European Alternatives to HashiCorp Vault
Looking for a European alternative to HashiCorp Vault? HashiCorp licenses Vault under the Business Source License 1.1, which limits offering the software as a competing hosted service, and its privacy policy states that HashiCorp has been acquired by IBM and lists an Armonk, New York address. Teams that want a European operator, a fully open licence or a different pricing unit are comparing replacements.
The European tools below include managed and supported OpenBao services from Germany and Switzerland, an Israeli SaaS platform, and secret stores inside French and German clouds.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects which tools are listed. Editorial policy
10 European Alternatives to HashiCorp Vault
ayedo
Managed OpenBao on German infrastructure, run for you
Adfinis Secretz Enterprise
Flat-fee support subscription for running OpenBao in production
Akeyless
SaaS secrets platform with zero-knowledge key handling
Passwork
Self-hosted password and secrets vault with REST API
Scaleway
Paris cloud with a pay-per-version Secret Manager
STACKIT
Schwarz Group cloud with a Vault-style key-value store
OVHcloud
Public cloud secret vault with Vault-compatible API
Passbolt
Open source credential vault with a documented API
GitGuardian
Finds leaked credentials and maps non-human identities
Psono
Self-hosted team vault with API keys and a CI client
Key takeaways
- HashiCorp Vault is published under the Business Source License 1.1, and HashiCorp's privacy policy states that IBM has acquired the company.
- ayedo publishes the only fixed Vault-style price on this page, €1,299.95 per month for a dedicated single-tenant cluster.
- Adfinis Secretz Enterprise charges a flat fee for support of the open source engine, so the cost does not rise with the number of identities.
- Akeyless is the only hosted option here that lists HashiCorp Vault as an external vault it can synchronise.
- Passwork lists secrets management under its Advanced plan at €4.50 per user per month, not under the €3 Standard plan.
Why people leave HashiCorp Vault
HashiCorp Vault is the secrets manager that many infrastructure teams treat as the reference design: a key-value store with versions, credentials created on demand for databases and cloud accounts, an internal certificate authority, an encryption service and an audit trail. Because so many pipelines, Kubernetes clusters and runbooks were written around its API, replacing it is a platform project, not a purchasing decision. The reasons to look beyond it are therefore usually legal and commercial, not a lack of features.
The legal side starts with ownership. According to HashiCorp's privacy policy, as read for this review, HashiCorp has been acquired by IBM, and the policy lists an address in Armonk, New York.
A vault is the system that can unlock all your other systems, so the question of which company, and which country's courts, stand behind it carries more weight than it does for a note-taking app. Hosting Vault in a Frankfurt data centre does not change who the vendor is.
The commercial side is the licence. HashiCorp publishes Vault under the Business Source License 1.1, which restricts offering the software as a competing hosted service. For an end user that rarely matters on day one, but it explains why European operators now sell vaults built on a different engine or on their own cloud, and why teams that wanted a plainly open licence started comparing replacements.
- A US-based parent behind the keys HashiCorp's privacy policy names IBM as the acquirer and gives an Armonk, New York address. For a secrets store, jurisdiction is the central question, because a request addressed to the vendor can in principle cover the system holding every production credential. A contract with ayedo (Germany), Adfinis (Switzerland) or Passbolt (Luxembourg) moves that question to European law, and a self-hosted deployment removes the vendor from the path entirely.
- A licence that limits hosted offerings The Business Source License 1.1 is not an open source licence in the usual sense, since it restricts offering the software as a competing hosted service. A company that wants to build a managed vault on top of Vault code cannot simply do so, and a customer that insists on a fully open licence has to look at other engines. The European operators on this page make that choice for you in different ways, from open source servers to closed SaaS.
- Pricing you have to ask about The HashiCorp pricing page showed no Vault prices when it was checked for this review, so a budget comparison starts with a conversation. Several European vendors are no better: Akeyless and Adfinis publish no list prices either. The ones that do publish a number are ayedo (€1,299.95 per month for a dedicated cluster), Passwork (€3 and €4.50 per user), Passbolt (€4.50 per user) and Scaleway, which bills per secret version and request.
