Where Vault Enterprise cost differs from self-hosted OpenBao
Moving to OpenBao removes the Vault Enterprise license line, but it does not remove cost. It replaces a subscription with infrastructure, unseal design, high availability, support and migration work that your own team or a partner must carry. Whether the total comes out lower depends on your quote and your staffing, so the comparison should be built from those two inputs rather than from the license alone. HashiCorp prices Vault Enterprise and HCP Vault Dedicated by quote, and the HashiCorp Vault pricing page is where to start the request. No price for either side is stated on this page.
The licensing context explains why this comparison is now open for many buyers. HashiCorp announced on August 10, 2023 that future releases of its products would move from the Mozilla Public License 2.0 to the Business Source License 1.1, and IBM completed its acquisition of HashiCorp on February 27, 2025. OpenBao is a community fork of Vault licensed under MPL 2.0 and managed under the Linux Foundation's OpenSSF. Ask your procurement team to confirm which terms apply to the Vault version and edition you run today, and whether your renewal terms change the price or the scope of support.
When you build the comparison, list each cost component separately: the subscription or quote, the infrastructure for storage and nodes, an unseal method such as an HSM or cloud KMS, monitoring and backup, internal staff time for upgrades and incidents, third-party support if you want it, and the one-time migration project. The subscription recurs each term, while migration and design work are largely one-time. Ask vendors and partners for written scope and deliverables for each line, so the figures you compare describe the same work.
Cost components on each side
This table sets each cost component of Vault Enterprise or HCP Vault Dedicated against the same work when OpenBao runs in your own infrastructure. Read the commercial column for what a vendor quote covers and the self-hosted column for what your team must still provision, staff and operate. Vendor pricing is quote-based, so the comparison is about which costs move from the vendor invoice to your own budget.
| Cost component | Commercial side (Vault Enterprise or HCP) | Self-hosted side (OpenBao) | One-time or recurring |
|---|---|---|---|
| Core software subscription | Vault Enterprise licence or HCP Vault Dedicated subscription, quoted by HashiCorp; confirm what tier, support and cluster sizes the quote includes | OpenBao is MPL 2.0 licensed with no license fee; you pay only for the infrastructure and services around it | Recurring (commercial); none (OpenBao software) |
| Community edition | Free Vault Community edition, but Enterprise features such as namespaces and replication are not included | Not applicable as a separate tier; OpenBao's feature set is the software you deploy | Not applicable |
| Storage backend | Included in HCP Vault Dedicated; for self-managed Enterprise, you provision Raft or Consul storage yourself | Integrated Raft storage or PostgreSQL; PostgreSQL requires a managed or self-run database with backups and patching | Recurring (infrastructure and database operations) |
| Auto-unseal (HSM or cloud KMS) | Auto-unseal and HSM support sit in the Enterprise tier; confirm whether your quote covers the HSM or KMS itself | Use a cloud KMS or PKCS#11 HSM you already own or buy; the key service and HSM hardware are separate purchases | Recurring (KMS or HSM service); one-time (HSM hardware) |
| Compute and load balancing | HCP covers hosting; self-managed Enterprise requires your own servers or cloud instances and load balancers | VMs or Kubernetes nodes, load balancers and network paths in your account, sized to your request volume | Recurring |
| High availability design | Clusters and replication are part of the Enterprise scope; confirm node count and failover terms in the quote | Build an active and standby node layout yourself; Raft or PostgreSQL HA must be tested under failure | One-time (design); recurring (extra nodes) |
| OpenBao software deployment | Not applicable; HashiCorp operates or licenses the binary | Install from the OpenBao releases and the Helm chart, which requires Helm 3.6 or later | One-time (initial install); recurring (upgrades) |
| Migration project | Vendor onboarding is usually quoted separately; confirm what is included | Plan the migration from Vault Community 1.14.1 on Raft, or other versions and Enterprise features, with an internal or partner project | One-time |
| Third-party support | Included in the Enterprise support contract; confirm response times and escalation in writing | Contract an external support provider or retain DeployOpen for scoped support, upgrades and patching; quote follows the written scope | Recurring (if contracted) |
| Upgrades and patching | Vendor delivers releases on its own cadence; your team still schedules and tests rollouts | Your team or a partner tracks OpenBao releases, such as v2.7.1 on October 1, 2026, and applies security fixes | Recurring |
| Internal skills | Operators need Vault knowledge; the vendor adds support escalations | Operators need Vault or OpenBao administration, seal and key management, and Kubernetes or Linux skills | Recurring (staffing or training) |
| Backups and DR testing | HCP handles managed backups; self-managed Enterprise snapshot automation is an Enterprise feature | Snapshot storage, restore drills and disaster recovery tests are your responsibility in your own infrastructure | Recurring |
What the subscription buys and what self-hosting must replace
A Vault Enterprise or HCP Vault Dedicated subscription bundles the software with the vendor's operational features and support, and that bundle is what you are comparing against. Before you model any cost, ask for the quote in writing and list which features it includes: the enterprise-only capabilities, support tier and response terms, upgrade and patch handling, and any managed operations. Pricing for both is available only by quote from HashiCorp, so the comparison is only as good as the scope you can confirm. Treat the quote's feature list as the baseline your self-hosted design must match or replace.
