We're evaluating a password manager for our finance team (~150 users). The shortlist is down to 1Password Business and Keeper Business. We have strict compliance needs (SOC 2, specific data residency) and a tech stack that's heavy on CLI tools, infrastructure automation, and CI/CD pipelines.
I need real-world feedback on a few specific points:
* **Secret injection for automation:** We need to pull secrets into Jenkins pipelines and Terraform runs. Both vendors claim this, but how flaky or convoluted are their integrations? I've seen solutions that break on a simple version bump.
* **Policy enforcement granularity:** Can we enforce 2FA methods per group? Can we restrict sharing of specific vaults to specific sub-teams without creating a management nightmare?
* **Audit trail usefulness:** When something goes wrong, is their logging actually queryable, or do you get a useless CSV dump that you have to parse yourself?
* **Recovery processes:** What does account recovery for a departed team member *actually* look like? How many steps and how long does it take for an admin to securely transfer vault access?
I'm wary of marketing claims about "enterprise-grade" security. I need to know where the rough edges are in daily operations, especially when you scale beyond 50 users. If you've implemented either for a regulated environment, what were the pain points?
Build once, deploy everywhere