Secrets Management Platforms Compared
Choosing a secrets management platform affects your licensing costs, operational model, API compatibility, and data sovereignty for years. This page compares OpenBao against HashiCorp Vault Enterprise, Vault Community (BSL), Infisical, AWS Secrets Manager, and Azure Key Vault.
Quick comparison
| OpenBao | Vault Enterprise | Vault Community (BSL) | Infisical | AWS Secrets Manager | Azure Key Vault | |
|---|---|---|---|---|---|---|
| License | MPL 2.0 | Commercial | BSL 1.1 | MIT | Proprietary | Proprietary |
| Cost model | Free + ops | Per-client pricing | Free (BSL-restricted) | Free tier + paid | Per-secret/month | Per-operation |
| API compatibility | Vault API | Vault API | Vault API | Own API | Own API | Own API |
| Dynamic secrets | Yes | Yes | Yes | Limited | No | No |
| PKI/certificates | Yes | Yes | Yes | No | No | Yes |
| Transit encryption | Yes | Yes | Yes | No | No | Yes |
| HSM support | Yes | Yes | No | No | CloudHSM | Azure HSM |
| Data sovereignty | Your infra | Your infra | Your infra | SaaS or self-host | AWS regions | Azure regions |
| Managed by VSHN | Yes | No | No | No | No | No |
Vault Enterprise pricing
HashiCorp Vault Enterprise pricing is per-client: each application, service, or user that authenticates counts as a client. Pricing is not publicly listed. Based on available market data and customer reports, estimates range from $1 to $3 per client per month, with enterprise contracts typically starting at $50,000 per year.
IBM completed its acquisition of HashiCorp in February 2025. For context, since IBM acquired Red Hat in 2019, Red Hat subscription prices have increased approximately 10% per year consistently. The same pattern should be expected for Vault Enterprise.
OpenBao has zero software licensing cost. VSHN managed operations are priced at a fixed monthly rate regardless of client count.
Estimated annual cost by client count
| Clients | Vault Enterprise (est.) | OpenBao + VSHN managed ops |
|---|---|---|
| 100 | $1,200 - $3,600/year | Fixed monthly rate, contact us |
| 500 | $6,000 - $18,000/year | Fixed monthly rate, contact us |
| 2,000 | $24,000 - $72,000/year | Fixed monthly rate, contact us |
Caveat: Vault Enterprise pricing is not publicly listed. The estimates above are based on available market data and customer reports. Contact HashiCorp for a current quote.
Vault Enterprise features in OpenBao
As of OpenBao 2.6.2 and HashiCorp's Vault documentation on 13 September 2026. Each Vault entry links the page where HashiCorp states that the feature needs an Enterprise license. Each OpenBao entry links the documentation for that release where there is something to link.
HashiCorp documents 25 features as Enterprise-only. OpenBao 2.6.2 matches three of them, a fourth when it runs on Kubernetes, and covers one in part. Three more arrive with 2.7.0, in beta since 9 September 2026: control groups, External Keys (OpenBao's counterpart to managed keys) and consistency headers. The other 17 are not in its documentation. Two of those weigh little where tooling runs around OpenBao: the order of an upgrade and a schedule for rotating root credentials are jobs a GitOps pipeline or a scheduled job can take on, where Vault Enterprise does them inside the server.
