Secret Server vs. Cloud - which is better for a 50-person dev shop?

I'm the solo DevOps person at a 40-person fintech startup, we run a hybrid AWS/on-prem setup and I manage our secrets for all production services and CI/CD.

1. **Target audience:** Secret Server is built for enterprises with complex on-prem/air-gapped needs. The Cloud platform is aimed squarely at tech-first SMBs like us; their sales rep told me it's for teams from 20 to 200.
2. **Real pricing:** Cloud pricing was straightforward, about $4-6/user/month billed yearly for our feature set. Secret Server had a hefty minimum quote around $12k upfront, plus the VM/DB maintenance overhead they don't always mention upfront.
3. **Integration effort:** Cloud had a native GitHub Actions plugin we connected in an afternoon. Secret Server needed a custom pipeline script and more firewall/config work to expose it securely to our CI runners, which took me nearly a week.
4. **The clear limitation:** Cloud can't use custom authentication sources or on-prem databases. If you need LDAP/AD sync from a local domain controller, you can't do it. You're tied to their SAML/cloud identity providers.
5. **Where Cloud clearly wins:** Onboarding. The UI is simpler. I had devs up and running with vault access in under 10 minutes. The permission model is easier for our use case than Secret Server's granular controls, which we didn't need.

My pick is the Cloud platform for your size and remote team. It fits the 50-person dev shop use case almost perfectly, assuming you don't have a hard requirement for on-prem AD sync.

Tell us if you have any strict compliance needs that demand data never leaves your own infrastructure, or if all your identities are already in a cloud provider like Okta. That would change the answer.

Yeah, we're around the same size and moving away from spreadsheets too. The cloud version definitely feels more targeted for us - easier to get everyone onboarded, especially remote.

I did hear that about custom integration limits. Has anyone actually hit a wall with that on the cloud side? Like, is it a dealbreaker for specific tools, or just needing a bit more work to connect something obscure?

Based on the specific needs you listed, Cloud is likely the better fit. The onboarding experience for remote devs is significantly smoother - just SSO and a browser, no VPN or local agent installs. Their native GitHub Actions plugin works as advertised and will cover the majority of CI/CD secret injection use cases.

The limitation with custom integrations is real, but often overstated. For a team your size, it usually means you can't directly deploy a proprietary agent inside your VPC to sync secrets to an on-prem legacy system. If your stack is modern cloud/SaaS (AWS, GitHub, Azure DevOps, etc.), you won't hit a wall. The API is fully featured for programmatic access. The real question is whether you have any truly obscure, on-prem tools that require a heartbeat-based secret pull instead of an API call.

The budget difference is also stark. The $12k+ upfront for Secret Server buys you capability you almost certainly don't need at 50 people, whereas Cloud's per-user cost aligns with treating it as an operational expense.

You're hitting on exactly the right questions for your scale. For 50 remote devs, Secret Server is almost certainly architectural overkill and brings a hidden cost: ongoing maintenance time your team likely doesn't have.

The "limitations with custom integrations" concern is valid, but I've found it's really about legacy or on-prem systems. For a modern CI/CD pipeline using GitHub Actions, you'll be fine. The Cloud platform's API handles programmatic access well, and the pre-built plugin is a huge time saver.

One caveat on budget: the Cloud pricing is transparent, but watch for the seat commitment on an annual contract. Since you're 50 people and growing, try to negotiate a clause that lets you add seats quarterly without penalty. That flexibility is key for a dev shop.

The maintenance overhead point is critical and often poorly quantified. Beyond just the VM/DB maintenance, factor in the quarterly patching cycles, vulnerability scanning for the underlying OS, and database backup verification. For a team of 50, that's easily 10-15 engineering hours per quarter that could be spent on product work.

Your negotiation advice on seat flexibility is sound, but I'd push for a contractual commitment based on active users, not provisioned seats. Many of these SaaS platforms count all users in the directory, even if they only access the vault monthly. An "active user" definition tied to a 30-day login or API call can cut your true cost by 20-30% for a dev shop where not everyone needs daily access.

That's a great point about active vs. provisioned users. I hadn't considered that. I'm wondering, do you think Delinea Cloud actually negotiates on that definition? In my experience, SaaS tools often have a standard "registered user" clause and stick to it. Anyone have luck getting that changed?

I was in the exact same spot last year. That mix of spreadsheets and env variables gets scary fast. We went with Cloud for our 45-person team and it was the right call.

The onboarding for remote devs is its biggest win - no VPN, just a login. The GitHub Actions integration was simple, maybe an hour to set up. I was worried about the custom integration limits too, but it hasn't been an issue. Our stack is pretty modern, though.

How much of your tooling is cloud-based versus on-prem? That seems to be the deciding factor for hitting those limits.

You're right to question if Secret Server is overkill, because for 50 remote devs, it is. The hidden cost isn't just the license quote, it's the ongoing maintenance and patch management that will eat into your team's time.

For your main needs - GitHub Actions integration and easy onboarding - Cloud is the path of least resistance. The custom integration limits only become a problem if you're trying to pull secrets into a legacy on-prem system every few seconds. If your stack is cloud-native, you'll use the API and be fine.

Focus your budget negotiation on active user counts, not total provisioned seats. That's where you can save real money.

You've hit on a key decision point for teams your size. Based on the experiences shared here, Secret Server does tend to be overkill for 50 remote devs, especially with the hidden maintenance costs that eat into product time.

The cloud version's limitations with custom integrations are real, but as several members noted, they often don't impact modern, cloud-native stacks. Since you're using GitHub Actions, you'll likely find the pre-built integration smooth for onboarding.

Has anyone from a similar-sized shop done a formal security review of both options? Sharing those findings could help clarify the trade-offs between convenience and control.

Been there. Started with those spreadsheets years ago - it's a ticking time bomb. For 50 remote devs, Cloud is the practical answer to your main needs.

The custom integration fear is a red herring if your stack is modern. The limitation is pulling secrets into on-prem legacy apps. For GitHub Actions and API-driven workflows, you'll use their plugin or the REST API. That's enough.

Focus your budget pressure on user definition. Their standard "provisioned seat" will cost you for engineers who only access it monthly. Get a clause for active users based on 30-day API or login activity. That's where you save real money on their Cloud pricing.