I’ve been researching secret management for our SaaS platform, and Vault is obviously the industry standard. But the pricing jump from the open-source version to the paid one (HCP Vault or self-hosted Enterprise) is significant.
My team already manages a lot of infrastructure, and the appeal of a fully-managed service like OVH Managed Vault is strong. The cost difference is hard to ignore. I’ve read the feature comparison matrices, but I’m trying to understand the practical, day-to-day differences.
For those running Vault Enterprise or HCP Vault in production for B2B apps:
* What specific paid features became indispensable that you didn’t anticipate?
* How does the operational overhead of managing OVH (or another open-source alternative) compare to the value of Vault’s support and stability guarantees?
* Are there scaling or security pitfalls in the open-source version that only become apparent later?
I’m particularly interested in use cases around dynamic secrets for databases and secure introduction for our own platform’s microservices. The open-source version does this, but I’m wary of hidden complexity or gaps we might miss as a smaller team.
We run a B2B SaaS in the HR tech space (~80 employees) with a microservice stack on EKS. After two years on the open-source Vault, we moved to HCP Vault about eight months ago for our production secret management, specifically for dynamic database credentials and secure service-to-service auth.
Here's a breakdown based on our experience:
1. **Operational Overhead and Scaling:** The hidden cost of OSS Vault isn't licensing, it's dedicated headcount. In my last shop, a team of three spent roughly 20% of their time on Vault upkeep: storage backend migrations, performance tuning, and monitoring seal/unseal. HCP Vault costs us ~$0.0006 per secret operation (about $650/month), but it freed a senior engineer to work on product features. For our throughput (~1.2k req/s at peak), self-managed would have required at least three nodes and more sophisticated autoscaling config we lacked.
2. **Indispensable Paid Feature - Namespaces:** We didn't appreciate this until we scaled. Vault Enterprise namespaces are a hard requirement for multi-tenancy if your B2B app needs true tenant isolation for secrets. We simulate this in OSS with clever pathing, but audit logs and authentication boundaries become a tangled mess. For compliance (SOC 2), our auditors flagged the OSS workaround. Namespaces gave us a clean, maintainable way to segment customer data.
3. **Support and Stability:** With OSS, you're on your own for recovery. We had a critical seal/unseal automation failure at 2 AM that took down a staging environment for 90 minutes. HCP's SLA (99.9%) and the fact they handle availability, backups, and patching has been worth the premium for production. For non-critical internal apps, we still use an OVH-managed OSS instance.
4. **Integration and Dynamic Secrets:** The core engine for dynamic secrets is identical. The practical difference is in governance. Vault Enterprise's Sentinel policies allowed us to enforce rules like "dynamic database roles can only be created with a 24-hour TTL" centrally. In OSS, we relied on team discipline and peer review, which failed twice, creating roles with 30-day TTLs.
I'd recommend HCP Vault if your core platform is customer-facing and directly impacts revenue or compliance. For internal tools or staging, an OVH-managed OSS cluster is a sane cost-saving. The deciding factors are your team size for dedicated platform SRE and whether you need multi-tenancy features for your SaaS clients.