Delinea DevOps Secrets Vault

Overview

DevOps Secrets Vault (DSV) is Delinea's SaaS secrets manager for applications, pipelines, and other machine consumers. It sits beside Secret Server, Delinea's privileged access vault, and is aimed at high-volume API retrieval rather than human password checkout. Delinea is privately owned (TPG).

A status note for buyers: the product is still documented and sold, with an administrator guide on docs.delinea.com labelled version 11.4.x and dated 2026. But Delinea's former DSV product page now redirects to a general "machine and AI solutions" page for the Delinea Platform, which lists Secret Server, Credential Manager, and other platform products without naming DSV. Ask Delinea about DSV's roadmap before signing a multi-year deal.

What it is good at

Low-friction API access to secrets. DSV is delivered as an API service with no infrastructure to run, a CLI for Windows, macOS, and Linux, local CLI caching, a sandbox tenant, and multi-region deployment with hot standby. Workloads authenticate with their cloud identity (AWS roles, Azure managed identity and Entra ID, GCP service accounts) or with certificates, so a pipeline can fetch a credential without a bootstrap secret in its environment. That removes one of the commonest secrets in CI failure modes.

It also issues short-lived material. Delinea's 2020 integration post describes X.509 and SSH certificate issuance and dynamic secrets that expire after use, and the release notes add dynamic database credentials (PostgreSQL, Oracle, MSSQL, MongoDB). Secret Server can create and sync secrets into DSV, so a credential rotated under PAM governance reaches pipelines without a second copy. Integrations listed in the release notes include Kubernetes (dsv-k8s and an open-source sidecar), a GitHub Action, a GitLab plugin, and a Go SDK.

Where it falls short

Momentum. The release notes list few new features since 2022; the most recent entry (February 2025) adds Azure MSI and Entra ID authentication to the Go SDK and Kubernetes integrations. Dynamic secrets cover a short list of databases rather than the long catalog of engines in HashiCorp Vault. It is SaaS only, so air-gapped or self-hosted requirements rule it out, and outside a Delinea estate there is little reason to pick it over cloud-neutral options.

Pricing

Quote-based, with a free tier. As of 2026-11-05 the DSV documentation lists a free version capped at 250 secrets and 20,000 API calls per month; paid tiers are not priced publicly and are usually sold alongside Delinea PAM.

Best for, and who should look elsewhere

Choose DSV if you already run Secret Server and want pipeline and application secrets under the same governance and audit trail. Look elsewhere for self-hosting, broad dynamic secrets, or a vendor-neutral standard: HashiCorp Vault, Infisical, Akeyless, or Idira Secrets Manager (formerly CyberArk Conjur). For cloud-native single-provider shops, AWS Secrets Manager is simpler. See the secrets management primer and best secrets management tools.

Bottom line

DSV is a sensible extension of Delinea PAM into DevOps secrets for existing Delinea customers. Get a roadmap commitment first, because the product is no longer front and center on Delinea's site.