- Running Vault is a job in itself A self-managed Vault needs someone to handle unsealing, upgrades, backups and disaster recovery. Teams that left a managed Vault because of cost or jurisdiction often discover this late. ayedo sells exactly that operational layer, with auto-unseal and the audit log handled by the operator, while the cloud secret stores from Scaleway, STACKIT and OVHcloud remove the job by reducing the feature set.
What you have to replace, not just match
What you replace is a set of habits as much as a product. Applications authenticate to Vault with a role, read a path and receive a lease. CI jobs fetch short-lived tokens.
Operators write policies in Vault's own language and review audit logs in a fixed format. Whichever European tool you choose, list the auth methods your workloads use today, the secrets engines you rely on (key-value, database, cloud IAM, PKI, transit) and the number of distinct policies, because the match with each replacement differs sharply by engine.
The closest matches in API terms are ayedo and Adfinis, both built around the same open source engine that forked from Vault, and the OVHcloud secret store, which advertises a Vault-compatible API.
The distance grows with the tools that follow a different model: Akeyless uses its own gateways and client counting, Scaleway and STACKIT are versioned stores, and the password vaults (Passwork, Passbolt, Psono) are aimed at shared logins with an API on the side. GitGuardian replaces nothing in the vault itself; it covers the leak-detection job around it.
The data to move is smaller than the habits. Static secrets can be exported and re-imported with a script, while dynamic secrets are not data at all: they are configuration that has to be recreated against each database and cloud account.
Plan for the integrations first, for example the External Secrets Operator in Kubernetes, which ayedo and OVHcloud both name, and for the period in which two vaults run side by side. Akeyless documents a connector for Vault for exactly this overlap.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | ayedo | Schwalbach-Hülzweiler, Germany | Shared platform on request; dedicated cluster €1,299.95 per month | EU (Germany) |
| #2 | Adfinis Secretz Enterprise | Bern, Switzerland | Flat fee, amount on request | Switzerland (adequacy decision, outside the EEA) |
| #3 | Akeyless | Ramat Gan, Israel | Free start available, enterprise priced by client count and add-ons, quote on request | Israel (outside the EU/EEA) |
| #4 | Passwork | Barcelona, Spain | Standard €3 / Advanced €4.50 per user/month billed annually, for the self-hosted licence and for the cloud; a one-time lifetime licence is offered | EU (Spain) |
| #5 | Scaleway | Paris, France | From about €0.0006/hour (DEV1-S) | EU (France) |
| #6 | STACKIT | Bad Friedrichshall, Germany | EU (Germany) | |
| #7 | OVHcloud | Roubaix, France | PostgreSQL essential from about €0.16/hour (2 vCPU / 8GB RAM); MySQL, MongoDB, Kafka, Cassandra, OpenSearch, M3DB and Valkey priced separately by engine and tier | EU (France) |
| #8 | Passbolt | Luxembourg City, Luxembourg | Free Community Edition / from €4.50/user/month (Pro, minimum 10 users) | EU (Luxembourg) |
| #9 | GitGuardian | Paris, France | Free plan for small teams / Business priced per active developer seat / Enterprise pricing on request | EU (France) |
| #10 | Psono | Germany | Free and open source / paid hosting and enterprise plans | EU (Germany) |
How each alternative compares to HashiCorp Vault
Best for: Platform teams with enough workloads to justify a fixed monthly cluster price
Against HashiCorp Vault, ayedo changes who does the operating, not what the vault does. The service runs the open source engine that forked from Vault, so the key-value store with versioning, leases, dynamic credentials, an internal certificate authority and the transit engine are all listed on the product page. Auto-unseal, the audit log and the Kubernetes integration are handled by ayedo, which removes the on-call work that a self-run Vault brings.
The company behind it is Ayedo Cloud Solutions GmbH, registered at Amtsgericht Saarbrücken under HRB 107704, and the contract is therefore under German law. The price structure is the other difference. The dedicated single-tenant cluster costs €1,299.95 per month, whereas the shared platform has no published price. Check the patch policy for engine upgrades, because you depend on ayedo for them.
