Infisical

Infisical: frequently asked questions

How much does Infisical cost?

Infisical publishes real prices, and the billing unit is the thing to understand: Secrets Management is billed per identity per month, where an identity is any principal that authenticates, human or machine. Free covers 5 identities, unlimited projects, 3 environments and 10 secret syncs. Pro is 20 dollars per identity per month billed annually, or 23 monthly, with unlimited identities, 6 environments per project and 25 syncs. Advanced is 40 dollars annually or 46 monthly, with 12 environments and 50 syncs. Enterprise is custom and annual only. Certificate Management and Privileged Access are priced separately, and PAM is billed per user rather than per identity.

Is Infisical actually open source?

Partly, and the boundary matters. Everything outside the ee directories is MIT licensed, genuinely free to self-host including commercially, with no user cap or field-of-use restriction. Everything inside backend/src/ee is under a separate source-available Infisical Enterprise licence: you may copy and modify it for development and testing without a subscription, but production use requires a paid subscription and redistribution is forbidden. GitHub's own licence detector returns NOASSERTION for the repository because of this split. The accurate description is open-core: MIT core plus a proprietary enterprise tier, not open source end to end.

What features are gated behind paid tiers?

More than the marketing implies. Dynamic secrets and full secret rotation require Advanced at 40 dollars per identity per month or Enterprise. SSO enforcement is Advanced and above. Approval workflows, SCIM and LDAP are Enterprise only. Dynamic secrets being a paid feature is the sharpest contrast with HashiCorp Vault, where it is a core capability of the free self-hosted build.

Infisical or HashiCorp Vault: which should we use?

Infisical is the better fit for smaller teams that want secrets management working quickly without dedicating platform engineers to it, and its per-identity pricing is legible. Vault is the better fit where breadth and operational control matter: 26 secrets engines, 21 auth methods, 23 storage backends, free dynamic secrets, and a CSI driver Infisical does not document. Two honest caveats against the usual framing. Infisical is still on 0.x versioning after four years, currently 0.165.13. And neither is fully open source at the top end: Vault moved its whole core to BUSL 1.1, while Infisical keeps an MIT core with a proprietary enterprise tier. The boundary differs; the outcome for a paying enterprise is similar.

Does per-identity pricing include machines?

Yes, and this is the most decision-relevant pricing fact. An identity is any principal that authenticates, human or machine, so every service, workload and CI runner that talks to Infisical is a billable identity. For an organisation with far more workloads than people, cost scales with workload count rather than headcount. Model this against your actual machine identity population before comparing headline prices with per-user competitors.

Is Infisical compliant and secure enough for enterprise use?

Its documentation states SOC 2 compliance with the report available through its trust centre, HIPAA compliance, and FIPS 140-3 compliance with a FIPS mode for enterprise deployments using validated cryptographic modules. It does not specify SOC 2 Type I versus Type II, so we do not assert Type II. No ISO 27001 certification and no FedRAMP authorization were found. Encryption is AES-256-GCM with a key hierarchy from a root encryption key through an internal KMS root key to organisation and project data keys, with external KMS support for AWS KMS, AWS CloudHSM and GCP KMS, plus HSM-backed root key protection. Infisical states it undergoes penetration tests twice yearly, and Cure53 has performed a gray-box test.

Does Infisical have any CVEs?

None. The National Vulnerability Database returns zero results for Infisical, and its GitHub security advisories page has no published advisories. Interpret that with care rather than as a quality signal: a four-year-old project with no assigned CVEs also reflects limited external security research attention. HashiCorp Vault's longer CVE history partly reflects far greater scrutiny.

What are the best Infisical alternatives?

HashiCorp Vault for breadth and dynamic secrets in the free tier, if you can operate it. OpenBao if you want a genuinely open-source Vault-compatible option under Linux Foundation governance. Doppler for a comparable developer-first managed experience. Akeyless for managed secrets with a lower operational floor. AWS Secrets Manager or Azure Key Vault if you are single-cloud and want the native option.