# infisical

Source: https://startwithidentity.com/vendors/secrets/infisical/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

Infisical is an open-core [secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/) platform built for teams that want secrets, PKI, KMS and privileged access without standing up and operating [HashiCorp Vault](https://startwithidentity.com/vendors/machine-identity/hashicorp-vault/). Founded in 2022 out of Y Combinator's W23 batch, it has raised 18.8 million dollars across a 2.8 million dollar seed and a [16 million dollar Series A](https://www.prnewswire.com/news-releases/infisical-secures-16m-series-a-to-redefine-enterprise-secrets-identity-and-access-management-302475063.html) led by Elad Gil in June 2025, and carries over 29,000 GitHub stars. Hugging Face and LG are named customers.

Unusually for this category, it publishes prices. The unit is per identity per month, where an identity is any principal that authenticates, human or machine.

## What it is good at

Time to working secrets management. The developer experience is the product: clear documentation, eight machine identity auth methods including SPIFFE JWT-SVIDs, a Kubernetes operator with modern CRDs supporting Kubernetes 1.29 through 1.33, and secret syncs that push into AWS Secrets Manager, GitHub and Vercel rather than demanding everything move at once. Scope has widened well beyond secrets into certificate management, KMS, secret scanning and session-based privileged access to databases and servers.

Security engineering is more serious than the company's age suggests: AES-256-GCM with a layered key hierarchy, external KMS and HSM support for the root key, an SSRF-safe gateway for reaching private services, and twice-yearly penetration testing including a Cure53 gray-box test.

## Where it falls short

The open-source framing needs qualifying. The MIT core is genuinely unrestricted, but the ee directories are source-available and require a paid subscription for production use. Dynamic secrets and full rotation, core reasons to adopt a secrets platform at all, sit behind the 40 dollar Advanced tier, and SCIM, LDAP and approval workflows are Enterprise only.

Per-identity billing counts machines, so cost tracks workload count rather than headcount, which can invert the comparison against per-user competitors.

It remains on 0.x versioning after four years. No ISO 27001, no FedRAMP, no documented CSI driver, and SOC 2 without a stated Type.

## Pricing

Free at 5 identities; Pro 20 dollars and Advanced 40 dollars per identity per month billed annually; Enterprise custom. Certificate Management and PAM priced separately. Supported self-hosting is quoted, not listed. Model it with our [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Infisical for startups and mid-market teams wanting managed secrets fast, with a credible self-hosted path. Choose [Vault](https://startwithidentity.com/vendors/machine-identity/hashicorp-vault/) for breadth and free dynamic secrets, [Doppler](https://startwithidentity.com/vendors/secrets/doppler/) for a similar developer-first alternative, or [Akeyless](https://startwithidentity.com/vendors/machine-identity/akeyless/) for managed secrets at enterprise scale. See [Doppler vs Infisical](https://startwithidentity.com/compare/doppler-vs-infisical/).

## Bottom line

The most approachable serious secrets platform for teams without a platform engineering function, provided you price the machine identities honestly and know where MIT stops.