| Feature | Vault Enterprise | OpenBao 2.6.2 | Verdict |
|---|---|---|---|
| Namespaces | Enterprise | Shipped since 2.3.1 | Parity |
| PKCS#11 HSM auto-unseal | Enterprise | Built in. From 2.7.0 a separately installed plugin, still free | Parity |
| Standby nodes serving reads | Enterprise, as performance standbys | Every standby serves reads by default since 2.5.0 | Parity |
| Seal wrap | Enterprise Plus (HSMs) | Per-mount seal wrapping, without the FIPS 140 attestation HashiCorp offers | Partial |
| Automated Raft snapshots | Enterprise | Scheduled snapshots to S3 with expiry through the Helm chart CronJob. Outside Kubernetes, a cron job of your own | Parity on Kubernetes |
| Control groups | Enterprise | In the 2.7.0 beta | 2.7.0 beta |
| Managed keys | Enterprise | External Keys, in the 2.7.0 beta with a different API | 2.7.0 beta |
| Consistency headers | Enterprise | In the 2.7.0 beta | 2.7.0 beta |
| Performance replication | Enterprise | Not documented. The design for standby reads lists cross-cluster replication as a non-goal | Not in 2.6.2 |
| Disaster recovery replication | Enterprise | Not documented | Not in 2.6.2 |
| Sentinel policies | Enterprise | ACL policies only. CEL validates PKI and JWT roles, a narrower mechanism | Not in 2.6.2 |
| Step-up MFA in policies | Enterprise | Login MFA only, as in Vault Community | Not in 2.6.2 |
| Lease count quotas | Enterprise | Rate limit quotas only | Not in 2.6.2 |
| Redundancy zones | Enterprise | Not documented. Autopilot covers stabilization, dead server cleanup and state | Not in 2.6.2 |
| Automated upgrades | Enterprise | Not built in. The Helm chart leaves the upgrade order to the operator: standbys first, the active node last | Not in 2.6.2 |
| Scheduled root credential rotation | Enterprise | Root credentials rotate through an API call, with no built-in schedule | Not in 2.6.2 |
| Audit filtering | Enterprise | Not documented | Not in 2.6.2 |
| Entropy augmentation | Enterprise | Not documented | Not in 2.6.2 |
| FIPS 140-3 builds | Enterprise | Not documented | Not in 2.6.2 |
| SCIM provisioning | Enterprise, in beta | Not documented | Not in 2.6.2 |
| Secrets Sync | Enterprise | Not documented. Open feature request, no implementation yet | Not in 2.6.2 |
| KMIP server (KMIP secrets engine) | Enterprise with the ADP module | Not documented. The KMIP seal is a different feature: OpenBao as a KMIP client for unsealing | Not in 2.6.2 |
| Transform (tokenization, format-preserving encryption) | Enterprise with the ADP-Transform module | Removed from the fork | Not in 2.6.2 |
| Key Management secrets engine | Enterprise with the ADP module | Not documented | Not in 2.6.2 |
| SCEP certificate enrollment | Enterprise | Not documented | Not in 2.6.2 |
What still makes Vault Enterprise the right purchase. Replication across clusters is the largest gap. OpenBao has neither performance nor disaster recovery replication, so an OpenBao deployment that spans sites is a single cluster. Behind that come Sentinel policies, the Advanced Data Protection modules (a KMIP server, Transform tokenization, key distribution to cloud KMS), a FIPS 140-3 build where a contract or regulation requires one, and Secrets Sync into cloud secret managers.
What has stopped being a reason. Namespaces, PKCS#11 auto-unseal and read-serving standbys ship in OpenBao without a license fee, and so do scheduled snapshots on Kubernetes. Control groups and managed keys follow with 2.7.0: both are already in its beta and become available with the stable release.
The fork: why OpenBao exists
In August 2023, HashiCorp changed Vault's license from MPL 2.0 to BSL 1.1 (Business Source License). BSL 1.1 restricts use in competing hosted services. IBM announced its acquisition of HashiCorp in April 2024 and completed it in February 2025.
OpenBao forked from Vault in response to the license change. It is maintained under the Linux Foundation, uses MPL 2.0, and is fully API-compatible with Vault. Migrating from Vault to OpenBao is a configuration change, not a rewrite. Your existing Vault clients, scripts, and Terraform resources work without modification.
Vault Enterprise
HashiCorp Vault Enterprise is the mature commercial offering with the longest track record.
Strengths: performance replication and disaster recovery replication across clusters, Sentinel policies, the KMIP, Transform and Key Management secrets engines, FIPS 140-3 builds, an enterprise support SLA, and a large community of operators. The table above lists all 25 Enterprise features against OpenBao.
