Infisical
Infisical, Inc. ·infisical.com· As of: 2026-07-30
Our verdict
A vault for credentials makes no company distinguishable. It prevents regression: credentials in code, in chat and in spreadsheets are the most common route by which a business loses control of its own systems. Once automation and AI agents reach into systems on their own, the number of credentials grows faster than the number of people, and without a register nobody knows who may do what. This is mandatory kit, not an edge. The edge sits behind the credentials, not in them.
Who it fits
Solo
suitable
The free plan covers five identities. One human, one pipeline, two services, and the limit is reached. That carries a one-person shop, but the headroom is thin.
Mid-market
suitable
Twenty US dollars per identity per month stays calculable as long as the number of services is known. Anyone choosing self-hosting gets the core as open source and pays only for role permissions, corporate single sign-on and dynamic credentials.
Enterprise
suitable with caveats
According to the pricing page the SOC 2 Type II report is listed only from the Advanced plan at forty US dollars per identity, all sixteen named subprocessors sit in the United States, and no ISO 27001 certificate of the vendor itself is publicly evidenced. For a procurement process with a checklist that means: clarify first, sign later.
Buy, switch or build
Off-the-shelf
HashiCorp Vault or the cloud provider's own vault
Vault is the reference point of the category and can do more, but it demands operational knowledge that small teams do not have. The more comfortable standard route is the vault of your own cloud, AWS Secrets Manager or Azure Key Vault: nothing extra to run, no new invoice, but a tie to one provider and no order for credentials that live outside that cloud.
AI-native
No meaningful AI-native replacement
A credential vault does not get better from a language model, it only gets more attackable. What AI changes here is the demand side: agents need short-lived, tightly scoped access instead of permanent keys. That is exactly what the vendor's agent features target. It is an argument for an identity register, not for a new class of tool.
Build it yourself
Encrypted files in version control
The serious build-it-yourself route is not your own vault but doing without a service: secrets encrypted as files next to the code, decrypted through your cloud's key service. It costs nothing, is auditable through version history and carries small, technically led teams. It breaks in three places: rotating credentials, revoking a single person's access, and the moment somebody without coding skills needs access.
Our advice
- Solo: Free plan or encrypted files, either one carries.
- Mid-market: Buy or self-host, but count the machines first, not the people.
- Enterprise: Buy, but settle data processing terms, transfer basis and the audit report in writing before signing.
Who is behind it
Staying power: Funded
A young company with fresh venture capital and an open-source core. The funding carries for now, but there is no long track record. The MIT-licensed core limits the damage if the vendor changes direction.
- Funding round: USD 16 million Series A led by Elad Gil, June 2025 · Source · As of 2026-07-30
- Founding, batch, size: founded 2022, Y Combinator Winter 2023, around 50 employees, based in San Francisco · Source · As of 2026-07-30
- Open-source core: MIT licence with the exception of the ee directory, around 28,500 stars on GitHub, active development · Source · As of 2026-07-30
- Subprocessors: 16 named, all located in the United States · Source · As of 2026-07-30
- Independent testing: penetration test across the entire attack surface by Cure53, report on request · Source · As of 2026-07-30
Cost of leaving: Moderate
The secrets themselves come out through the command line and the API, which is mechanical work. The expensive part is everything around them: the Kubernetes operator, syncs into other systems, dynamically generated database credentials and, if you use the certificate module, a private certificate authority whose certificates are live in production. Store only secrets and you are out in days. Hang certificate issuance on it and you plan in weeks.
