Every European secrets management software tool reviewed
Schwalbach-Hülzweiler, Germany
Shared platform on request; dedicated cluster €1,299.95 per month
Demo on request
Best for: Platform teams that want the Vault API from a German operator and no unseal rota of their own
ayedo does not write its own vault: its secrets page says the service is OpenBao running in the platform cluster, with ayedo handling auto-unseal and the Kubernetes integration while customers only call the APIs. The feature list covers a versioned key-value store with leases and an audit log, dynamic credentials for databases, cloud IAM roles and service accounts, an internal certificate authority for mTLS and a transit engine. The External Secrets Operator delivers values into workload clusters.
The operator is Ayedo Cloud Solutions GmbH of Schwalbach-Hülzweiler, registered at Amtsgericht Saarbrücken under HRB 107704, and its site lists ISO 27001, ISO 9001 and DORA among its badges. There are three ways to buy: a shared platform with no published price, a dedicated cluster at €1,299.95 per month, and bring-your-own-cloud or on-premises. The dedicated figure is the only price shown, and the patch policy for engine upgrades is worth confirming.
What ayedo does well
- Keeps the Vault API and engines, so existing policies and client libraries stay usable
- Legal notice names a GmbH and its commercial register number
- One monthly figure is public, for the dedicated cluster
- Pushes secrets into clusters with the External Secrets Operator
- Can also be deployed in your own cloud or on-premises
Where ayedo falls short
- The dedicated cluster costs a lot for a team with few secrets
- The shared tier is quoted on request
- Bought together with the wider ayedo platform
Standout feature. It is the only operated service on this list that names the whole engine set (key-value, dynamic, PKI, transit) beside a public monthly price.
Bern, Switzerland
Flat fee, amount on request
Demo on request
Best for: Organisations that already picked the open source engine and want a Swiss vendor to sign a support contract
Adfinis Secretz Enterprise is a subscription, not a hosted vault: the product page promises vendor assurance, 24/7 support and long-term maintenance for production use of the open source engine that forked from Vault, from a company that describes itself as a co-maintainer of that project. Security patches and software assurance are part of it, and so is migration planning. You operate the vault on your own infrastructure unless you add managed operations.
Adfinis AG is a public limited company registered in Bern, with locations also in Germany, the Netherlands, Australia, New Zealand and Egypt, and it announced the subscription on 19 February 2026. The price is a flat fee that includes all features, quoted on request, and the vendor claims savings of up to 50 percent against proprietary products, a figure it supplies itself. It states certification for Red Hat OpenShift and SUSE Ready for Rancher.
What Adfinis Secretz Enterprise does well
- Support comes from a company that calls itself a co-maintainer of the engine
- All features sit inside one flat fee, with no per-identity metric
- Listed for OpenShift and SUSE Ready for Rancher
- Adopting or ending it needs no data migration
- Swiss AG with a commercial register entry in Bern
Where Adfinis Secretz Enterprise falls short
- It is support only, and the vault stays yours to run unless you buy operations
- No price is published
- Makes sense only when you have chosen that engine already
Standout feature. It is a pure support layer, so ending the contract changes nothing in your running vault.
Ramat Gan, Israel
Free start available, enterprise priced by client count and add-ons, quote on request
Demo on request
Best for: Companies that want a hosted vault while an existing HashiCorp Vault keeps running during the move
Akeyless sells a hosted replacement for Vault instead of a Vault-compatible engine. Its pricing page distinguishes pure SaaS from a hybrid mode with gateways inside your own network, where the customer fragment of the encryption key stays out of Akeyless hands. The platform covers static and dynamic secrets, just-in-time access, certificate lifecycle management, a KMS and governance across several vaults, and connectors read from AWS, Azure, GCP, Kubernetes and HashiCorp Vault.
The contracting company is Akeyless Security Ltd. of Ramat Gan, Israel, named as controller in a privacy policy dated 5 May 2026, and the same policy lists a US subsidiary, Akeyless Security USA, Inc.
A free start is offered, but enterprise pricing counts clients that start a session, with connectors, certificates and HSM integrations as extra units, and no list prices. The trust page claims SOC 2 Type II, ISO 27001, PCI DSS and DORA, which are vendor statements to verify.
What Akeyless does well
- Credentials are generated on demand and expire by themselves
- Connectors read from an existing Vault and from cloud stores
- Gateways can be placed inside your network
- The trust page makes DORA and other compliance claims
- A free start needs no sales call
Where Akeyless falls short
- List prices are not published
- A US subsidiary and a New York office are listed
- Growing estates can exceed the client quota unexpectedly
- Closed source, with no engine you can host yourself
Standout feature. It is the only option here that treats an existing HashiCorp Vault as a source to synchronise from.
