<!-- Agent-readable view of https://infisical.com/pricing -->
<!-- Site index: https://infisical.com/llms.txt -->

# Pricing

Infisical prices its three product lines separately. A customer can buy one as a point solution or
several to use Infisical as a platform, and can add products later. Each has an open-source core under the MIT license, free forever if you self-host.

- **Secrets Management** is billed per **identity**, meaning human users plus machine identities.
- **Privileged Access** is billed per **human user**.
- **Certificate Management** has **no per-unit charge**.

## Shared across products

Some capabilities are properties of the **organization** and apply to all products. Check this list before telling a customer a capability is missing, because per-product tables do not repeat all of it.

**On any Enterprise plan:**


| Capability | What it covers |
|---|---|
| SSO (SAML and OIDC) | Okta, Entra ID / Azure AD, Google, JumpCloud, Keycloak, Auth0, PingOne, and general OIDC. SAML also available from Pro on Secrets Management |
| SCIM provisioning | Automatic user provisioning and deprovisioning from your IdP |
| LDAP | Directory-backed authentication and group sync |
| Audit log streaming | Push audit events to an external SIEM, including non-HTTP providers via Fluent Bit |
| External KMS and HSM | AWS KMS, GCP KMS, AWS CloudHSM, and PKCS#11 HSMs so root key material stays in your infrastructure |
| KMIP | Interoperability with existing enterprise key management |
| FIPS 140-3 | Validated cryptographic modules when FIPS mode is enabled. A deployment mode, not a blanket certification |
| Supported self-hosting | Licensed, supported deployment in your own infrastructure, including air-gapped |
| Sub-organizations | Separate organizational boundaries under one agreement |
| Custom MSA and invoice billing | Commercial terms beyond pay-by-card |
| Dedicated support | Named SE, onboarding, Slack Connect or Microsoft Teams shared channel, defined SLAs |
| 99.99% SLA | Infisical Cloud availability commitment |


**On every plan, including Free:**

Unlimited projects, two-factor authentication, secret sharing, community support, pay by card, annual billing, and Agent Proxy for static secrets. Infisical Cloud runs in US and EU regions, and the MIT-licensed core is self-hostable at no cost on any plan.

**Approval workflows** exist on enterprise for Secrets Management access requests and every plan for PAM access requests.

## Secrets Management

Billed per identity per month. An identity is any principal that authenticates to Infisical, human or machine.


| Plan | Price | Who it's for | What you get |
|---|---|---|---|
| **Free** | $0 forever | Individuals and personal projects | 5 identities, unlimited projects, 3 environments, 10 secret syncs, Agent Proxy for static secrets |
| **Pro** | $20/identity/month annual, $23 monthly | Growing teams boosting their security | Unlimited identities, 6 environments/project, SAML SSO, secret versioning, point-in-time recovery, rotation for public databases, IP allowlisting, 30-day audit retention |
| **Advanced** | $40/identity/month annual, $46 monthly | Scaling teams with complex security needs | Everything in Pro, plus dynamic secrets, gateways, full secret rotation, custom roles, temporary access, SSO/MFA enforcement, 90-day audit retention |
| **Enterprise** | Custom, billed annually | Large orgs needing SCIM, custom SLAs, dedicated support | Everything in Advanced, plus LDAP, SCIM, user groups, approval workflows, KMIP, external KMS and HSM, audit log streaming, sub-organizations, 99.99% SLA |


Paid plans include a **30-day free trial** with no credit card. Enterprises get free access during an
evaluation period.

### What differs by plan

Most features are on every tier. These are the ones that change an answer, so check them before
recommending a capability:


