Tool profile
HashiCorp Vault: cost, fit and limits
HashiCorp Vault is an identity-based secrets management product made by HashiCorp, an IBM company, that stores and distributes secrets, issues certificates, manages encryption keys and offers encryption as a service. It targets humans, machines and AI agents, and runs self-managed or as a hosted service.
What to know first
Vault is the reference design for policy-driven secrets management, and HashiCorp now sits inside IBM. The product page groups four capabilities: secrets, certificates, keys and data protection. It positions Vault for AI agents with scoped policies, secret detection in prompts and workflow definitions, and short-lived credentials at runtime. The pricing page read lists plan types, pay-as-you-go, Flex and Enterprise self-managed, without Vault-specific prices.
HashiCorp Vault at a glance
| Maker | HashiCorp, an IBM Company, United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 9 of 10 |
| Website | hashicorp.com/en/products/vault |
Who HashiCorp Vault is best for
Platform teams with many systems
One API creates, expires and rotates secrets across databases, clouds and applications, which suits an estate where each team would otherwise run its own store.
Security teams governing AI agents
The product page describes policies scoped to AI agents and agentic workflows and short-lived, just-in-time credentials that expire automatically. That suits agent-heavy environments.
Organizations that need self-managed control
The pricing page lists an Enterprise self-managed plan type with fully customizable terms, for customers who want to run the software themselves.
Teams with certificate duties
Vault can generate, rotate and revoke certificates on demand, which consolidates secrets and PKI work in one system. That reduces tool sprawl.
HashiCorp Vault plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Pay-as-you-go | Usage-based, $500 credit | On-demand billing with no long-term commitment, listed on the HashiCorp pricing page as a general plan type; Vault-specific rates were not shown. |
| Flex | Contact sales | Single or multi-year plans with preferred pricing, listed as a general plan type on the HashiCorp pricing page. |
| Enterprise self-managed | Contact sales | Fully customizable plan for customers who run the software themselves and want maximum control over their environment. |
Checked November 2026.
What HashiCorp Vault does
- Secrets engine
- Secrets are stored centrally and distributed programmatically. The product page describes a single API for secret creation, expiration and rotation, rather than separate tools per system.
- Certificate management
- Certificates can be generated on demand, rotated and revoked. This lets Vault act as an internal certificate authority alongside secrets for the same applications. Rotation reduces the damage from stolen certificates.
- Keys and data protection
- Keys can be distributed, rotated, enabled and disabled, and encryption as a service lets applications encrypt data without holding the keys themselves. That keeps keys away from application code.
- Agent identity
- The product page mentions policies for AI agents, detection of secrets in agent configurations, prompts and workflow definitions, and runtime issuance of short-lived credentials. Confirm details in a demo.
- Exposure scanning
- The page mentions scanning repositories and collaboration tools for exposed credentials, then governing access with least-privilege policies, though it does not name the scanning component.
How HashiCorp Vault handles your data
HashiCorp's privacy page identifies HashiCorp, an IBM Company, acquired by IBM on February 27, 2025, with a mailing address in Armonk, New York, and an EU and UK representative in Mechelen, Belgium. It says HashiCorp does not use automatic decision-making or profiling and refers new customers to IBM terms for data processing and sub-processors. The Vault product page does not state hosting regions, certifications, retention or how AI features process customer data, so the vendor's policy was not checked for those points. Self-managed Vault keeps data on infrastructure you operate.
Where HashiCorp Vault falls short in practice
- Operational weight. Running Vault yourself means managing unsealing, storage, upgrades, high availability and policy as code. Smaller teams without a platform engineer often prefer a hosted product.
- Vault prices not shown. The pricing page read listed Terraform tier prices and general plan types, but no Vault rate. A budget needs a quote or the hosted service's own pricing.
- License not stated. The product page read did not state the software license. Teams that care about open-source terms should read the current license in the repository before standardizing.
Works with
Alternatives to HashiCorp Vault
HashiCorp Vault: common questions
Is HashiCorp Vault now owned by IBM?
Yes. The HashiCorp privacy page states that HashiCorp, Inc. was acquired by IBM on February 27, 2025, and will be integrated into the IBM organization. New customers working directly with IBM are referred to IBM terms for data processing and sub-processors.
What can Vault do for AI agents?
The product page says Vault is positioned for AI agents as well as humans and machines. It describes policies scoped to agents, detection of secrets in agent configurations, LLM prompts and workflow definitions, and short-lived credentials issued at runtime. Ask for a demo.
How is Vault priced?
The pricing page lists pay-as-you-go with a $500 credit, Flex plans and Enterprise self-managed plans as general plan types. The rates shown were for Terraform, not Vault. Ask HashiCorp for Vault prices, including the hosted service. Ask whether the hosted offering is priced separately.
Can Vault manage certificates as well as secrets?
Yes. The product page lists certificates as a core capability, with on-demand generation, rotation and revocation. It also lists keys and data protection through encryption as a service, so Vault can replace several narrow tools. Ask for Vault prices. Both matter.
Where is HashiCorp based?
The privacy page gives a mailing address of c/o 1 North Castle Drive, Armonk, New York, United States, and an EU and UK representative, Technology Law Boutique, in Mechelen, Belgium. The company is described as HashiCorp, an IBM Company. HashiCorp lists IBM as the parent company.