Infisical

Free: Infisical Cloud Free is $0 forever: 5 identities (humans and machines combined), unlimited projects, 3 environments, 10 secret syncs, 100+ integrations, secret sharing, references and overrides, 2FA. No access controls (RBAC), no SAML SSO, no audit log retention, no secret versioning or point-in-time recovery, no secret rotation. Everything outside the repo's ee/ directories is MIT.

Self-hosted: Docker, Docker Compose (Infisical + PostgreSQL + Redis), Helm, a Linux package, or reference setups on AWS and GCP. PostgreSQL is the only supported database and Redis is a required, persistent datastore (job queue and locks), so both need backups. Infisical's own small-deployment guidance is 2+ containers at 2 cores / 4 GB each, plus Postgres at 2 vCPU / 8 GB RAM / 100 GB disk. Code under ee/ is under the Infisical Enterprise license: free for development and testing, but production use needs a paid license key set as LICENSE_KEY. Self-hosted pricing is not published; Infisical says it differs from Cloud and to contact sales. If a license expires, the instance keeps running with EE features disabled.

Paid: Pro is $20/identity/month billed annually or $23 billed monthly: unlimited identities, access controls, secret rotation (marked "Public DBs only"), SAML SSO, 30-day audit logs, secret versioning, point-in-time recovery, 6 environments per project, 25 syncs. Advanced is $40/identity/month annually or $46 monthly: dynamic secrets, custom roles, SSO and MFA enforcement, temporary access, gateways to private networks, 90-day audit logs, 12 environments per project, 50 syncs. Enterprise is custom and billed annually: approval workflows, LDAP, SCIM, user groups, audit log streaming, 99.99% SLA, HSM support, self-hosting or dedicated infrastructure. Pro and Advanced have a 14-day trial. Pricing is per product (Secrets Management, Certificate Management, Privileged Access, Agent Vault).