penv-cloud
Pricing

One price per person.

Your invoice counts the people who sign in. Every machine gets its own scoped token at no cost, on every plan.

Billing unit
1 human seat
Machines
0 charged
Encryption floor
Envelope + AWS KMS
Every plan

What each tier includes.

Encrypted, each value under its own key, on every plan.

Compare plansFreeProEnterprise
Limits
Projects3UnlimitedUnlimited
Environments per project3UnlimitedUnlimited
Human seats3UnlimitedUnlimited
Machine identitiesUnlimitedUnlimitedUnlimited
API rate limit · read / write per min (a bulk read costs one per secret)240 / 60480 / 120Custom
Encryption & isolation
Envelope encryption + AWS KMS
Address-bound ciphertext (AAD)
Postgres RLS org isolation
Keyless CI auth (OIDC)
Customer-held wrapping key (BYOK)Your AWS, GCP, Azure or Vault key
Audit & recovery
Insert-only audit log
Audit retention7 days90 daysCustom
Point-in-time version history
Audit log streamingSigned batches, minutes behind
Access & support
SSO via SAML
SupportCommunityPriority emailSLA + named SE
Compliance commitmentsBy contract

Not on any plan

Why, in detail →
Dedicated isolation.
Shared infrastructure, no residency choice
Hash-chained audit.
Insert-only, no chain

Purchasing-power pricing

We adjust prices for local purchasing power in several regions and route African markets through Paystack. Regional figures come from a reviewed price book rather than live foreign exchange, and checkout confirms the amount you pay.
Questions

Pricing questions.

01What counts as a seat?
A human who signs in to the console. Machine identities are free and unlimited on every plan.
02Do machines or their credentials cost anything?

Seats are the only billable unit. Create as many scoped machine identities as you like; the bill tracks human seats and nothing else.

This is where we differ from Infisical, which prices per identity and defines an identity as "any human or machine that authenticates to Infisical." Under that model a CI pipeline with its own credentials is a billable line. Under ours it is zero.

03Is Free encrypted the same way as Pro and Enterprise?

Yes, and it is not a tier. Every plan gets AES-256-GCM envelope encryption under a per-value data key wrapped by AWS KMS, address-bound ciphertext, the same row-level isolation, and keyless OIDC auth for CI. Plans differ on how much you can put in, not on how well it is held.

Keyless CI auth is the one worth naming: Doppler added OIDC service-account identities inMarch 2025, on its Team and Enterprise plans. We put it on Free.

04Are there add-ons on top of the seat price?

No. A seat is the whole price, and custom roles, SSO on Enterprise, and every security control on the security page are included in the tier that carries them.

For contrast, Doppler's Team plan sells custom roles, user groups, and integration syncs as separate $9/seat/month add-ons. Figures are their public list prices as of August 2026.

05What does Enterprise not get me?

Dedicated isolation, data residency, and a hash-chained audit trail are not built, on any plan. Enterprise buys unlimited capacity, SSO, support, contractual commitments, audit log streaming to a sink you own, and the option to wrap your secrets with a KMS key you own.

The security page says the same thing in more detail.

06Are the regional prices exact?
They are indicative. We publish purchasing-power prices from a reviewed price book, and checkout confirms the final amount and currency from your billing country.
07When can I subscribe to Pro?
In-product checkout ships next phase. Join the waitlist and we will bring you in as billing goes live.

Get your keys out of the chat.

Read the security pageJoin the waitlist

Three people free. Machines never take a seat.