Secret management pricing, without the sales call.

Anyone with a seat in your organisation who can sign in and read or write a secret. Service tokens are not members, so a CI pipeline that pulls secrets on every build costs nothing — and neither does a Kubernetes workload or an AI agent. A pending invitation is not counted until it is accepted, and removing someone frees their seat immediately. Seats are billed from a minimum on some plans — Team from 3 and Enterprise from 10 — so a smaller group on one of those pays the minimum rather than a lower number; Free and Pro have no floor. Nothing stops you running with fewer people than you are billed for.

Yes, on every plan including Free, and we will put it in writing. Only humans are billed. The reason is not generosity: a secret read runs on Cloudflare’s edge and makes no external network call, so a service token costs us a fraction of a cent. Billing per identity would also punish the one habit a secret manager exists to encourage — a separate, narrowly scoped token per workload rather than one shared credential in ten places.

Who can read production. On Pro every member sees every environment, which is fine while everyone on the team is trusted with everything. Team adds roles and per-environment grants, so a contractor can hold staging and not production. That is the whole gate, and it is why Pro has no member limit — most teams cross it because somebody joins who should not see prod, not because they hit a ceiling we invented.

It will not be. OIDC single sign-on is not built yet, and when it lands it is included from Team at no extra cost rather than priced separately — we are building it ourselves, so it costs us nothing per customer and charging for it would be indefensible. SAML is the exception and will be a $199 per connection add-on from Team, because it is brokered through WorkOS and they charge us $125 per connection per month whether anyone signs in or not; Enterprise includes it, because the contract floor already covers the connection. Directory sync is included with Enterprise on the same reasoning and is not sold below it. None of this is available today, on any plan. Self-hosted deployments will bring their own identity provider and pay nothing for any of it.

Nothing breaks and nothing is deleted. Free covers 1 organisation, 5 projects, 3 environments in each of them and 3 members, and the limits apply now: the next one of any of those past the limit is refused, with the plan that allows more named. Everything already stored keeps working, stays editable and the CLI keeps running. Going over the included fetch allowance is never blocked.

No, and this is the one commitment on this page we would rather be held to than any other. A declined card, a cancelled plan, an expired subscription or a fetch allowance ten times overspent all leave xecret run working exactly as before. Access is degraded in the dashboard and we send an email; the data path is never touched. A secret manager that can stop a deploy over an invoice is worse than the .env file it replaced.

Yes, and it is what the page opens on. In US dollars, billed yearly, Pro is $5 a member a month and Team is $12 — charged as $60 and $144 a member a year, a third to two fifths below the monthly rate. The other four sheets carry their own figures; the cards above show whichever one you are reading. The exact saving differs by plan as well as by currency, because each sheet is a set of deliberate prices rather than one number converted: on the euro sheet it is 33 per cent on Pro and 38 on Team, and on the rupee sheet 40 on Pro and 37 on Team. That is why the chip beside the toggle says "up to" — it carries the better of the two figures for whichever sheet you are reading, so it is an upper bound rather than a promise for every card. The controls above the plans and above the comparison table switch every price on the page and stay in step with each other. Monthly stays available on both, and neither is billed at all during pre-alpha.

Because a price that is reasonable in San Francisco is not reasonable in Bengaluru, and pretending otherwise just means we do not sell there. Pro and Team are priced separately in rupees, yen and Australian dollars rather than converted. The rate follows your billing country and the card that pays, it is locked for twelve months so it cannot be changed by travelling, and it does not apply to Enterprise contracts.

No. There is no billing system connected yet, so there is nothing to enter a card into. Every organisation starts on Free, and each plan’s limits and features apply as this page shows them; the ones marked "Coming soon" are not built for anybody. Nothing will start charging without notice, and nobody is converted to a paid plan silently.

Yes. The server is AGPL-3.0 and the CLI is MIT, so you can run the whole thing on your own infrastructure. No feature is held back for a paid tier and there is no licence key to buy — single sign-on included, once it exists; it is not built for anybody yet. What an Enterprise self-hosting licence buys is a commercial, non-AGPL licence, priority security notification, help with the root-key escrow ceremony and an SLA. None of that is a feature we removed from the code.

Your organisation drops to the Free plan. Nothing is deleted: every secret is still readable, still exportable and still injectable by the CLI. If you are over the free limits, new members, projects and environments are blocked until you are back inside them or you export and self-host. We will not hold a credential hostage over a billing dispute.

Yes, and there is no automated flow for it — open an issue on GitHub or email us with a link to the project and we will sort it by hand. Public open-source projects, registered non-profits and student teams are the cases we intend to approve. Because a person reads every request, ask before you pay rather than after.

Yes, in both directions and at any time. Moving up takes effect immediately and is prorated for the rest of the period; moving down takes effect at the end of the period you have already paid for, and nothing is deleted when it does. None of this is live yet, because no plan is billed yet.