Vault

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that shouldn't live in a config file or an environment variable. It stores secrets, controls who can read them, rotates them automatically, encrypts data in transit and at rest, and logs every access. It's a bank vault for your application's credentials, and it's the most widely deployed tool of its kind in production.

Two things changed the picture. HashiCorp relicensed Vault from open source (MPL) to the Business Source License in 2023, so it's now source-available, not true open source: free to self-host for your own use, but you can't offer it as a competing managed service. That move triggered OpenBao, a fully open (MPL-2.0) fork now under the Linux Foundation, which is the route to take if the BUSL bothers you. And as of 2026, Vault is an IBM product (IBM closed its HashiCorp acquisition in early 2025) and jumped to a 2.0 version line under IBM's support lifecycle.

Vault is powerful and complex, not a docker-run-and-forget tool. Setting up high availability, configuring auth methods, writing policies, and handling the unseal process all take real infrastructure knowledge. Solo and small teams: self-host the free binary if you have the ops muscle, or look at OpenBao for a cleaner license. Teams that want it managed: HCP Vault starts around $365/mo. Large orgs: this is squarely the tool, just staff it accordingly.

The catch is the license and the new owner. BUSL means you're depending on source-available software now run by IBM, and how that stewardship plays out over time is the open question. If a guaranteed-open future matters to you, OpenBao exists for exactly that reason.