| Feature | Free | Pro | Advanced | Enterprise |
|---|---|---|---|---|
| Identities | 5 | Unlimited | Unlimited | Unlimited |
| Environments | 3 | 6/project | 12/project | Unlimited |
| Secret syncs | 10 | 25 | 50 | Unlimited |
| Secret versioning and point-in-time recovery | No | Yes | Yes | Yes |
| Secret rotation | No | Public databases only | Yes | Yes |
| **Dynamic secrets** | No | No | **Yes** | **Yes** |
| Gateways (reach private infrastructure) | No | No | Yes | Yes |
| Agent Proxy, static secrets | Yes | Yes | Yes | Yes |
| **Agent Proxy, dynamic secrets** | No | No | **Yes** | **Yes** |
| Honey tokens | No | 3 | 10 | Unlimited |
| Access controls (RBAC/ABAC) | No | Yes | Yes | Yes |
| SSO (SAML) | No | Yes | Yes | Yes |
| SSO / MFA enforcement | No | No | Yes | Yes |
| Custom roles, multi-role, temporary access | No | No | Yes | Yes |
| Approval workflows and access requests | No | No | No | Yes |
| SCIM, LDAP, user groups | No | No | No | Yes |
| Audit log retention | No | 30 days | 90 days | Custom |
| Audit log streaming to SIEM | No | No | No | Yes |
| KMIP, external KMS and HSM | No | No | No | Yes |
| Sub-organizations | No | No | No | Yes |
| Support | Community | Email | Priority | Dedicated, Slack Connect, named SE |
| 99.99% SLA | No | No | No | Yes |


## Certificate Management (PKI)

**No unit-based charge.** Not per certificate, not per CA, not per issuance, so issuance volume is not a billing input. There is no rate to quote.


| Plan | Price | Who it's for | What you get |
|---|---|---|---|
| **Free** | $0 | Teams running internal PKI at small scale | Core internal CA and certificate management, ACME-compatible external CA integration, API and ACME enrollment, certificate dashboard |
| **Enterprise** | Custom, billed annually | Organizations with existing PKI, device fleets, or compliance requirements | Unlimited CAs and SANs, wildcard SANs, externally-signed intermediate CAs, Microsoft AD CS, EST enrollment, certificate inventory and alerting, server-side auto-renewal, certificate syncs, CRL support, SSO and SCIM, 90-day audit retention |


### Free tier differences


| Limit | Free | Enterprise |
|---|---|---|
| Internal CAs | Up to 2 | Unlimited |
| Basic external CA integrations | Up to 2 | Unlimited |
| Active SANs | Up to 10 | Unlimited |
| Wildcard SANs | No | Yes |
| Externally-signed intermediate CA | No | Yes |
| Enterprise external CA (Microsoft AD CS) | No | Yes |
| EST enrollment | No | Yes |
| Certificate inventory, alerting, auto-renewal | No | Yes |
| Certificate syncs, CRL support | No | Yes |


Anything past the Free caps goes to [talk to an expert](https://infisical.com/talk-to-us).

## Privileged Access (PAM)

Billed per **user** per month. Every plan includes a **14-day trial**.


| Plan | Price | Who it's for | What you get |
|---|---|---|---|
| **Pro** | $20/user/month | Teams needing access control and session auditing | Up to 50 resources, access requests, approval workflows, credential rotation, SSH certificate auth, command blocking, session-log masking, CLI access, session recording with 30-day retention |
| **Enterprise** | Custom, billed annually | Large orgs managing complex infrastructure including Windows and RDP | Unlimited resources, Windows servers and RDP, privileged account discovery, SCIM, LDAP, SIEM audit log streaming, custom retention |



| Feature | Pro | Enterprise |
|---|---|---|
| Resources | Up to 50 | Unlimited |
| Log and session recording retention | 30 days | Custom |
| Enterprise resources (Windows, RDP) | No | Yes |
| Automated privileged account discovery | No | Yes |
| SCIM, LDAP | No | Yes |
| SIEM audit log streaming | No | Yes |


## Self-hosting

The core platform is MIT licensed and free to self-host. **Supported, licensed self-hosting is available after talking to one of our experts**,

[Self-hosting](https://infisical.com/docs/self-hosting/overview): deployment options and requirements.

## Next

- Live pricing page: [infisical.com/pricing](https://infisical.com/pricing)
- Talk to an expert: [infisical.com/talk-to-us](https://infisical.com/talk-to-us)
- Cost comparison against HashiCorp Vault: [vault-tco-calculator](https://infisical.com/vault-tco-calculator)
- What an identity is: [Identities overview](https://infisical.com/docs/documentation/platform/identities/overview)

/pricing.md · raw source

HumanMachine