№ 01 — Pricing
Pricing that scales
with your secrets.
Hosted at ferrvault.com — EU region. Pay per user, not per secret.
Free
$0forever
- Up to 100 secrets
- 5 users, 1 organization, 3 projects
- CLI injection + K8s operator
- 7-day audit log retention
- Community support
Most popular
Team
$19/ user / month
- Unlimited secrets
- Versioned rotation
- Advanced audit log (1 year)
- Webhook notifications
- Project-scoped RBAC
- Priority email support
Business
$79/ user / month
- Everything in Team
- SSO / SAML / SCIM
- BYOK (AWS, GCP, Vault Transit)
- IP allowlist + full audit log
- SOC2 + DPA + custom MSA
- Dedicated Slack channel
№ 02 — FAQ
Frequently asked
When does FerrVault launch?
Early access is open via the waitlist. We onboard new teams every two weeks. Public launch targeted for Q3 2026.
Can I migrate from Vault / Doppler / Infisical?
Yes — ferrvault import reads exports from Vault, Doppler, Infisical, and 1Password Secrets Automation. The CLI handles namespace mapping and key renaming.
What does BYOK actually cover?
You provide a KEK (Key Encryption Key) in your own KMS — AWS KMS, GCP Cloud KMS, HashiCorp Vault Transit, or Azure Key Vault. FerrVault generates and wraps DEKs (Data Encryption Keys) per secret. Your KEK never leaves your KMS.
Where is my data hosted?
In the EU. Encrypted secrets, audit logs, and backups stay in EU-region infrastructure under EU jurisdiction. No cross-Atlantic replication in the default configuration.