Infisical: product and architecture
This Infisical review covers an open-source secrets platform that a team runs itself or buys as a managed cloud, and that is sold explicitly as a way off HashiCorp Vault. Infisical stores application secrets, issues and tracks X.509 certificates through its own PKI, and brokers privileged access to databases and servers — three jobs that usually arrive as three products. The core is MIT-licensed and self-hostable; Infisical Cloud runs it in US and EU regions. We evaluated it on its public documentation, its pricing page, the feature set advertised on its own site, and its GitHub repository, which carried 29,318 stars when we checked on 19 September 2026.
Overview
Infisical is a security platform aimed at the engineering team that already has secrets scattered across .env files, CI variables and a cloud provider's parameter store, and wants one place to hold them. The company positions the product directly against HashiCorp Vault, and does so on operational cost rather than capability: it publishes a Vault TCO calculator and ships migration tooling for teams moving across. That is an unusually specific pitch, and it tells you who the product is for — a team that has looked at running Vault, priced the engineering time, and flinched.
The scope has widened past secrets. The platform now covers certificate lifecycle management with a PKI dashboard, and privileged access management with session recording. Each of those is a separate purchase in most estates, which is the second half of the argument: consolidation onto one control plane rather than three.
Key Features and Architecture
Secrets management is the core. Access is scoped by environment, path and identity through fine-grained RBAC, so a service account can be granted exactly one path in one environment rather than a whole project. Secret rotation runs on a schedule, and dynamic secrets issue short-lived credentials scoped to each request — the pattern that removes long-lived database passwords from an estate entirely. Approval workflows sit in front of sensitive changes, requiring review before a change reaches production.
The PKI side is a full certificate authority view rather than a bolt-on. The PKI dashboard lists every CA and certificate across an estate with expiry warnings; certificate discovery scans environments continuously for certificates already deployed, which is aimed squarely at the certificate nobody remembers issuing; and certificate sync pushes issued certificates directly into AWS load balancers and other external systems, so renewal does not end in a manual upload.
Privileged access management is the newest layer. Access accounts let an engineer launch into a database or a server from the browser, credential rotation cycles the underlying privileged credentials automatically, and session recording captures what happened with AI-generated summaries over the recordings.
Integration is through a CLI, SDKs and a REST API. The Python SDK is published as infisicalsdk and the platform itself is TypeScript.
Ideal Use Cases
Infisical fits a mid-sized engineering organisation — roughly ten to a few hundred engineers — that has outgrown environment variables and does not want to staff a Vault operator. The free tier's five identities make it viable for a small team to run properly rather than improvise.
It suits a team that needs certificates and secrets under one roof. If your certificate estate is currently a spreadsheet and an annual scramble, the discovery and expiry alerting are the reason to look.
It suits regulated teams that need approval workflows and session recordings as evidence, without buying a separate privileged-access product.
Do not use Infisical if your organisation has already invested in Vault operators and Vault-specific tooling: the migration is real work, and the argument for moving is operational cost, not a capability you cannot get where you are. It is also the wrong choice if you need a secrets engine embedded in a cloud provider's IAM to the exclusion of anything else — a managed parameter store will always integrate more tightly with its own cloud.
Pricing and Licensing
Infisical is freemium with a genuinely usable free tier: perpetually free, with 5 identities, unlimited projects and 3 environments. That is enough for a small team to run the product properly rather than as a trial.
Paid plans are not published as a simple per-seat number. Pro covers secrets management and offers a 30-day trial with no card required; privileged access carries its own 14-day trial. Enterprise is custom-priced. SSO enforcement, LDAP and SCIM sit behind a paid plan, which is the usual place this category puts the identity integrations an enterprise cannot go without — worth pricing early if you need them, because they are not on the free tier.
Self-hosting the MIT-licensed core carries no licence fee at all. The cost there is the infrastructure and the operational work, which is precisely the number the vendor's own TCO calculator invites you to compare against running Vault.
We recommend treating the quoted plans as a conversation rather than a price list: the published figures cover the free tier, and everything above it is scoped to your identity count and which of the three product lines you take.
Strengths & Trade-offs
Pros
- A free tier you can actually run on. Five identities, unlimited projects and three environments is a working configuration, not a demo.
- MIT-licensed core with a managed option. Self-host it, or buy Infisical Cloud in a US or EU region, without changing product.
- Certificate discovery, not just issuance. Finding certificates already deployed is the part most PKI tooling leaves to you.
- Dynamic secrets and scheduled rotation. Short-lived, per-request credentials are supported directly rather than through a plugin you maintain.
- Migration tooling from Vault. The vendor supplies the path it advertises, rather than leaving the move as an exercise.
Cons
- Paid pricing is not published as rates. You cannot budget Pro or Enterprise from the website; the free tier is the only firm number.
- Identity integrations are gated. SSO enforcement, LDAP and SCIM require a paid plan, which pulls most enterprises off the free tier immediately.
- Three product lines, one young platform. Secrets, PKI and privileged access are each mature categories with specialist incumbents; breadth this new deserves a proof of concept per line rather than one.