Regulation and data
| Data processing agreement | on request, no publicly linked documentThe privacy policy states that data protection terms under EU and UK GDPR are offered. The legal page lists terms of service, privacy policy, subprocessors and the service level agreement, but no signable data processing document. Whether one exists can only be settled with sales.Source · As of 2026-07-30 |
|---|---|
| Storage location | selectable: US region at app.infisical.com or EU region at eu.infisical.comPer the vendor both regions run in separate AWS accounts with dedicated infrastructure. The documentation does not name the specific AWS regions behind them. The region is chosen when the organisation is created and then appears in every configuration.Source · As of 2026-07-30 |
| Subprocessors | 16 published by name, all located in the United StatesNamed entries include AWS and Google Cloud for infrastructure, plus Cloudflare, Datadog, Stripe, Salesforce, Slack and Posthog. The list is fully visible, which is more openness than many competitors offer.Source · As of 2026-07-30 |
| Third-country transfer | unclearThe privacy policy says information may be transferred, processed and stored anywhere in the world. It does not name the legal basis for transfers to the United States, neither standard contractual clauses nor an adequacy decision. Choosing the EU region puts the service in Europe, but the vendor's support and analytics tooling stays in the US.Source · As of 2026-07-30 |
| Training on customer data | not applicable in substance, but without a commitmentThe tool is not a language model, it handles credentials. An explicit commitment that customer content is never used for model training appears neither in the privacy policy nor on the security page. The vendor advertises AI-generated session summaries, so the question belongs in the contract.Source · As of 2026-07-30 |
| Retention and deletion | audit logs 30 days on the Pro plan, 90 days on the Advanced plan, freely configurable on the Enterprise planFor its own infrastructure logs the architecture page names 365 days in CloudWatch. How long deleted secrets remain in backups is not publicly stated.Source · As of 2026-07-30 |
| Certifications | SOC 2 Type II, listed on the pricing page only from the Advanced plan upwards; penetration test by Cure53No ISO 27001 certificate of the vendor itself is publicly evidenced. Reports and an attestation letter for the penetration test are available on request via security@infisical.com per the documentation. Tying the audit report to a plan tier is unusual and should be clarified before procurement.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearThe vendor makes no public statement on the transparency duties under Article 50 of the AI Regulation. The tool is not an AI system in the sense of the regulation, but it ships AI-generated session summaries for which no classification is given.no source given · As of 2026-07-30 |
| Audit logging | audit logging included in the product, retention period depends on the planEvery access to a secret is logged. The free plan states no retention, Pro keeps 30 days, Advanced 90 days. Longer evidence obligations require the Enterprise plan or a stream into your own logging system.Source · As of 2026-07-30 |
What it really costs
Entry price
Free for 5 identities, unlimited projects, 3 environments and 10 secret syncs. The Pro plan costs 20 US dollars per identity per month billed annually, 23 US dollars billed monthly. The core can be self-hosted under the MIT licence.
Source · As of2026-07-30
What gets expensive
The billing unit is the trap. An identity is any human or machine that authenticates. Every service, every pipeline, every agent counts separately and costs the same as a person. Anyone serious about automation ends up with more machines than people, so the bill grows with automation rather than with headcount. Two further jumps: dynamic secrets and the SOC 2 report sit in the Advanced plan at 40 US dollars per identity, and self-hosting with enterprise features costs 25 to 100 US dollars per identity per month according to the pricing page, which is more than the hosted service.
What it displaces
- Credentials in source code and configuration files
- Passwords in chat threads and spreadsheets
- Shared password manager vaults used for machine access
Interfaces
- Command line and REST API
- Kubernetes operator
- Sync into third-party systems via Secret Syncs
- Dynamically generated database credentials
At Convios: Not used by us
Not in use at Convios. This assessment comes from reviewing public sources, not from our own operation.
Matching methods
Evidence
- 1.Plans, free limits, price per identity, self-hosting surcharge and the SOC 2 report being tied to the Advanced plan · As of 2026-07-30
- 2.Full list of 16 subprocessors, all located in the United States · As of 2026-07-30
- 3.Separate US and EU regions in dedicated AWS accounts, encryption at rest, 365-day retention for infrastructure logs · As of 2026-07-30
- 4.MIT licence for the core with the exception of the ee directory, which requires an Infisical licence · As of 2026-07-30
- 5.16 million US dollar Series A in June 2025 led by Elad Gil · As of 2026-07-30
- 6.Worldwide transfer and processing possible, GDPR data protection terms are offered, no publicly linked data processing document · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.