What ayedo does better than HashiCorp Vault
- European contracting entity with a register number in the legal notice
- Operated unsealing, backups and upgrades included
- One published monthly price for a dedicated cluster
- Bring-your-own-cloud and on-premises variants
Where ayedo is a step down from HashiCorp Vault
- A dedicated cluster is expensive for a small secret estate
- Sold as part of a wider ayedo platform, not as a standalone vault
- Engine upgrades follow ayedo's schedule
Standout against HashiCorp Vault. It is the only European service on this page that lists the full dynamic-secret, PKI and transit engine set next to a published price.
Best for: Kubernetes-experienced platform teams that need a Swiss vendor behind an engine they already run
Adfinis Secretz Enterprise is the least like a product swap of the ten. Against HashiCorp Vault it replaces the vendor relationship, not the software: Adfinis AG of Bern sells 24/7 support, security patches and long-term maintenance for the open source engine, and the company describes itself as a co-maintainer of that project. Your policies and client code stay as they are, and so does your own operations work unless you buy managed operations separately.
The pricing logic is the point of the offer. Adfinis argues that per-identity charging punishes growth and sells a flat fee instead, with all features included. It claims savings of up to 50 percent against proprietary products, which is the vendor's own figure and was not checked here. The subscription is certified for Red Hat OpenShift and SUSE Ready for Rancher, and the announcement says customers can start or stop without a migration.
What Adfinis Secretz Enterprise does better than HashiCorp Vault
- Flat fee instead of charging by identity or client
- Swiss legal entity with a commercial register entry
- Certified for OpenShift and Rancher
- No migration to adopt or to leave
Where Adfinis Secretz Enterprise is a step down from HashiCorp Vault
- You still operate the vault yourself
- No published price
- Only worthwhile if the Vault-derived engine is already your choice
Standout against HashiCorp Vault. It sells the support contract alone, so leaving it means ending a subscription, not moving data.
Best for: Platform teams that want one vendor for a hosted vault and a gradual move
Akeyless takes the opposite route to the Vault-derived engines. Against HashiCorp Vault it is a closed SaaS platform with its own gateways, and its hybrid mode puts gateways inside your network while the customer fragment of the encryption key stays out of Akeyless hands. Dynamic secrets, just-in-time access, certificate lifecycle and a KMS are in the feature list. Connectors synchronise secrets from HashiCorp Vault, AWS, Azure, GCP and Kubernetes, which lets a migration happen in steps.
The contracting company is Akeyless Security Ltd. in Ramat Gan, Israel, with a US subsidiary and a New York office also listed in its privacy policy. Pricing counts clients (users, applications and servers) against an annual quota, with connectors, certificates and HSM integrations as separate units, and no list prices. The compliance claims on its trust page, including SOC 2 Type II, ISO 27001 and DORA, are the vendor's own and should be backed by reports.
What Akeyless does better than HashiCorp Vault
- No vault cluster of your own to unseal, patch or back up
- Connector that reads an existing HashiCorp Vault during migration
- Free start available, so a trial needs no sales call
- Publishes compliance claims including DORA
Where Akeyless is a step down from HashiCorp Vault
- Closed source, with no self-hosted engine
- Israeli entity plus a US subsidiary and New York office
- Client counting can surprise a growing estate
Standout against HashiCorp Vault. It is the only option here that names HashiCorp Vault as a source it can synchronise from.
Passwork
Self-hosted password vault with an API, for small machine-secret needs next to human logins
Best for: Small teams that keep human logins and a few pipeline secrets in one audited place
Passwork is a password vault that added secrets management on its Advanced plan, so the comparison with HashiCorp Vault is about scope. It offers a REST API, a Python SDK and CI/CD integration for fetching credentials from pipelines, and you can run it as a self-hosted licence or use the cloud, which is hosted in Germany. It does not describe leases, dynamic credentials or per-workload identities, which are Vault's centre of gravity.
The price is the clearest difference: Standard at €3 and Advanced at €4.50 per user per month, billed annually, with secrets management only on Advanced, and a one-time lifetime licence also offered. The company is Passwork Europe SL in Barcelona. No security certification is published for it, and the product is not open source, so ask for evidence before putting production credentials in it.
