Infisical

What's Free

The core is MIT licensed and self-hostable: secret storage, environments, the CLI, the integrations, the web UI. Everything under the repository's ee/ directory is licensed separately and is not covered by the MIT grant, which is where the enterprise-only functionality lives.

Infisical Cloud Free

• 5 identities (humans and machines combined)
• Unlimited projects, 3 environments
• 10 secret syncs, 100+ integrations
• No SSO/SAML, no RBAC, no audit logs, no secret rotation, no dynamic secrets

Paid Tiers

• Pro: $20/identity/mo annual, $23 monthly. Unlimited identities, RBAC, SSO (SAML), secret rotation, 30-day audit log retention, 6 environments per project.
• Advanced: $40/identity/mo annual, $46 monthly. Dynamic secrets, custom roles, SSO and MFA enforcement, 90-day audit retention, temporary access grants, higher rate limits.
• Enterprise: custom. Approval workflows, LDAP and SCIM, user groups, 99.99% SLA, dedicated or self-hosted infrastructure.

Self-Hosting Cost

Docker plus Postgres plus Redis. A $20-40/mo VPS runs it for a small team. The hidden cost is key management: back up the encryption keys somewhere that is not the same box, and test the restore.

The Math

Per-identity billing counts service accounts and CI runners. A five-person team with a dozen machine identities is 17 billable identities, not 5. On Pro that is $340/mo, which is well past the point where self-hosting and handling your own SSO story deserves a serious look.

vs Alternatives

HashiCorp Vault is free and open source but a considerably heavier operational commitment. Doppler is cloud-only with no self-hosted path. AWS Secrets Manager is $0.40 per secret per month and only makes sense if you are already all-in on AWS.