Tool profile
Akeyless: cost, fit and limits
Akeyless is a SaaS secrets management platform made by Akeyless Security Ltd. that stores and rotates static, dynamic and rotated secrets, manages encryption keys and certificates, and offers secure remote access. It uses a patented key-splitting technology and sells on usage units with Free and Enterprise plans.
What to know first
Akeyless sells a platform with several products on one meter: secrets management, encryption and KMS, certificate lifecycle management, a password manager and secure remote access. The pricing page shows a Free plan with itemized limits and an Enterprise plan with custom numbers. Usage is counted by clients, connectors, certificates and transactions, and overages are invoiced at the end of the contract period. SaaS and hybrid SaaS options are described.
Akeyless at a glance
| Maker | Akeyless Security Ltd., Israel |
|---|---|
| Free plan | Yes |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 4 of 10 |
| Website | akeyless.io |
Who Akeyless is best for
Enterprises with several clouds
The security page says the platform spans multiple cloud platforms, regions and availability zones, with geolocation-based policies for multi-region deployments.
Regulated buyers
The page lists FedRAMP Class D (High), FIPS 140-3, SOC 2 Type II, ISO 27001 and 27701, PCI DSS, DORA and GDPR, which helps with vendor risk questionnaires.
Teams that want to keep keys private
Akeyless says its DFC technology means neither Akeyless nor its cloud providers can access customer secrets and keys, and hybrid SaaS adds zero-knowledge mode with on-premise gateways.
Teams securing AI agents
The security page mentions SecretlessAI and Agentic Runtime Authority, aimed at securing AI agent identities, although it gives no detail on how they work.
Akeyless plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free | $0 | 5 clients, 500 static secrets, 5 dynamic secrets, 5 rotated secrets, 3 targets, 1 gateway cluster and 3-day audit log retention. |
| Enterprise | Custom, talk to an expert | Custom limits for clients, secrets, gateways and audit retention, with SAML, OIDC, LDAP, HSM integration, log forwarding and zero-knowledge mode. |
| Pure SaaS deployment | Included in plan | Fully cloud-managed service with the gateway included in the starter tier. This is the default model. |
| Hybrid SaaS deployment | Included in plan | Adds on-premise gateways and zero-knowledge encryption, with one gateway in the starter tier for exploration. |
Checked November 2026.
What Akeyless does
- Dynamic and rotated secrets
- The Free plan allows 5 of each. Dynamic secrets are created per request, and rotated secrets are changed on a schedule at the target system, such as a database.
- Universal Secrets Connector
- A connector syncs secrets from other stores into Akeyless. Free allows 1, which suits a trial migration from a cloud-native store. It is listed as a limit of one on Free.
- Encryption and KMS
- Free includes 5 keys and 1,000 transactions per day, while multi-cloud KMS, tokenization, code signing and KMIP or TDE are listed as not included. Enterprise limits are custom.
- Certificate lifecycle
- Free covers 5 managed certificates and 1 CA integration. Auto-renewal, provisioning, discovery and ACME are excluded from Free. Enterprise offers fuller lifecycle features, though the page does not itemize them.
- Remote access
- Secure remote access gives 5 users and 3 targets on Free with session management, while session recordings and the desktop app are excluded. Enterprise limits are custom.
How Akeyless handles your data
Akeyless states on its security page that it holds SOC 2 Type II, ISO 27001 and 27701, PCI DSS, FedRAMP Class D (High) and FIPS 140-3 validation, and that all encryption and decryption uses its patented DFC technology, with TLS 1.2 or later in transit. It says neither Akeyless nor its cloud providers can access customer secrets and keys. Hosting regions are not named. The privacy policy names Akeyless Security Ltd. in Ramat Gan, Israel, says support communications may train its AI support tools, and does not say customer secrets are used for training.
Where Akeyless falls short in practice
- Free plan excludes enterprise sign-in. SAML, OIDC and LDAP authentication, certificate-based authentication, HSM integration and log forwarding are all excluded from Free, so a pilot of those features needs an Enterprise discussion.
- Metering is multi-dimensional. Usage is counted by clients, connectors, certificates, transactions, tokenizers and more. Estimating a yearly bill takes an inventory, and overages are invoiced at the contract's end.
- Pricing tables mix products. The page itself does not always make clear which product a limit table covers, so confirm each limit for secrets, KMS or access separately. Ask the sales team to list them.
Works with
Alternatives to Akeyless
Akeyless: common questions
What does the Akeyless Free plan include?
The pricing page lists 5 clients, 500 static secrets, 5 dynamic secrets, 5 rotated secrets, 3 targets, 1 gateway cluster and 3-day audit log retention for secrets management, plus small allowances for encryption keys, certificates, a password manager and remote access.
Which certifications does Akeyless state?
The security page lists FedRAMP Class D (High), FIPS 140-3 validation, SOC 2 Type II, ISO 27001 and 27701, PCI DSS, DORA and GDPR compliance, with CSA STAR Level 1 shown as a badge. Request the reports to verify each scope.
What is the difference between SaaS and Hybrid SaaS at Akeyless?
Pure SaaS is fully cloud-managed with the gateway included. Hybrid SaaS adds on-premise gateways and zero-knowledge encryption, so key material stays in your environment. The starter tier includes one gateway to explore the hybrid model. Ask which fits your policy.
Can Akeyless see our secrets?
The security page says neither Akeyless nor its cloud providers can access customer secrets and keys, based on its DFC technology. It does not use the phrase zero knowledge for that claim, and hybrid SaaS offers a separate zero-knowledge mode with on-premise gateways.
Where is Akeyless based?
The privacy policy says Akeyless Security Ltd. is incorporated under the laws of Israel and gives a Data Protection Officer address in Ramat Gan, Israel. It also names a US subsidiary, Akeyless Security USA, Inc. No hosting region is stated.