Barcelona, Spain
Standard €3 / Advanced €4.50 per user/month billed annually, for the self-hosted licence and for the cloud; a one-time lifetime licence is offered
Free trial, no card required
Best for: Small technical teams that keep staff logins and a few pipeline secrets in one self-hosted vault
Passwork is a password manager whose Advanced plan adds secrets management, with a REST API, a Python SDK and CI/CD integration for fetching values from pipelines. It can run as a self-hosted licence on your own infrastructure or as the Passwork Cloud, which is hosted in Germany although the underlying provider is not named. Because it is built around shared entries, it does not describe leases or per-workload identities.
Passwork Europe SL operates from Barcelona. Its published prices are €3 per user per month on Standard and €4.50 on Advanced, billed annually, secrets management sits on Advanced only, and a one-time lifetime licence exists. No security certification is published, the product is not open source, and the privacy policy mentions processors outside the customer jurisdiction under standard contractual clauses. The company does not state a founding year.
What Passwork does well
- Secrets management, API and Python SDK are available on the Advanced plan
- Self-hosted licence, or a cloud hosted in Germany
- A one-time lifetime licence is available as an alternative to renting
- Spanish company with an imprint and VAT number
- A free trial runs without a card
Where Passwork falls short
- The Standard plan at €3 does not include secrets management
- No leases or dynamic credentials are described
- No security certification is published and the code is closed
- The German cloud provider is not named
Standout feature. It is the only tool in this category that you can buy outright with a lifetime licence instead of renting per seat.
Paris, France
Founded 1999
From €0.0025/hour (DEV1-S)
Demo on request
Best for: Teams whose workloads already run on Scaleway and that need a plain managed store for secret versions
Scaleway offers a Secret Manager inside its cloud console, with envelope encryption using AES-256, availability in the Paris, Warsaw and Amsterdam regions, and billing per stored secret version and per API request. That makes it a usage-priced store, not a cluster or a seat licence, and it lives next to the Kubernetes and compute services that read from it. The pages read describe a versioned store, not dynamic credentials or a certificate authority.
Scaleway is a subsidiary of the Iliad Group in Paris, founded in 1999 as Online.net before its rebrand, and its data centres sit in Paris, Amsterdam and Warsaw, with Milan also listed. The platform price on its tool page starts at €0.0025 per hour for a DEV1-S instance, which concerns compute, not secrets. The unit prices of the Secret Manager were not read, so cost needs a calculator run.
What Scaleway does well
- Billing follows stored versions and requests, with no cluster to pay for
- Secret values use envelope encryption with AES-256
- Runs in the PAR, WAW and AMS regions
- The Iliad Group stands behind the provider
- Sits in the same console as compute and Kubernetes
Where Scaleway falls short
- A store only, without the engine breadth of a full vault
- Unit prices were not checked for this review
- Fewer regions and niche services than the large US clouds
- Gains most for teams already on Scaleway
Standout feature. It meters secrets by stored version and API request, the finest billing unit on this list.
Bad Friedrichshall, Germany
Custom (quote-based)
Demo on request
Best for: Organisations in the Schwarz Group cloud that need a versioned store for passwords and configuration
STACKIT lists a Secrets Manager as a versioned key-value store for passwords and configuration, ordered through its self-service portal. The detail closest to HashiCorp Vault is access through the Vault CLI with AppRole authentication, which STACKIT labels as public preview. That wording matters for planning, since a production job that relies on it is relying on a feature that is not yet generally available.
The operator named in the site footer is Schwarz Digits Cloud GmbH & Co. KG of Bad Friedrichshall, Germany, whose cloud brand is STACKIT. No price for the Secrets Manager was found, and the STACKIT calculator loads in the browser and could not be read, so the pricing is listed as quote-based. For a migration from Vault, test the AppRole login and the CLI calls your jobs use, and plan around the preview status.
What STACKIT does well
- Versioned key-value storage for passwords and configuration
- Vault CLI access with AppRole, offered as public preview
- Ordering runs through a self-service portal
- German operator within a broad cloud catalog
Where STACKIT falls short
- Vault-style access is not yet generally available
- No Secrets Manager price was found
- Reads as a key-value store, not a full engine set
Standout feature. It is the one cloud store on this list whose Vault CLI access is explicitly marked public preview.
Roubaix, France
Founded 1999
PostgreSQL essential from about €0.16/hour (2 vCPU / 8GB RAM); MySQL, MongoDB, Kafka, Cassandra, OpenSearch, M3DB and Valkey priced separately by engine and tier
Demo on request
Best for: Teams on OVHcloud that want a Vault-compatible API and External Secrets Operator support in the same provider
OVHcloud publishes a Secret Manager for its public cloud that advertises a Vault-compatible API and native support for the Kubernetes External Secrets Operator. It sits beside the OVHcloud KMS and HSM products, so key management and secret storage can come from one provider. Compatibility is a claim about the API surface, so test the engines and auth methods your jobs use against it before you migrate.
