Managed Vault Hosting — production-ready from $15 a month
Secrets management and data protection. Deployed on your own dedicated instance in AWS, Azure, or GCP, kept patched, backed up, and monitored by ManageStacks — standard Vault, no lock-in.
Vault on ManageStacks is HashiCorp Vault (or OpenBao, the Linux Foundation Apache-2.0 fork) deployed to your own AWS, Azure, or GCP region — priced flat at $29 per instance per month with cloud-KMS-based auto-unseal, dynamic secrets for databases and cloud providers, PKI + SSH certificate management, and full audit logging. Materially cheaper than AWS Secrets Manager or Doppler at scale, and secrets never leave your cloud region. Licence-safe: pick HashiCorp Vault (BSL 1.1) or OpenBao (Apache-2.0) based on your posture on the 2023 licence change.
What does Vault do, and why do teams deploy it?
HashiCorp Vault is the de-facto tool for securely accessing secrets — API keys, database passwords, TLS certificates, encryption keys — and for dynamic secrets that are generated on demand for databases and cloud providers. It provides a unified interface with tight identity-based access control and detailed audit logging.
Vault's dynamic-secrets feature is unique: instead of storing static credentials, Vault generates short-lived credentials on demand for Postgres, MySQL, MongoDB, AWS IAM, GCP IAM, SSH, and Kubernetes — meaning your applications never handle long-lived secrets, and revocation is automatic when a lease expires. The PKI and SSH engines let Vault issue TLS certificates and SSH certificates on demand, replacing traditional CA setups.
In 2023 HashiCorp changed Vault's licence from MPL 2.0 to BSL 1.1 (Business Source Licence — source-available but restricts commercial reselling). The Linux Foundation forked the last MPL version as OpenBao. Both are wire-compatible; ManageStacks supports both, so you pick based on your licence posture.
Self-hosting Vault means running Vault with a storage backend (Raft integrated storage is now recommended), configuring auto-unseal against your cloud KMS (essential — otherwise Vault starts sealed and manual unseal keys are needed after every restart), setting up HA replicas (Vault Enterprise features like DR replication are BSL-only), and coordinating upgrades. ManageStacks handles all of that.
- Centralised secrets management with identity-based access policies
- Dynamic secrets for Postgres, MySQL, MongoDB, AWS IAM, GCP IAM, K8s
- Encryption as a service — encrypt/decrypt via API without storing keys client-side
- PKI engine — issue TLS certificates from an internal CA on demand
- SSH engine — issue SSH certificates for cert-based host auth
- Cloud-KMS auto-unseal (AWS KMS, GCP KMS, Azure Key Vault)
Secrets management and data protection
What does managed Vault hosting cost?
Flat per-app pricing, in your chosen AWS, Azure, or GCP region. No per-user pricing — a busy deployment costs the same as a quiet one.
Starter
Staging and internal tools. Dedicated instance, TLS, daily backups, managed upgrades.
Standard
Production workloads. Adds monitoring, staging environment, region choice, priority support.
Business
High-traffic and compliance workloads. Adds a high-availability replica and same-day support.
24×7 SRE retainer
Round-the-clock on-call across every hosted application, for teams that need a pager answered at 3am.
Self-hosting Vault vs managed — what does it really cost?
The software is free. The engineer-hours are not.
Running it yourself
- Install Vault, choose storage backend (Raft vs external), configure it
- Set up cloud-KMS auto-unseal by hand — critical for production
- Configure HA replicas + Raft cluster; test failover
- Set up audit logging pipeline; wire in your monitoring
- Track the BSL vs OpenBao licence question yourself
On ManageStacks
- Subscribe through your AWS, Azure, or GCP marketplace
- Vault (or OpenBao) comes up with Raft storage + KMS auto-unseal configured
- HA-mode with 3+ nodes available on Business+
- Audit logs stream to your monitoring stack automatically
- Rolling version upgrades handled by us
Vault on ManageStacks vs the alternatives
How Vault on ManageStacks compares to the hyperscaler secrets managers and the developer-focused vendor.
| Vault on ManageStacksUs | AWS Secrets Manager | GCP Secret Manager | Doppler | |
|---|---|---|---|---|
| Deployment | Managed on your AWS, Azure, or GCP | AWS-managed | GCP-managed | Vendor-hosted |
| Data residency | Your cloud region | AWS region | GCP region | Vendor infrastructure |
| Pricing basis | Flat per instance | Per secret + per API call | Per secret + per access | Per user + per project |
| Dynamic secrets | Yes (Postgres, MySQL, AWS, K8s, SSH) | Limited to a few engines | Limited | No |
| License | BSL 1.1 or Apache-2.0 (OpenBao) | No (proprietary) | No (proprietary) | No (proprietary) |
| Auto-unseal via cloud KMS | Yes (AWS/GCP/Azure KMS) | N/A (managed) | N/A | N/A |
Provisioning, upgrades, backups and monitoring on your team’s plate.
What does running Vault yourself involve?
