Platform capabilities.
Point-solution pricing.
On every plan
| Developer | Teams | Teams Pro | |
|---|---|---|---|
| Machines and identities | |||
| Ephemeral machinesShort-lived identity for CI runners and autoscaled fleets | ✓ | ✓ | ✓ |
| Temporary machinesTime-boxed identity for contractors and incidents | ✓ | ✓ | ✓ |
| AI identitiesPlaintext-blind MCP access for coding agents | ✓ | ✓ | ✓ |
| Enrollment tokensBootstrap a machine without handing over a key | ✓ | ✓ | ✓ |
| Docker provisioning and CI templates | ✓ | ✓ | ✓ |
| Secrets | |||
| Applications and standalone projects | Unlimited | Unlimited | Unlimited |
| Secrets per project | Unlimited | Unlimited | Unlimited |
| Reads and rotationsNever metered, so rotating often costs nothing | Unlimited | Unlimited | Unlimited |
| Single-value and structured secrets | ✓ | ✓ | ✓ |
| Managed secretsRotation applied to the source system by a sync agent | ✓ | ✓ | ✓ |
| Leased secretsShort-lived database credentials minted per machine | ✓ | ✓ | ✓ |
| Certificate secretsSSH certificates signed on demand from your own authority | ✓ | ✓ | ✓ |
| Canary secretsTrip-wire credentials that freeze the project when read | ✓ | ✓ | ✓ |
| TTL secretsOne-time shares for a human recipient | ✓ | ✓ | ✓ |
| Version history, rollback, trash and restore | ✓ | ✓ | ✓ |
| Manual and scheduled rotation | ✓ | ✓ | ✓ |
| Access control | |||
| Access policies per secretTime windows, IP allowlists, read caps, co-signing | ✓ | ✓ | ✓ |
| IP allowlist on machine reads | ✓ | ✓ | ✓ |
| Certificate authorities | ✓ | ✓ | ✓ |
| Passkeys, two-factor and OAuth sign-in | ✓ | ✓ | ✓ |
| Monitoring and audit | |||
| Filtered audit exportCSV, JSON or TXT, by action, actor, severity, IP and range | ✓ | ✓ | ✓ |
| Webhooks | ✓ | ✓ | ✓ |
| Tooling and support | |||
| CLI and sync agent | ✓ | ✓ | ✓ |
| MCP server | ✓ | ✓ | ✓ |
| SDKsGo, Python, Node, .NET, Kotlin and PHP | ✓ | ✓ | ✓ |
| Offline fallback cache | ✓ | ✓ | ✓ |
| Docker, Kubernetes, GitHub, GitLab and Bitbucket | ✓ | ✓ | ✓ |
| Direct in-dashboard support | ✓ | ✓ | ✓ |
Questions
Is the free plan a trial?
No. Developer is permanent, with 10 machines and no expiry.
What counts toward my machine quota?
Every machine that can read secrets right now: your long-lived servers and services, plus any ephemeral CI machines and temporary machines while they are live. The kind does not matter, the ability to read does.
Anything that cannot read is free. Disable a machine, let an ephemeral or temporary one expire, or delete it, and its slot opens up straight away. AI identities and the people who sign in to your dashboard never count. And reaching the limit only stops you adding a new machine, it never turns off one already running.
Do reads or rotations cost extra?
No. Secret count, project count, read volume and rotation frequency are unlimited on every plan.
What happens if a payment fails?
A failed renewal opens a seven-day window, not an immediate change. Your card is retried and reminders are sent, and nothing about your vault changes in the meantime: full plan, every machine still reading. If any payment lands, the window closes and that is the end of it.
Only if the seven days pass unpaid does the plan move to Developer. Machines and tunnels above the Developer allowance are disabled newest first and the paid features switch off, while everything inside the free allowance keeps reading the whole time. Support can extend the window if you ask, for instance while a bank problem clears.
Paying afterwards restores your plan and its features at once. Machines that were disabled stay off until you turn them back on yourself, since your setup may have moved on while they were dark.
Can I change plan mid-cycle?
Yes, from the dashboard. Moving up applies immediately and is prorated. Moving down applies at the end of the current period.
What if I go over my machine allowance?
Additional machines bill at your plan's per-machine rate. You are never blocked from adding one.