by InfisicalSecrets management
An open-source secrets platform with syncs, rotation and dynamic secrets, billed per identity (human or machine) from $20, in US or EU cloud or self-hosted.
An open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself.
Infisical stores secrets per project, environment and path and delivers them through its CLI, agent, Kubernetes operator and CSI provider, and through syncs to GitHub, Vercel, AWS, GCP, Azure and others. Its core is MIT-licensed, so a team can self-host it for free, and its cloud has US and EU regions. Pro, at $20 per identity a month billed annually, adds SAML SSO, point-in-time recovery and 30 days of audit logs; Advanced adds dynamic secrets and full rotation.
Against 3 other products we reviewed in Secrets management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Infisical | Google Secret Manager | Doppler | AWS Secrets Manager |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself. | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. |
| Overall score | 6.8 | 8.5Best | 7.3 | 7.0 |
| Free option | Free plan | Free plan | Free plan | Free trial |
| Card to start | No card needed | –Not measured | No card needed | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $20/identity/mo | $0.06/secret version/mo | $21/user/mo | $0.40/secret/mo |
| Pricing model | Per seat | Usage-based | Per seat | Usage-based |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per identity (human or machine) per month | Per active secret version per location and per 10,000 access operations | Per human user per month; no secret, API or usage fees | Per secret per month and per 10,000 API calls |
| Free option | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts |
| Reference scenario (monthly) | $300 on Pro (15 × $20, annual), computed | $14.61 (194 × $0.06 + 99 × $0.03), computed | $210 on Team (10 × $21), computed | $85 (200 × $0.40 + 100 × $0.05), computed |
| Machine identities | Billed like users; machines with identical permissions can share one | Service accounts and IAM principals, not billed | Free; service accounts from Team | IAM roles and users, not billed |
| Audit log retention | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | 3 days on Developer, 90 days on Team, custom on Enterprise | CloudTrail event history, 90 days; trails to S3 for longer |
| Dynamic secrets | Advanced ($40 per identity) | Not offered | Enterprise (AWS IAM, Azure Service Principal) | Not offered |
| Database rotation | Pro for public databases; full rotation on Advanced | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Managed rotation for RDS, Aurora, DocumentDB and Redshift |
| Kubernetes | Operator, Agent Injector and CSI provider; External Secrets provider | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Doppler Kubernetes Operator and External Secrets provider, all plans | Secrets Store CSI provider (ASCP), EKS add-on |
| SAML SSO / SCIM | SAML on Pro; SCIM on Enterprise | Through Cloud Identity Free; Entra ID provisioning guide | SAML on Team; SCIM on Enterprise | IAM Identity Center, no extra charge |
| SOC 2 / ISO 27001 | SOC 2 Type II; no ISO 27001 stated | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 |
| HIPAA BAA | HIPAA compliance stated; BAA by agreement, plan not stated | Covered by the Google Cloud BAA, every account | Not described | HIPAA-eligible under a BAA with AWS |
| EU data storage | EU cloud region (eu.infisical.com) | Regional secrets or user-managed replication in EU locations | No EU region; GCP us-central1 | Any EU region you choose |
| Self-hosting | MIT-licensed core free; enterprise features need a license | Not offered | Doppler On-prem, Enterprise only | Not offered |
| Secret export | CLI export as dotenv, CSV, JSON or YAML | One version at a time | CLI and API download as JSON, .env or YAML | One secret, or up to 20 per batch call |
| Bottom line | From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise. | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. |
Evidence: Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Infisical's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read Infisical's pricing page with its plan comparison and FAQ, the docs on identities, SSO, SCIM, audit logs and log streams, secret rotation, dynamic secrets, secret syncs, Kubernetes, access control, point-in-time recovery, security, deployment models and self-hosting, the CLI reference, the terms of service, DPA and vulnerability disclosure page on Oct 16, 2026; we did not sign up, start a trial or call the API. The pricing page served US dollars; its annual and monthly prices come from the page's own script.
Infisical bills per identity, which it defines as any human or machine that authenticates. Free covers 5 identities with unlimited projects, 3 environments and 10 syncs. Pro is $20 per identity a month billed annually ($23 monthly), Advanced is $40 ($46), and Enterprise is priced by sales. Every paid plan has a 30-day trial.