What Passwork does better than HashiCorp Vault
- Per-user price that is simple to forecast
- Self-hosted licence with a one-time purchase option
- Humans and pipelines share one audited store
- Cloud option hosted in Germany for teams without a server
Where Passwork is a step down from HashiCorp Vault
- No dynamic secrets or leases described
- Secrets management needs the more expensive plan
- No published security certification
Standout against HashiCorp Vault. It is the only tool on this page that can be bought outright with a lifetime licence.
Best for: Teams already running workloads on Scaleway that want a simple managed secret store
Scaleway Secret Manager is small next to HashiCorp Vault and priced on a different principle. It stores secret versions with envelope encryption using AES-256 and runs in the Paris, Warsaw and Amsterdam regions. Billing counts stored secret versions and API requests, so cost follows usage instead of a cluster or a seat. It sits inside the Scaleway console beside the compute and Kubernetes services your workloads already use.
Scaleway is a subsidiary of the Iliad Group, founded in 1999 as Online.net, so the contract is French and the data stays in EU regions. What you lose against Vault is the engine breadth: the pages read describe a store, not a certificate authority or a database credential generator. The unit prices were not read for this review, so estimate a bill with the Scaleway calculator before relying on the model.
What Scaleway does better than HashiCorp Vault
- Pay-per-version billing with no cluster or seat to buy
- French contract and EU regions only
- No separate vault to run or unseal
Where Scaleway is a step down from HashiCorp Vault
- Narrower feature set than a full Vault deployment
- Useful mainly if the workloads are already on Scaleway
Standout against HashiCorp Vault. It is the only store here that charges per stored secret version and per API request.
Best for: Organisations already inside the Schwarz Group cloud that need versioned passwords and config
STACKIT offers a Secrets Manager as a versioned key-value store for passwords and configuration, ordered through the STACKIT self-service portal. Compared with HashiCorp Vault it is aimed at the storage half of the job. The most Vault-like detail is the Vault CLI access with AppRole authentication, which STACKIT lists as public preview, so a production dependency on it should wait for general availability.
The operator is Schwarz Digits Cloud GmbH & Co. KG in Bad Friedrichshall, the cloud arm of the Schwarz Group, so the contract is German. No price for the Secrets Manager was found on the pages read, and the STACKIT calculator could not be read, which means a cost comparison needs a quote. For migrations from Vault, test your AppRole-based jobs against the preview before planning a cut-over.
What STACKIT does better than HashiCorp Vault
- German operator with a self-service ordering portal
- Vault CLI and AppRole access are offered, which eases job migration
- Sits inside a full cloud catalog
Where STACKIT is a step down from HashiCorp Vault
- Vault-style access is still public preview
- No published price found
- A key-value store, not a full engine set
Standout against HashiCorp Vault. It is the one cloud store here whose Vault CLI access is explicitly labelled public preview.
Best for: Teams on OVHcloud that want Vault-style calls and External Secrets Operator support
OVHcloud's Secret Manager is the cloud store on this page that sounds most like HashiCorp Vault. It advertises a Vault-compatible API, native support for the External Secrets Operator in Kubernetes, and sits next to the OVHcloud KMS and HSM products. For teams whose tooling speaks the Vault API for key-value reads, that points to a short migration path, although the supported engines and auth methods should be checked item by item.
OVHcloud SAS is based in Roubaix and has operated since 1999, with data centres on four continents, most of them in Europe. It builds its own hardware, and the tool page records a SecNumCloud qualification and Gaia-X founding membership at company level, which is not a statement about this one service. The Secret Manager price was not found on the pages read, so ask for a quote.
What OVHcloud does better than HashiCorp Vault
- Vault-compatible API for existing tooling
- Kubernetes External Secrets Operator support
- KMS and HSM products in the same provider
- French contract with European data centres
Where OVHcloud is a step down from HashiCorp Vault
- Smaller feature surface than a full Vault install
- No price found for the Secret Manager
- Best value only if compute also runs on OVHcloud
Standout against HashiCorp Vault. It pairs a Vault-compatible API with KMS and HSM products from the same French provider.
