Defakto (formerly SPIRL)

Overview

SPIRL is now Defakto. The workload identity startup rebranded in October 2025, and spirl.com redirects to defakto.security. Ten days later it announced a 30.75 million dollar Series B led by XYZ Venture Capital and gave its headquarters as Palo Alto, California; cofounder Danny Oliveri is CEO. The pitch has widened from SPIFFE workload identity to a "Non-Human IAM Platform" covering workloads, CI/CD jobs, Active Directory service accounts, and AI agents, still grounded in SPIFFE and the IETF WIMSE work. Defakto was named a 2025 Gartner Cool Vendor in Identity-First Security.

What it is good at

Running SPIFFE in production without building the operational layer yourself. The architecture docs split the system three ways. A cloud control plane is the admin interface, syncs configuration, and merges public keys from every deployment into a global trust bundle. Trust domain servers issue signed SVIDs and run in your environment, active-active across regions if you want. Agents on each node attest workloads and expose a local API for SVID requests; serverless workloads skip the agent and present a platform-signed identity proof. Existing servers and agents keep issuing through a control plane outage or network partition, which addresses the main fear about a SaaS dependency in the authentication path.

The practical result is short-lived, automatically rotated X.509 certificates or JWTs instead of long-lived API keys, which supports mTLS between services and workload identity federation to cloud providers. Administration is through a CLI and a Terraform provider. See workload identity 101 for the underlying model.

Where it falls short

It is a young company with a short public track record. Public documentation is thin on SVID lifetimes, federation specifics, and the boundaries of the newer AD service account and AI agent features, so ask for a technical deep dive. The control plane is SaaS, so fully disconnected environments should check whether that is acceptable. It is not a secrets vault or a PKI for TLS on public endpoints.

Pricing

Quote-based. As of 2026-11-05 Defakto publishes no pricing page (defakto.security/pricing returns a 404).

Best for, and who should look elsewhere

Choose Defakto if your platform team wants SPIFFE identities across Kubernetes, VMs, and CI/CD without staffing a SPIRE operations team. To run the open standard yourself, use SPIFFE/SPIRE (see SPIFFE/SPIRE vs HashiCorp Vault). For workload-to-SaaS access brokering, compare Aembit; for a secrets platform, HashiCorp Vault. The best machine identity for enterprises ranking covers the field.

Bottom line

Defakto, formerly SPIRL, is a credible managed SPIFFE platform with fresh funding. Strong for platform teams retiring static secrets; still early enough to verify every claim in a pilot.