A few points need a question to Infisical. Custom roles appear on Advanced on the pricing page, on Enterprise in the RBAC docs and on Pro in the organization docs. Gateways are on Advanced on the pricing page and Enterprise in the gateway docs. The pricing page says trials need no card, while the terms say a payment method may be required. Secret scanning is listed on Free but not on Pro or Advanced, and is described as a paid Enterprise add-on. The pages state SOC 2 and HIPAA compliance; no ISO 27001 certificate is claimed.
The open-source core is MIT-licensed; self-hosted paid features need a license key, and when a license expires Infisical keeps running with those features turned off.
vs Doppler: Doppler’s self-hosted option, Doppler On-prem, is an Enterprise plan.
Rotation covers PostgreSQL, MySQL, MSSQL, Oracle, MongoDB, Redis, AWS, Azure and GCP keys, LDAP and APIs such as Stripe and Okta; Pro rotates public databases, Advanced the rest.
Compared: Google Secret Manager’s managed rotation is in Preview for regional Cloud SQL secrets.
Advanced, bought online at $40 per identity, generates dynamic credentials for databases, AWS, GCP and Azure identities, Kubernetes, SSH and more.
vs Doppler: Doppler keeps dynamic secrets on Enterprise.
Infisical Cloud runs in US and EU regions; the EU cloud at eu.infisical.com uses a dedicated EU AWS account.
vs Doppler: Doppler hosts its cloud in GCP us-central1 only.
Pro and Advanced charge for every identity, human or machine, and the 5 free identities become billable after an upgrade.
Workaround: The identity docs let machines that need identical permissions share one machine identity.
Free keeps no audit log; Pro keeps 30 days and Advanced 90. Audit log streaming to a SIEM, SCIM and approval workflows are Enterprise features.
Custom roles and gateways sit on different plans on the pricing page and in the docs, and rate limits are given only as Normal, Higher and Custom.
Workaround: Confirm the plan for a feature with Infisical before buying.
The pages state SOC 2 Type II and HIPAA compliance, with reports in a trust center; no ISO 27001 certificate is claimed, and FIPS and external KMS or HSM keys are Enterprise.
Infisical bills per identity, and an identity is any human or machine that authenticates. For our scenario, 10 engineers and 5 machine identities on Pro cost 15 × $20 = $300 a month billed annually ($3,600 a year), or 15 × $23 = $345 month to month (computed). Pro is the cheapest plan that covers it: Free stops at 5 identities and keeps no audit log, and Pro keeps 30 days. Advanced, at $40 per identity, adds dynamic secrets, full rotation and 90 days of logs: $600 a month for 15 (computed). Machines with identical permissions may share one identity, which lowers the count. SCIM, SIEM streaming, approval workflows and external KMS or HSM keys are Enterprise features priced by sales, and so is self-hosted support.
The CLI command infisical export writes secrets as dotenv, CSV, JSON or YAML, and secret syncs can push to Vault, AWS, GCP and Azure stores. The terms keep customer data available for export for 60 days after termination before deletion. The MIT-licensed core can also be self-hosted.
From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise.
| Limit | As recorded |
|---|---|
| Billing unit | Per identity (human or machine) per month |
| Free option | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card |
| Reference scenario (monthly) | $300 on Pro (15 × $20, annual), computed |
| Machine identities | Billed like users; machines with identical permissions can share one |
| Audit log retention | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise |
| Dynamic secrets | Advanced ($40 per identity) |
| Database rotation | Pro for public databases; full rotation on Advanced |
| Kubernetes | Operator, Agent Injector and CSI provider; External Secrets provider |
| SAML SSO / SCIM | SAML on Pro; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 2 Type II; no ISO 27001 stated |
| HIPAA BAA | HIPAA compliance stated; BAA by agreement, plan not stated |
| EU data storage | EU cloud region (eu.infisical.com) |
| Self-hosting | MIT-licensed core free; enterprise features need a license |
| Secret export | CLI export as dotenv, CSV, JSON or YAML |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Infisical yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Infisical yet.
Infisical lists 4 plans. The cheapest paid plan, Pro (billed annually; $23 month to month), costs $20/identity/mo.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: infisical.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal and documentation pages of three secrets managers on the same day and scored them on the same six indicators. What 10 engineers and 5 machine identities cost, where rotation, dynamic secrets, SSO and SCIM sit, and who should pick which.