Best for: Small technical teams that want auditable open source and a handful of API reads
Passbolt solves a narrower problem than HashiCorp Vault. It is an open source password manager for teams that encrypts each credential with OpenPGP for every recipient, so administrators and the server cannot read shared entries. An API exposes endpoints to read shared secrets, which lets a script or a pipeline fetch a credential. It has no leases, no dynamic secret generation and no per-workload identity model.
The source is released under AGPL v3 with independent audits published, which answers the licence worry that Vault's Business Source License raises. You can self-host on Linux, Docker or Kubernetes, or use the EU cloud. The company is Passbolt SA in Luxembourg, founded in 2016. The Community edition is free, and the Pro edition costs €4.50 per user per month, billed annually, with a minimum of ten users.
What Passbolt does better than HashiCorp Vault
- Open source under AGPL v3, with published audits
- Free Community edition
- Luxembourg entity and an EU cloud
- Per-recipient OpenPGP encryption
Where Passbolt is a step down from HashiCorp Vault
- No dynamic secrets, leases or workload identities
- Pro has a ten-user minimum
- Self-hosting needs technical upkeep
Standout against HashiCorp Vault. It encrypts every shared credential for each recipient with OpenPGP, so the server holds nothing it can read.
Best for: Engineering teams that suspect credentials already sit in repositories, CI logs or chat
GitGuardian does not replace HashiCorp Vault, and the comparison is useful because of that. It scans git history, CI/CD logs and chat tools for credentials that have already leaked, and its governance of non-human identities adds context about API keys and service tokens, including rotation. Where Vault prevents leaks by handing out secrets at runtime, GitGuardian finds the ones that escaped anyway. Most teams in this position need both.
GitGuardian SAS is a Paris company founded in 2017, with a US affiliate, GitGuardian Inc., acting as joint controller for American customers. Its category page lists a free Starter plan for up to 25 developers. Business pricing is per active developer seat, counting only people who committed in the last 90 days, and Enterprise is quoted. Budget it as an addition to the vault, not as a swap.
What GitGuardian does better than HashiCorp Vault
- Finds secrets already committed to git, CI logs and chat
- Free plan for up to 25 developers
- Active-contributor seat count instead of every account
Where GitGuardian is a step down from HashiCorp Vault
- Does not store or hand out secrets at all
- Business price is not published
- A US affiliate acts as joint controller for US customers
Standout against HashiCorp Vault. It is the only tool on this page that checks whether a real secret has already ended up in git history.
Best for: Teams that want a self-hosted shared vault and scripted access from a few jobs
Psono is a team password manager that can run on your own server, and the machine side of it is an API key feature plus the psonoci command-line client for CI jobs. Next to HashiCorp Vault that covers fetching a stored value in a pipeline, not issuing short-lived credentials. Encryption happens client-side before data is sent, so the server holds material it cannot read, on a self-hosted install or on the German hosted servers.
esaqa GmbH develops Psono in Germany, and the server code is open source, which means you can audit what runs. Self-hosting is free at any team size, while hosting and enterprise plans are paid and carry the administration features larger deployments need. The trade-off against commercial vaults is a smaller integration ecosystem and an interface that is functional rather than polished.
What Psono does better than HashiCorp Vault
- Open source server that you can audit
- Free to self-host at any team size
- German company with German hosted servers
Where Psono is a step down from HashiCorp Vault
- No dynamic secrets or leases
- Smaller integration ecosystem than commercial tools
- Enterprise administration features are paid
Standout against HashiCorp Vault. It ships a dedicated command-line client for CI, psonoci, in an open source team vault.
What actually breaks when you switch
Most of what breaks is outside the vault. Authentication is the first place: Vault roles, tokens and auth methods have to be recreated in the new system, and every workload that logs in needs a new credential or identity.
Check how many distinct auth paths exist today, because each one is a small migration. Dynamic secrets are the second place. They are not exportable data, so database roles, cloud IAM mappings and TTL settings have to be configured again and tested against each target.
Contracts and timing are the other half. Running two vaults in parallel is normal, and Akeyless prices connectors as licensed objects, while ayedo and Adfinis may need a quote before the overlap period can be budgeted.
