72.92 a month | Service accounts and IAM principals, not billed | Free; service accounts from Team | IAM roles and users, not billed |
| Audit log retention | 30 days for download from Essentials; none on Development | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | 3 days on Developer, 90 days on Team, custom on Enterprise | CloudTrail event history, 90 days; trails to S3 for longer |
| Dynamic secrets | Every tier | Not offered | Enterprise (AWS IAM, Azure Service Principal) | Not offered |
| Database rotation | Every tier (database static roles) | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Managed rotation for RDS, Aurora, DocumentDB and Redshift |
| Kubernetes | Vault Secrets Operator and CSI provider | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Doppler Kubernetes Operator and External Secrets provider, all plans | Secrets Store CSI provider (ASCP), EKS add-on |
| SAML SSO / SCIM | HCP SAML or OIDC SSO and SCIM, no plan gate stated | Through Cloud Identity Free; Entra ID provisioning guide | SAML on Team; SCIM on Enterprise | IAM Identity Center, no extra charge |
| SOC 2 / ISO 27001 | Restricted-use SOC 2 report, type not stated; ISO 27001 and 27017 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 |
| HIPAA BAA | Not supported | Covered by the Google Cloud BAA, every account | Not described | HIPAA-eligible under a BAA with AWS |
| EU data storage | EU regions on AWS and Azure; snapshots in the US | Regional secrets or user-managed replication in EU locations | No EU region; GCP us-central1 | Any EU region you choose |
| Self-hosting | Vault Community (BSL 1.1); Vault Enterprise through sales | Not offered | Doppler On-prem, Enterprise only | Not offered |
| Secret export | Per path via CLI or API; no bulk export | One version at a time | CLI and API download as JSON, .env or YAML | One secret, or up to 20 per batch call |
| Bottom line | From its public pages, HCP Vault Dedicated puts the most secret-lifecycle features on its entry production tier, with SSO, SCIM and audit streaming self-serve. At $2,245.73 a month it costs the most for our scenario, and it offers no HIPAA BAA or customer-managed keys. | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. |
Evidence: HCP Vault Dedicated: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from HCP Vault Dedicated's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read HashiCorp's Vault pricing tab, IBM's HashiCorp price list, the docs on tiers and features, pricing definitions, client counting, billing, Flex Multiyear, limits, logs, integrations, secrets sync, Kubernetes, policies, security, deletion and migration, HCP SSO, SCIM and MFA, the trust and compliance pages and IBM's PAYG supplement and general terms on Oct 16, 2026; we did not sign up, use trial credit or create a cluster. www.hashicorp.com answered our requests with a bot check, so the Vault pricing tab was read from its Internet Archive copy of June 6, 2026; IBM's US list was read live.
Pricing is by usage, not seats: a cluster-hour fee by tier and size, plus $72.92 a month for each client on Essentials and Standard. A client is anything that authenticates, from people to apps and CI pipelines, counted once a month per cluster. Development is $0.62 an hour with up to 25 clients and no client fee, but has no audit logging. New organizations get $500 of trial credit for 6 months.
Some points need a question to HashiCorp. The tiers doc calls the client fee a flat-rate hourly cost, while the pricing page and IBM's list show it monthly. Standard Small is $1.85 an hour on HashiCorp's page and $1.84299 on IBM's list. Vault Radar is sold pay-as-you-go on the pricing page but listed as Flex Multiyear only in the pricing definitions, which also name a Starter edition no pricing page shows. The compliance page offers a restricted-use SOC 2 report without stating its type.
Dynamic and auto-rotating secrets are on every tier, with database plugins for PostgreSQL, MySQL, MSSQL, Oracle, MongoDB Atlas, Snowflake and Redshift, and AWS, Azure and GCP secrets engines.
vs Infisical: Doppler keeps dynamic secrets on Enterprise; Infisical starts them on Advanced.
HCP organizations can set up SAML or OIDC SSO and SCIM with no plan gate stated, and Essentials streams audit logs to Splunk, Datadog and other targets.
vs Infisical: Doppler and Infisical keep SCIM and SIEM streaming on Enterprise.
Path-based policies are deny by default and can bind tokens to CIDR blocks; namespaces are available on all tiers.
Vault Community is free for production use under the BSL 1.1 license, except in competing hosted offerings, and Vault Enterprise can be self-managed through sales.
Essentials Small is about $1,152 a month for 730 hours before clients, and each client adds $72.92 a month; a client that uses several clusters is counted on each.
Workaround: Development is $0.62 an hour for up to 25 clients, though the pricing page positions it for exploring features in a limited environment.
Push syncs to GitHub, Vercel and AWS, Azure and GCP stores are on Standard only, and each synced secret counts as a billable client.
Workaround: The Vault GitHub Action and Kubernetes integrations read secrets on every tier.
The security overview says HIPAA BAAs and external AWS KMS or Azure Key Vault keys are not supported; FIPS 140 and HSM auto-unseal are only in self-managed Vault Enterprise.
The CLI reads secrets path by path as tables, JSON or YAML; there is no bulk export command or migration tool, only example scripts.
HCP Vault Dedicated bills cluster-hours by tier and size plus a monthly fee per client, pay as you go with no commitment; contract pricing is through sales. For our scenario, an Essentials Small cluster for 730 hours costs 730 × $1.57799 = $1,151.93, and 15 clients (10 engineers and 5 machine identities) cost 15 × $72.92 = $1,093.80, $2,245.73 a month in all (computed from IBM’s list). Development is left out because it has no audit logging. Secrets sync needs Standard and adds a client for every synced secret. Client counts reset monthly and cannot be reduced mid-month. Support is included: Silver on Essentials, Gold on Standard. IBM calls its prices indicative, before taxes.
Secrets come out per path through the CLI or API as JSON or YAML; HashiCorp offers example scripts rather than a migration tool. A deleted cluster can be restored for up to 30 days. Audit logs can be downloaded for 30 days or streamed. Vault Community can be self-hosted with the same API and policies.
From its public pages, HCP Vault Dedicated puts the most secret-lifecycle features on its entry production tier, with SSO, SCIM and audit streaming self-serve. At $2,245.73 a month it costs the most for our scenario, and it offers no HIPAA BAA or customer-managed keys.
| Limit | As recorded |
|---|---|
| Billing unit | Per cluster-hour by tier and size, plus per client per month |
| Free option | No free tier; $500 of trial credit for 6 months, no card |
| Machine identities | Billed as clients, like people, at $72.92 a month |
| Audit log retention | 30 days for download from Essentials; none on Development |
| Dynamic secrets | Every tier |
| Database rotation | Every tier (database static roles) |
| Kubernetes | Vault Secrets Operator and CSI provider |
| SAML SSO / SCIM | HCP SAML or OIDC SSO and SCIM, no plan gate stated |
| SOC 2 / ISO 27001 | Restricted-use SOC 2 report, type not stated; ISO 27001 and 27017 |
| HIPAA BAA | Not supported |
| EU data storage | EU regions on AWS and Azure; snapshots in the US |
| Self-hosting | Vault Community (BSL 1.1); Vault Enterprise through sales |
| Secret export | Per path via CLI or API; no bulk export |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for HCP Vault Dedicated yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for HCP Vault Dedicated yet.
HCP Vault Dedicated lists 5 plans. The cheapest paid plan, Development (Extra Small, up to 25 clients), costs $0.62/cluster-hour.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: hashicorp.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal and documentation pages of three secrets managers on the same day and scored them on the same six indicators. What 10 engineers and 5 machine identities cost, where rotation, dynamic secrets, SSO and SCIM sit, and who should pick which.