The self-hosted side is not a license line item but a set of infrastructure and people. You pay for compute and storage for at least three nodes in a high availability design, load balancing and network paths, backup storage for snapshots, and the key management that holds unseal material and recovery keys. OpenBao's documented storage options set the design inputs: integrated storage on Raft, which the OpenBao docs describe as the default path for most deployments, and PostgreSQL, which the docs describe as easier to operate safely than Raft. Its HA model uses one active node holding a lock in the data store, with standbys that forward or redirect requests. Choose the storage backend early, because it determines your backup, failover and upgrade procedures.
Do not assume feature parity. Namespaces, replication and secrets sync are the Enterprise capabilities most likely to decide the outcome, and each has its own sibling page with mapping details. Check those pages against your quote before you accept an OpenBao design as a full replacement. Staff time is also a recurring cost: someone must own upgrades, certificate rotation, unseal procedures and incident response, and that effort should appear in your model alongside infrastructure. Independent support for OpenBao is a separate line item to request if you want a contracted response path, and the OpenBao release notes, such as the v2.7.1 security fixes, set the patching rhythm you should plan for.
What moves the cost comparison up or down
Vault Enterprise and HCP Vault Dedicated price against your footprint, while self-hosted OpenBao shifts cost into infrastructure, staff time and support. The drivers below decide which side of the comparison carries more weight in your environment, so size each one before you ask for a quote.
Clusters and environments
Each cluster needs its own nodes, storage, backups, monitoring and upgrade window, whether it serves production, staging or a regional region. Splitting one estate into many clusters multiplies infrastructure and operating effort for self-hosted OpenBao, and it also changes how many subscription units or quote lines you will need from HashiCorp. Ask the vendor how licensing counts clusters, and inventory your environments before you compare totals.
Secret and lease volume
Higher volumes of static secrets, dynamic credentials and leases increase storage growth, lease expiry load and request traffic on the cluster. Self-hosted OpenBao scales this with bigger nodes or a better-tuned backend, which adds compute and database cost. Ask vendors how their pricing scales with secret counts, dynamic secret usage and request volume, and measure your own lease churn first.
Availability targets and node count
A cluster that must survive node loss needs an active node with standby nodes, which means more machines, load balancing and failover testing for OpenBao. Stricter availability targets therefore raise infrastructure and on-call costs in a self-run model, while a managed service moves that engineering into the subscription. Define your recovery objectives in writing and cost the number of nodes each one requires.
Unseal method
Shamir unseal keeps the cost low but places key custody and manual unseal steps on your operations team. Auto-unseal with a cloud KMS or an HSM adds the key service or hardware and its licenses, and an HSM also adds rack space and vendor support. Confirm which unseal method your current Vault uses, because moving between methods is a migration task with its own effort.
Edition and feature needs
If you depend on Enterprise features such as namespaces, replication, HSM seals or secrets sync, the Vault Enterprise quote carries those costs directly. OpenBao covers namespaces and several other areas, but you still need to confirm whether each Enterprise feature you use has an open-source equivalent or must be rebuilt with external tooling. List every feature in use and map each one to a cost line before comparing.
In-house skills and support
Self-hosted OpenBao moves patching, upgrades, backup testing and incident response onto your staff or a support partner, and that effort recurs every release cycle. Vault Enterprise and HCP Vault Dedicated include vendor support in the subscription, while third-party support for OpenBao is a separate contract. Assess who on your team already runs Vault, and ask any partner for a fixed scope covering upgrades and on-call coverage.
How the comparison shifts by team situation
Teams on the free Vault Community edition with integrated Raft storage have the smallest licensing change to make, because there is no subscription to cancel. The documented path is an in-place, node-by-node upgrade from Vault Community 1.14.1 on Raft storage with Shamir unseal, and OpenBao's migration guide states that this is the version it was tested against. Other Community versions are not covered by that testing, so confirm your exact version before planning.
- Licensing: No Vault subscription line exists to remove. The cost change is mostly staff time and testing effort.