Retrain the on-call engineers on the new audit log format, check that alerting still fires, and confirm what each vendor does at the end of the contract. Adfinis states that its subscription can be dropped without a migration, which is the lowest-friction exit on the page.
Can I replace HashiCorp Vault without rewriting my applications?
It depends on how your applications talk to it. If they call the Vault HTTP API or use its client libraries, the managed services built on the Vault-derived engine, ayedo and the Adfinis support subscription, keep that interface and your policies mostly intact. The OVHcloud store advertises a Vault-compatible API, which suggests a similar path for key-value use, although the engine coverage should be tested before you commit.
If your applications read secrets through Kubernetes instead, the work is smaller. The External Secrets Operator sits between the cluster and the vault, so changing the backend means changing a store definition, not application code. ayedo and OVHcloud both name that integration. For Scaleway, STACKIT and Akeyless you should expect an SDK or CLI change in any job that talks to the vault directly.
Does a European provider remove the CLOUD Act question?
Only if the whole chain is European. A German or Swiss operator running a vault on its own infrastructure keeps the contract and the processing under European law, which is the argument for ayedo and Adfinis. Akeyless is incorporated in Israel and also has a US subsidiary and a New York office, which a strict sovereignty policy may weigh differently from a pure EU contract.
The practical test is to follow the contract, not the data centre. Ask who the contracting entity is, which sub-processors have access and whether any affiliate acts as a joint controller. GitGuardian, for example, names a US affiliate as joint controller for US customers. Passwork's cloud runs in Germany but does not name the provider. Self-hosting Passbolt, Psono or Passwork removes the question, and adds the operating work.
Which one to pick
If your platform team is committed to the Vault API and wants a European operator, the shortlist is ayedo for operated service and Adfinis for support on a self-run engine. ayedo suits a company with enough workloads to carry a €1,299.95 monthly dedicated cluster, and Adfinis suits one that already has Kubernetes operations skills and mainly needs a Swiss signature on an incident-response contract.
If you want a hosted platform and a gradual move from an existing Vault, Akeyless is the choice, subject to the Israeli entity and US subsidiary.
If your secret estate is small, the cheaper routes are the cloud stores and the password vaults. Scaleway, STACKIT and OVHcloud fit teams that already live in those clouds, with OVHcloud the closest to the Vault API and STACKIT's Vault CLI access still in preview. Passwork, Passbolt and Psono fit teams that mostly share human logins and have a few pipelines. Add GitGuardian when leaks, not storage, are the actual problem.
Frequently Asked Questions
It depends on the criterion. For the closest API match with a European operator, ayedo (Germany) runs a managed service on the engine that forked from Vault, and Adfinis Secretz Enterprise (Switzerland) sells support for teams that run it themselves. For a hosted platform with dynamic secrets and a Vault connector, Akeyless is the Israeli option. For secrets inside an existing cloud, Scaleway, STACKIT and OVHcloud each offer a store.
HashiCorp states that it licenses Vault under the Business Source License 1.1. That licence is source-available and limits offering the software as a competing hosted service, so it is not the same as an open source licence. The open source tools on this page are Passbolt and Psono, which are password vaults with API access, not Vault engines. The ayedo and Adfinis services are built on a separate open source project.
ayedo lists dynamic credentials for databases, cloud IAM roles and service accounts, plus a certificate authority and a transit engine. Akeyless documents on-demand credentials with an expiry, for example an AWS access key that is revoked automatically. Scaleway and STACKIT are described as versioned key-value stores, so check the engine you need before choosing one of them.
Yes, and most teams do. Akeyless lists HashiCorp Vault among the external vaults its connectors can synchronise, and the pricing page counts each connector as a licensed object. STACKIT offers Vault CLI access with AppRole, in public preview. Running two vaults in parallel for a quarter is common, and the cost of the overlap should go into the budget.
No. GitGuardian (France) scans git history, CI/CD logs and chat tools for credentials that have already leaked and maps non-human identities, but it does not store or manage secrets. It complements a vault. If your problem is a key committed to a repository, start there, and treat the vault replacement as a separate project.
Related comparisons
European tools head to head
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.