Infisical

Infisical: frequently asked questions

How much does Infisical cost?

Secrets Management is billed per identity per month, where an identity is any human or machine principal that authenticates. Free covers 5 identities, 3 environments and 10 secret syncs. Pro is 20 dollars per identity per month billed annually or 23 dollars monthly; Advanced is 40 dollars annually or 46 dollars monthly; Enterprise is custom and annual only. Other modules price separately: Certificate Management is free for one CA and 10 active certificates, Privileged Access Pro is 20 dollars per user per month, and Agent Vault charges 2 dollars per 1,000 brokered requests after 5,000 free each month (checked 2026-11-05).

Is Infisical actually open source?

Partly, and the boundary matters. Everything outside the ee directories is MIT licensed, genuinely free to self-host including commercially, with no user cap or field-of-use restriction. Everything inside backend/src/ee is under a separate source-available Infisical Enterprise licence: you may copy and modify it for development and testing without a subscription, but production use requires a paid subscription and redistribution is forbidden. GitHub's own licence detector returns NOASSERTION for the repository because of this split. The accurate description is open-core: MIT core plus a proprietary enterprise tier, not open source end to end.

What features are gated behind paid tiers?

More than the marketing implies. SAML SSO starts on Pro, but SSO and MFA enforcement need Advanced. Secret rotation on Pro covers public databases only; full rotation and dynamic secrets need Advanced at 40 dollars per identity per month. SCIM, LDAP, approval workflows for secret access requests and external KMS or HSM root key protection are Enterprise only. Dynamic secrets being a paid feature is the sharpest contrast with HashiCorp Vault, where it is part of the free self-hosted build (checked 2026-11-05).

Who owns Infisical and how well funded is it?

Infisical is a private company founded in 2022 and backed by Y Combinator. On 27 October 2026 it announced a 40 million dollar Series B at a 600 million dollar valuation, led by Elad Gil with Y Combinator, Gradient Ventures, Gallery Ventures, Pace Capital and Dynamic Capital. That follows a 16 million dollar Series A, also led by Elad Gil, in June 2025. Infisical says more than 1,300 organizations use the platform and names LG, First American Financial, OpenRouter, Wise and the US Government among them.

Infisical or HashiCorp Vault: which should we use?

Infisical is the better fit for smaller teams that want secrets management working quickly without dedicating platform engineers to it, and its per-identity pricing is legible. Vault is the better fit where breadth and operational control matter: 26 secrets engines, 21 auth methods, 23 storage backends, free dynamic secrets, and a CSI driver Infisical does not document. Two honest caveats against the usual framing. Infisical is still on 0.x versioning, currently v0.167.6 from 3 November 2026. And neither is fully open source at the top end: Vault moved its whole core to BUSL 1.1, while Infisical keeps an MIT core with a proprietary enterprise tier. The boundary differs; the outcome for a paying enterprise is similar.

Does per-identity pricing include machines?

Yes, and this is the most decision-relevant pricing fact. An identity is any principal that authenticates, human or machine, so every service, workload and CI runner that talks to Infisical is a billable identity. For an organisation with far more workloads than people, cost scales with workload count rather than headcount. Model this against your actual machine identity population before comparing headline prices with per-user competitors.

Is Infisical compliant and secure enough for enterprise use?

Its documentation states SOC 2 compliance with the report available through its trust centre, HIPAA compliance, and FIPS 140-3 compliance with a FIPS mode for enterprise deployments using validated cryptographic modules. It does not specify SOC 2 Type I versus Type II, so we do not assert Type II. No ISO 27001 certification and no FedRAMP authorization were found. Encryption is AES-256-GCM with a key hierarchy from a root encryption key through an internal KMS root key to organisation and project data keys, with external KMS support for AWS KMS, AWS CloudHSM and GCP KMS, plus HSM-backed root key protection. Infisical states it undergoes penetration tests twice yearly, and Cure53 has performed a gray-box test.

Does Infisical have any CVEs?

None. The National Vulnerability Database returned zero results for Infisical when we queried it on 5 November 2026, and its GitHub repository has no published security advisories. Interpret that with care rather than as a quality signal: a four-year-old project with no assigned CVEs also reflects limited external security research attention. HashiCorp Vault's longer CVE history partly reflects far greater scrutiny.

What are the best Infisical alternatives?

HashiCorp Vault for breadth and dynamic secrets in the free tier, if you can operate it. OpenBao if you want a genuinely open-source Vault-compatible option under Linux Foundation governance. Doppler for a comparable developer-first managed experience. Akeyless for managed secrets with a lower operational floor. AWS Secrets Manager or Azure Key Vault if you are single-cloud and want the native option.