- Plugins: Mounts that use plugins OpenBao does not ship are skipped during migration, so inventory every secrets engine and auth method first.
- Tokens: New tokens use a shorter OpenBao format, so any tooling that parses token strings needs review.
- Clients: Agents, CI jobs and Kubernetes injectors must be re-pointed and tested.
- Recurring cost: Your own compute, storage, backups and on-call time, plus any third-party support you choose to buy.
Before committing, ask your DeployOpen or internal team to confirm your Vault version and every plugin in use against the migration guide.
Teams running self-managed Vault Enterprise pay an annual subscription, quoted by HashiCorp, and that line is the main cost that OpenBao removes. Enterprise features such as namespaces, replication and HSM-based auto-unseal are the areas where the feature comparison matters most, because the migration guide only covers the Community 1.14.1 upgrade path. Enterprise clusters therefore need a separate plan that is checked against the features actually in use.
- Subscription: The Enterprise license fee is quote-based. Ask for the renewal scope, support tier and what happens to features you use only in Enterprise.
- Feature mapping: Namespaces, replication and HSM seals each need a mapping exercise rather than a file copy.
- Data path: Raft snapshots from Enterprise may not restore into a different cluster, so plan a read-out and re-write strategy if the upgrade path does not apply.
- Support: Third-party support for OpenBao is a separate line you can compare against your current support contract.
- Recurring cost: Infrastructure, HA operations, upgrades and on-call staffing move to your side of the ledger.
Check which Enterprise features are live in your cluster and ask for the license terms in writing before you set a migration date.
Teams using HCP Vault Dedicated pay HashiCorp to run the Vault Enterprise binary for them, so the cost change is a move from a managed subscription to infrastructure and staff you own. HCP Vault Dedicated is not the Community 1.14.1 Raft cluster described in the migration guide, which means the in-place upgrade path does not apply directly. A data export and a rebuilt OpenBao cluster is the more likely route, and that route has its own effort and downtime planning.
- Subscription removed: The HCP consumption or subscription line ends, and the quote-based price is the figure to compare against your own costs.
- Cloud and network: Check how HCP connectivity, peering and private endpoints are used today, since those carry over to your own network design.
- Operations: Patching, upgrades, backups and availability move to your team or a retainer partner.
- Data movement: Plan how secrets, policies and auth configuration are read out and re-created, rather than assuming a cluster copy.
- Hosting: Decide which cloud account, data center or air-gapped network will hold the cluster and its unseal material.
Ask HashiCorp which Vault version HCP runs and what export options are available for your tenant before you plan the move.
Platform teams that run Vault only to inject secrets into Kubernetes workloads usually have a narrower footprint, but the cost picture still depends on which edition they run. The OpenBao Helm chart is the recommended way to install OpenBao on Kubernetes and requires Helm 3.6 or later, so the cluster-side install is standard. The migration work concentrates on injectors, service accounts, Kubernetes auth roles and the storage backend that sits under the cluster.
- Chart and version: Confirm that your Helm client is version 3.6 or later and pin the OpenBao chart and image versions you test.
- Injectors and auth: Kubernetes auth roles, service accounts and sidecar or CSI integrations must be re-pointed and tested.
- Storage: Integrated Raft or PostgreSQL is the supported HA choice, and PostgreSQL may be the operationally simpler backend according to OpenBao's storage docs.
- Unseal: Decide between Shamir keys, cloud KMS auto-unseal or an HSM, since each has a different recurring cost and staffing need.
- Plugins: Any Vault plugin not shipped with OpenBao is skipped, so verify each mount before cutover.
Confirm your Helm version, storage backend and unseal method with your platform team before estimating the work.
How to build the comparison with your own numbers
This sequence turns a vague sense that Vault Enterprise costs too much into a three-year comparison built from quoted figures, your own inventory and staff time. Each step produces a line item your finance and security teams can check.
Collect the current Vault quote and its scope
Ask your HashiCorp account team or reseller for the current written quote for Vault Enterprise or HCP Vault Dedicated, and ask what it includes: the number of nodes or clusters, support tier, namespaces, replication, HSM or auto-unseal features, secrets sync, and the term and renewal conditions. Pricing for both products is available by quote on HashiCorp's pricing page, so the figure must come from the document, not from memory or a previous year's invoice. You are done when every line in the quote maps to a feature you actually use or plan to use, and anything missing is noted as an open question.