No longer a differentiator: namespaces, PKCS#11 HSM auto-unseal and standby nodes that serve reads, plus scheduled snapshots on Kubernetes. OpenBao ships them without a license fee.
Limitations: per-client pricing scales linearly with adoption. BSL 1.1 license restricts certain use cases. IBM's acquisition history with Red Hat shows consistent annual price increases, making long-term cost planning harder. You are dependent on a single vendor for the entire secrets management stack.
Fits when: your organization is already committed to Vault Enterprise, needs replication across clusters, Sentinel policies, tokenization or a FIPS 140-3 build, and accepts the licensing cost and IBM vendor dependency.
Vault Community (BSL)
The Vault Community edition is free to run, but the BSL 1.1 license restricts use in competing service offerings.
Strengths: free to run, same API as Vault Enterprise and OpenBao, broad documentation and community resources.
Limitations: BSL 1.1 is not an open source license by OSI definition. The restriction clause creates legal ambiguity for SaaS companies and internal platform teams that offer Vault as a shared service. You still rely on HashiCorp (now IBM) for fixes and security patches. And PKCS#11 auto-unseal is not available: HashiCorp's documentation puts it behind Enterprise, so a Community deployment cannot unseal itself from an HSM. For a regulated organization that has been told where its key material must live, that single line decides the edition.
Fits when: you run Vault Community for internal use, BSL restrictions do not apply to your use case, and you manage the operational burden yourself.
Infisical
Infisical is a developer-first secrets platform built for application teams. It takes a different approach from Vault: a web dashboard, native integrations, and built-in secret rotation.
Strengths: developer-friendly web UI, native integrations with GitHub Actions, Kubernetes, Docker, and CI systems, built-in secret rotation for common services, and MIT license for the self-hosted version.
Limitations: Infisical does not have dynamic secrets: each secret is a stored value, not generated per-request. No PKI or certificate management. No transit encryption engine. No HSM support. Infisical and Vault solve different problems: Infisical is a secrets store; Vault is a secrets platform.
Fits when: your team needs a developer-friendly secrets store with a UI and does not require dynamic secrets, PKI, or transit encryption.
Hyperscaler options: AWS Secrets Manager and Azure Key Vault
Both AWS Secrets Manager and Azure Key Vault integrate tightly with their respective cloud ecosystems.
Strengths: zero infrastructure to manage, native IAM integration, tight integration with cloud-native services (Lambda, EC2, App Service), built-in audit trails.
Limitations: US company jurisdiction applies regardless of data region. No dynamic secrets generation. No transit encryption engine. No portability: secrets stored in AWS Secrets Manager cannot be retrieved by an Azure workload without cross-cloud calls. AWS Secrets Manager charges $0.40 per secret per month plus $0.05 per 10,000 API calls. Azure Key Vault charges per operation. Costs grow with secret count and access frequency.
Fits when: your entire workload runs on a single hyperscaler, US jurisdiction is acceptable, and you need only static secret storage with IAM access control.
When to choose each
Choose OpenBao + VSHN managed operations if you want Vault API compatibility without per-client licensing, need data sovereignty on Swiss infrastructure, or are migrating away from Vault Enterprise and want a drop-in replacement under MPL 2.0.
Choose Vault Enterprise if your organization requires replication across clusters, Sentinel policies, the Transform or KMIP secrets engines, or a FIPS 140-3 build, is already under an enterprise contract, and accepts per-client pricing and IBM vendor dependency.
Choose Vault Community (BSL) if you run an internal deployment, manage operations yourself, and BSL restrictions do not apply to your use case.
Choose Infisical if your primary need is a developer-friendly secrets store with a web UI and native CI integrations, and you do not need dynamic secrets or a PKI engine.
Choose AWS Secrets Manager or Azure Key Vault if your workloads run exclusively on one hyperscaler, US jurisdiction is acceptable, and you need basic secret storage with native IAM integration.
Next steps
Assessing a Vault-to-OpenBao migration or comparing licensing costs for your client count? Book a consultation. We review your current setup and give you a concrete cost comparison.