ManageStacks deploys Vault (or OpenBao) with cloud-KMS-based auto-unseal, Raft integrated storage, TLS, and audit logging enabled. We handle HA setup, encrypted backups, and rolling version upgrades — you configure the auth methods, secret engines, and policies for your infrastructure.
Vault key numbers
How long from subscribing to a live instance?
Subscribe
Subscribe to ManageStacks through your AWS, Azure, or GCP marketplace.
Choose engine
Pick HashiCorp Vault (BSL 1.1) or OpenBao (Apache-2.0).
Provision
Vault spins up with Raft storage, cloud-KMS auto-unseal, TLS, and audit logging — typically 3-5 minutes.
Configure auth + engines
Set up auth methods (Kubernetes, AWS IAM, OIDC), enable secret engines (KV, Postgres, PKI), and write policies.
When is self-hosting Vault the right answer instead?
“Managed hosting is not always the correct call.”
Self-host when a platform team already runs the infrastructure and on-call rotation to operate Vault at genuinely low marginal cost. Self-host when compliance requires an air-gapped or on-premises deployment that no hosted option can satisfy. And self-host when the deployment depends on heavy customisation with a fast internal build-deploy loop, because an internal release process will beat any managed change process.
For everyone else — teams whose engineers have better things to do than shepherd upgrades — managed hosting is cheaper than the hours it replaces.
Which cloud should Vault run on — AWS, Azure or GCP?
For most workloads, the choice of cloud matters less than proximity: run Vault in the same cloud and region as the applications and data it talks to, because every request between them adds a round trip. The underlying compute performs equivalently across AWS, Azure, and GCP.
In practice, an existing cloud footprint decides it. All plans support all three clouds, and moving regions later is a scheduled migration, not a rebuild.
Deepest managed-service catalog, default when there's no existing footprint
Best fit for teams already on Microsoft 365 or Entra ID
Strongest for data/analytics-adjacent workloads
Every plan supports AWS, Azure, and GCP — region choice included.
Common questions about Vault on ManageStacks
HashiCorp Vault or OpenBao — which should I pick?
OpenBao is the Linux Foundation Apache-2.0 fork of Vault from before the 2023 BSL licence change. Both currently share the same core codebase and API. Pick OpenBao if licence purity matters (OSI-approved, no commercial-reselling restrictions) or if you're wary of HashiCorp's IBM acquisition. Pick HashiCorp Vault if you want the vendor's roadmap and specifically need Vault Enterprise features (DR replication, HSM support) via a HashiCorp licence.
How does this compare to AWS Secrets Manager, GCP Secret Manager, or Doppler?
AWS/GCP Secret Manager are per-secret + per-API-call priced. Doppler is per-user + per-project. All grow linearly with scale. ManageStacks Vault is flat $29 per instance regardless of secret count or call volume. For teams beyond ~20 users or applications with high secret-fetch volume, self-hosted Vault on ManageStacks is materially cheaper. AWS/GCP Secret Manager win on tight IAM integration; Doppler on the developer-experience polish; Vault on dynamic secrets and PKI features that no vendor tool matches.
How does auto-unseal work?
Vault stores its master key encrypted by your cloud KMS (AWS KMS, GCP KMS, Azure Key Vault). On restart, Vault fetches the KMS-encrypted key, decrypts via KMS, and auto-unseals — no manual unseal keys needed. This is essential for production; without auto-unseal, every restart requires manual key entry.
What are dynamic secrets and why do they matter?
Instead of storing a long-lived Postgres password, Vault generates a new Postgres user with a random password on every request, with a TTL (say 1 hour). Your app fetches the credential, uses it, and Vault auto-revokes when the lease expires. No long-lived secrets in circulation, and revocation is automatic. Available for Postgres, MySQL, MongoDB, AWS IAM (STS), GCP IAM, K8s ServiceAccount tokens, SSH, and more.
How is HA configured?
Vault runs with Raft integrated storage (recommended) or with an external backend (Postgres, Consul). Standard plan is a single Vault; Business+ deploys 3+ Vault nodes with Raft consensus for automatic failover. DR replication (secondary DC) is a Vault Enterprise feature — only available if you bring your own HashiCorp licence.
Does ManageStacks handle Vault version upgrades?
Yes. Rolling upgrades on Raft HA setups keep Vault available throughout. We track upstream releases and validate against a staging clone of your data before rolling forward.
Can I integrate Vault with Kubernetes?
Yes. Vault Agent Injector (via a K8s mutating webhook) auto-injects secrets into pods without your app needing Vault-specific code. K8s auth method lets pods authenticate to Vault using their ServiceAccount token. Fully documented pattern.
What happens to my secrets if I want to move off?
Vault provides `vault operator raft snapshot save` for full backup. Restore into any Vault or OpenBao deployment. Secrets, policies, auth methods, and audit devices all persist. Migration off is a supported operation.
Run Vault without carrying the pager
Subscribe through your AWS, Azure, or GCP marketplace. We handle provisioning, SSL, monitoring, backups, updates, and security. From $15/mo.