Inventory clusters, secrets and consumers
Count the Vault clusters, namespaces or equivalent isolation boundaries, secrets engines, auth mounts, dynamic secret backends, and the applications, CI pipelines, Kubernetes injectors and agents that read from Vault. Record how many secrets and leases each cluster holds and which ones depend on Enterprise-only features such as namespaces, replication or secrets sync. Ask the platform team to export this list from their own configuration rather than estimating it. You are done when each cluster has a row with its features, consumers and data location, and the Enterprise-only dependencies are marked.
Size HA, DR nodes and storage
Define the node count and placement you would need for high availability and disaster recovery under self-hosting. OpenBao runs an active node with standbys, and its officially supported HA backends are integrated storage (Raft) and PostgreSQL, so decide which backend you would operate and whether you already have a database team that runs PostgreSQL. Price compute, disk, network and backup storage for each node and each site, using quotes from your cloud provider, data center team or hardware vendor. You are done when you have a node table with CPU, memory, storage, region and the backup target for each environment.
Price unseal as a separate line
Decide how the cluster will be unsealed: Shamir keys operated by people, an HSM through a PKCS#11 seal, or a cloud KMS. Treat this as its own cost line because it differs from the Vault quote and from the node cost. Ask your HSM vendor or cloud provider for the hardware, licensing and support price, and check with your security team who holds the key ceremony responsibilities. You are done when the unseal method is chosen and its recurring and one-time costs are written down with their source.
Estimate staff hours for install, upgrades and on-call
Ask your platform, security and operations leads to estimate hours for the initial install, routine upgrades, backup and restore testing, certificate and key rotation, monitoring, and on-call coverage for a secrets service that many systems depend on. Multiply those hours by the fully loaded internal cost from finance, and separately record any external support contract for OpenBao from a third party you choose, with its quote. Label these as your estimates and keep the source of each rate. You are done when staff time is split into one-time work and recurring work, with a named owner for each.
Add the migration project as one-time cost
List the migration work: planning, a test cluster, moving secrets and auth configuration, updating clients, agents and Kubernetes injectors, parallel running and cutover. Include any professional services you would buy, such as an implementation partner working to a written scope, and request a fixed quote for that scope. Note that the OpenBao migration guide documents an in-place upgrade from Vault Community 1.14.1 on Raft with Shamir unseal, and that it was tested only against that version, so later Vault or Enterprise clusters may need a different path. You are done when the migration line has a scope, an owner and a quoted or estimated cost, and the unsupported paths are flagged as risks.
Run the three-year comparison
Build one spreadsheet with two columns, Vault subscription and self-hosted OpenBao, and place one-time costs in year one and recurring costs in each of the three years. Include the Vault quote, infrastructure, unseal hardware or KMS, staff time, third-party support, and migration. Run a sensitivity check by changing the staff hours and the node count to see which assumption moves the result most. Share the sheet with finance and the security owner, and ask them to challenge each row. You are done when both totals are reproducible from the sourced inputs and the open questions are listed with an owner and a date to resolve them.
Common questions about Vault Enterprise and OpenBao costs
How much effort does self-hosting OpenBao take?
The effort depends mostly on how many clusters you run, how you store data, and how you unseal them. A single small cluster with integrated storage (Raft) is a different job from a multi-region deployment with an HSM or cloud KMS for auto-unseal. Recurring work includes patching, monitoring, backups, certificate rotation and on-call coverage for the platform. OpenBao's high availability design uses an active node and standby nodes, and the official HA backends are integrated storage and PostgreSQL, so your storage choice shapes both the setup and the ongoing operations. Ask any quote to break effort down by cluster, storage, unseal method and environment.
Can our own team run OpenBao without an outside partner?
Many teams can, provided they already operate infrastructure, TLS, identity and backup systems and can staff an on-call rota for a security-critical service. The skills gap is usually in seal and unseal handling, HA failover testing, auth method design and client migration rather than in installation itself. OpenBao's documentation covers installation on Kubernetes through its Helm chart, which requires Helm 3.6 or later, but it does not replace an internal runbook. Assess your team against these areas, and decide whether a partner is needed for the migration only, for ongoing operations, or for both.
How long does a migration from Vault to OpenBao take, and what sets the duration?
The duration depends on your Vault version, edition and inventory rather than on a fixed number of days. OpenBao's migration guide describes a node-by-node in-place upgrade from Vault Community 1.14.1 on Raft storage with Shamir unseal, and states that it was tested only against that version. Clusters on later Vault versions, Enterprise features, plugins that OpenBao does not ship, or many dependent clients need more analysis and testing. Other drivers include the number of applications, agents and Kubernetes injectors to repoint, and the change-window rules in your environment. Ask for a timeline that lists these items separately.
What does a migration project require from our team?
