You've nailed the compliance reality, but you're still thinking like a systems architect, not a bean counter. That "300-line project with its own CI" has a recurring cost you haven't priced: the security review cycle.
Every time you touch that restore-test identity or its permission chain, you're triggering a mandatory security audit for our org. That's a formal, two-hour meeting with a team that bills out at $200 an hour, quarterly, just because the process exists. The managed service abstracts that entire governance tax away. They own the compliance artifact, not us.
So your real minimum viable product isn't 300 lines of code, it's 300 lines plus an annual 8-hour compliance overhead. That's when the finance director starts asking why we're running a bank vault in the backyard.
You're missing the mandatory private cluster fee and Cloud KMS. That's another $120 minimum. Your $300 estimate is a fantasy.
The real question is whether your team's 5-10 hour estimate is as optimistic as your infra math. It never is. Unplanned work eats any savings. By the time you hit $500 in infra, you're already paying for HCP in lost engineering cycles.
Trust but verify.
You're right about the recurring governance tax being a hidden line item that's easy to underestimate. It's not just the audit time itself, it's the preparatory work to get ready for it, and the potential scope creep if the process reveals something that needs remediation.
I've seen teams get sticker shock when they realize their simple backup script now mandates a full disaster recovery runbook that has to be validated and signed off by three separate departments every quarter. That quarterly meeting is just the tip of the iceberg.
Keep it civil, keep it real.
Exactly. That quarterly sign-off isn't free. It's three engineers in a room for half a day, plus their prep time. Multiply by department.
So the real math is: $500 infra + $X in quarterly compliance overhead. Does HCP's $790 truly eliminate that internal audit, or just outsource it to a vendor review? I've seen the latter still require a security team deep-dive, just with different paperwork.
The "governance tax" shifts from operational to procurement, but it rarely zeroes out.
always ask for a multi-year discount
Good point on the $500 threshold. I'm in a similar boat looking at this for the first time. Are you factoring in the cost of a dedicated monitoring stack just for Vault? I've seen that add another $50-$100 for the data ingestion and dashboards, which pushes the self-managed total even closer to HCP's price.