OVHcloud SAS was founded in Roubaix in 1999, designs its own hardware and data centres, and operates 46 data centres on four continents, most of them in Europe. At company level its tool page records SecNumCloud certification from the French cybersecurity agency ANSSI and founding membership of Gaia-X, which are not statements about the Secret Manager itself. No price for the Secret Manager was found on the pages read.
What OVHcloud does well
- API that advertises compatibility with Vault
- Kubernetes External Secrets Operator supported natively
- KMS and HSM products from the same provider
- Own hardware and data centres, mostly in Europe
- Hourly public cloud catalog for other resources
Where OVHcloud falls short
- Part of a cloud, not a dedicated secrets product
- No Secret Manager price was found
- Compatibility with specific Vault engines needs testing
- Cloud pricing is granular, so a real bill takes effort to estimate
Standout feature. It combines a Vault-compatible API with KMS and HSM products from one French provider.
Luxembourg City, Luxembourg
Founded 2016
Free (Community) / From €4.50/user/month (Pro, minimum 10 users)
Demo on request
Best for: Technical teams that want an auditable open source vault for shared credentials and a few API reads
Passbolt is a password manager built for teams from the start, and it encrypts every entry with OpenPGP for each authorised user, so administrators and the server cannot read shared credentials. An API exposes endpoints to read shared secrets, which lets a script or pipeline fetch a value. It does not issue leases or generate credentials on demand. You can self-host on Linux, Docker or Kubernetes, or use the EU cloud.
Passbolt SA is based in Luxembourg City and was founded in 2016. The server is released under AGPL v3 and independent audit reports are published, according to the tool page. The Community edition is free. The Pro edition costs €4.50 per user per month, billed annually, with a minimum of ten users, and adds LDAP/AD integration, more MFA options and priority support.
What Passbolt does well
- Written for team sharing instead of single users
- Per-recipient OpenPGP encryption keeps entries unreadable to admins
- AGPL v3 source with independent audits on record
- Runs on Linux, Docker, Kubernetes or in the EU cloud
- Roles, an activity log and an API are included
Where Passbolt falls short
- Does not suit single-user use
- The GPG model takes learning for non-technical users
- Mobile apps trail the web interface and the extension
- Self-hosting takes upkeep and technical skill
Standout feature. It combines open source code with per-recipient OpenPGP encryption, so the server never holds a readable shared credential.
Paris, France
Founded 2017
Free plan for small teams / Business priced per active developer seat / Enterprise pricing on request
Demo on request
Best for: Engineering teams that suspect credentials already sit in repositories, CI logs or chat messages
GitGuardian scans git history, CI/CD logs and chat tools for secrets that should not be there, such as API keys, database passwords and private certificates, and flags them before or just after they leak. Its Non-Human Identity governance extends the idea to API keys and service-account tokens that outlive their creator, with rotation context. It works next to GitLab, Gitea, GitHub or Codeberg and stores no working secrets, so a vault from this list remains necessary.
GitGuardian SAS is a Paris company founded in 2017, and a US affiliate, GitGuardian Inc., serves as joint controller for American customers. The category page lists a free Starter plan for up to 25 developers. Business pricing is per active developer seat, defined as anyone who committed in the last 90 days, and Enterprise is quoted on request.
What GitGuardian does well
- Covers git history, CI/CD logs and chat tools
- The free plan is usable for a small team
- Seats count active contributors, not dormant accounts
- Long-lived API keys and tokens fall under identity governance
- Not tied to a particular code host
Where GitGuardian falls short
- Finds leaked secrets but does not store or manage them
- The Business tier price is not published
- The US affiliate is joint controller for US customers
- Adds a subscription on top of the code host
Standout feature. It is the only tool here that checks whether a live secret has already been committed into git history.
Germany
Free and open source / paid hosting and enterprise plans
Demo on request
Best for: Teams that want a self-hosted shared vault with scripted access from CI
Psono is an open source team password manager that you can run on your own server, with an API key feature and a command-line client called psonoci for scripts and CI jobs. Encryption happens on the client before anything is sent, so a self-hosted server and the hosted German servers store data they cannot read. Sharing works by group, and access can be revoked when someone leaves. It fetches stored values, not short-lived credentials.
Psono is developed in Germany by esaqa GmbH and is offered both as an on-premise edition and as a SaaS edition. Self-hosting is free at any team size, while hosting and enterprise plans are paid and bring the administration features larger deployments need. The tool page describes the interface as functional rather than polished and the integration ecosystem as smaller than that of commercial rivals.
What Psono does well
- Server code is open source and can be audited
- Data is encrypted on the client before upload
- Group sharing can be revoked at any time
- Hosted option runs on German servers
- Self-hosting costs nothing, whatever the team size
Where Psono falls short
- You run and update a self-hosted server
- The interface is functional more than polished
- Fewer integrations than commercial rivals
- Enterprise administration is a paid add-on
Standout feature. It pairs a self-hostable open source vault with psonoci, a dedicated command-line client for CI.