Expect to need named owners for the Vault cluster, the applications that read secrets, the identity and certificate systems, and the change approval process. The team must inventory auth methods, secrets engines, policies and client integrations, confirm which plugins OpenBao ships, and plan the token format change, since new tokens use a shorter OpenBao format. Application owners must test their clients against OpenBao before cutover. Security and compliance staff should review the changed control evidence. Agreeing these responsibilities early keeps the project from stalling at the first unsupported plugin.
Is there a paid support option for OpenBao?
OpenBao is open source under MPL-2.0 and is run by a community under the Linux Foundation's OpenSSF, so the software itself carries no license fee. Commercial support is a separate question. Confirm with the OpenBao project and any vendor you are considering which support options exist, their terms, response commitments and whether they cover your version and configuration. Support from an implementation partner, such as DeployOpen for a fixed scope, is a different service from vendor support and should be priced and described separately in writing.
What does a fixed-scope DeployOpen engagement cover?
A fixed-scope engagement covers the work agreed in writing before it starts, such as planning, implementing, integrating, hardening, backing up, documenting and handing over an OpenBao deployment inside your own infrastructure. Scope, deliverables and timelines are set out in that written agreement. DeployOpen does not issue audit reports or certifications, so compliance work is limited to preparing systems, controls and evidence for an independent assessor. Ongoing support, upgrades and continuous testing are separate retainers. Ask for the deliverable list and the exclusions in the written scope.
What should we request in a quote for this work?
Request a quote that is tied to a written scope and lists each cost component separately: the migration project, the initial build, the seal and unseal design, HA and backup setup, client and agent changes, testing, documentation and handover. Ask which items are one-time and which recur, such as support, upgrades and testing retainers. Confirm the infrastructure and staff costs you carry, including cloud KMS or HSM charges, hosting and on-call time. Ask what changes the price, such as cluster count, Vault version, plugin gaps and the number of dependent systems. Compare any quote with Vault Enterprise or HCP Vault Dedicated pricing, which is available only by quote from HashiCorp.
When staying on Vault is the cheaper option
Staying on Vault Enterprise or HCP Vault Dedicated is the cheaper option when the total cost of running OpenBao would exceed the subscription. That is most likely for a small team with no spare operations capacity, where the quote covers support, patching and upgrades that would otherwise fall to your own engineers. HCP Vault Dedicated moves the operating burden to HashiCorp, so the comparison is not only licence against servers but also licence against the on-call rota, the upgrade calendar and the staff hours to keep a highly available cluster healthy. Ask the vendor to state in writing which operations it performs, which service levels apply and what happens to your data if you leave.
Enterprise-only features can also tip the balance. If your estate depends on namespaces with replication, certain Enterprise replication modes, or secrets sync to cloud-native stores, those capabilities have to be rebuilt or replaced before OpenBao can take their place. Check each feature your clusters actually use, not the feature list, and estimate the engineering effort to replace it. The sibling pages on namespaces, HSM support and secrets sync describe where the gaps are. Also confirm whether your existing Vault Enterprise contract already bundles support and training, because a renewal that already includes those items narrows the cost difference considerably.
A quote is only useful if it is compared like for like. Request a line-item breakdown that separates licence, support, managed operations, and any add-ons such as HSM or cloud KMS integration, then price OpenBao with the same scope: storage, auto-unseal, high availability, backup and third-party support. Build the comparison over the contract term, not one year, and include a migration project in the OpenBao column. If the vendor option still wins on that basis, staying on Vault is a defensible decision and the cost review will have shown you why.
How DeployOpen scopes a fixed-price OpenBao implementation
DeployOpen is a Chainscore Labs company that plans, implements, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For a Vault Enterprise cost comparison, we start with a written scope that names your current Vault edition, storage, unseal method and clients, then build and hand over OpenBao in your environment.
How we scope
- Inventory your current Vault edition, storage backend, unseal method and Enterprise features in use
- Map secrets engines, auth methods, policies and clients that must keep working after cutover
- Agree in writing which unseal option, HSM or cloud KMS, and high availability design apply
How we build
- Install OpenBao on your chosen platform, including the Helm chart route where Kubernetes is used
- Configure storage, high availability and auto-unseal in your own cloud accounts or data centers
- Test the migration path against your Vault version before any production cutover
How we hand over
- Document architecture, runbooks, backup and restore steps, and the recurring cost components
- Deliver the cost model with the components you pay for directly and those you run internally
- Train your operators on upgrades, token handling and client re-pointing before handover
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing first
- Ongoing support, upgrades and continuous testing are available as a retainer
- Ask for a quote built from the written scope, with your third-party support needs listed separately
