Vault

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that should not live in a config file or an environment variable. It stores secrets, controls who can read them, rotates them automatically, and logs every access.

It is also not open source anymore. HashiCorp moved Vault from MPL to the Business Source License in 2023, and IBM, which closed its HashiCorp acquisition in February 2025, is now the named licensor. You can self-host it free for your own use. You cannot offer it to third parties on a hosted or embedded basis to compete with IBM's paid versions, and that includes paid support arrangements. Each release converts to MPL 2.0 four years after it ships.

High availability, auth methods, policies, and the unseal process all take real infrastructure knowledge. Solo and small teams: self-host the free binary if you have the ops muscle, or look at Infisical/infisical for something simpler. Managed means HCP Vault Dedicated. A Development cluster starts at $0.62 an hour, about $450 a month running full time, capped at 25 clients with no SLA. Production tiers start at $1.58 an hour plus $73 a month per Vault client.

The catch is the license and the owner. You are depending on source-available software run by IBM. OpenBao, the MPL 2.0 fork under the Linux Foundation, exists for anyone who wants a guaranteed-open future.