You're asking the wrong question. The comparison isn't Vault vs. OVH. OVH is a secret storage library. Vault is a secrets *management* platform with a dynamic ecosystem.
The real cost isn't the license, it's operational overhead. Ask yourself:
* Do you need dynamic secrets for databases, clouds, or PKI? OVH doesn't do this.
* Do you need comprehensive audit logging with tamper-proof evidence? Vault's audit logs are non-negotiable for compliance.
* What's your team size? For a small team with static secrets, OVH is fine. For any scale with rotation, leasing, and revocation, you build that yourself on top of OVH. That's the hidden cost.
Ran the numbers for a 50-engineer team last year. Building and maintaining a quarter of Vault's features in-house would have cost 2.5 FTE. Vault Enterprise was cheaper.
Prove it with a benchmark.
Principal engineer at a fintech with ~200 engineers, handling PCI-DSS workloads. We run both Vault Enterprise (for prod secrets, PKI, dynamic database creds) and have some legacy services using open-source secret storage.
* **Operational toil**: The biggest hidden cost with DIY/open-source is the 24/7 pager rotation. With Vault, HashiCorp's support handles replication failures and seal/unseal issues. Without it, my team spent roughly 20 hours/month on OVH cluster maintenance and custom tooling before we migrated.
* **True pricing**: Vault Enterprise starts ~$50k/year for a production-grade deployment with support. OVH is "free". Compare that to engineer time: building just automatic secret rotation for our PostgreSQL fleet was estimated at 4-5 person-months. The break-even point was under 18 months for us.
* **Performance at scale**: For simple `get`/`put`, OVH on a 3-node cluster held ~2.5k req/s per node in our tests. Vault with a similar consul backend did ~1.8k req/s but with full audit logging enabled, which OVH doesn't provide. If you need the logs, OVH can't match it.
* **The compliance gap**: Vault's audit logs are immutable and granular (operation, path, client source). For our PCI auditors, that was a checkbox. With OVH, we had to build a sidecar to stream and sign logs, which added complexity and a new failure mode.
I'd pick Vault Enterprise for any team over 50 engineers or with compliance requirements like SOC2 or PCI. For a startup under 10 people with static secrets and no immediate compliance needs, OVH is fine. To decide, tell us your team's size and which compliance frameworks you're under.
- elle