When the Infisical open source core is enough and when a paid plan is needed
If your secrets needs are storage, injection, rotation of static secrets and access by machine identities, the MIT-licensed Infisical core can cover them. A paid plan becomes necessary when you need a specific gated control: SAML SSO, dynamic secrets, SCIM provisioning, secrets approval workflows, or KMIP and external KMS or HSM integration. The first step is to list which of those controls your policy requires, because the license boundary is per feature, not per deployment. Infisical's repository is MIT except for content in an ee directory, which sits under the separate license in ee/LICENSE, so confirm with the vendor and your own review exactly which modules you would run.
The published plan gates are the deciding detail. On Infisical's pricing page, SAML SSO starts at Pro, while dynamic secrets and SSO or MFA enforcement start at Advanced, and SCIM, approval workflows, KMIP and external KMS or HSM are Enterprise only. Secrets Management is priced per identity per month: Free at 0 dollars with 5 identities, Pro at 20 dollars billed annually or 23 dollars monthly, Advanced at 40 dollars annually or 46 dollars monthly, and Enterprise at custom annual pricing. Those are the vendor's list figures. Multiply them by the number of machine and human identities you expect, and confirm with Infisical how identities are counted before you budget.
Self-hosting is a separate decision from the plan tier. Infisical's self-hosting documentation states that enterprise features such as SSO or gateways require enterprise licensing, and its pricing page says supported, licensed self-hosting is available after talking to an expert. Ask in writing which features your self-hosted build includes under which license, what the licensed self-hosting fee covers, and whether support and upgrades are part of it. A team that needs only the core and can run PostgreSQL and Redis itself may stay on the open source build, while a team that needs approvals or HSM for regulated secrets should price the Enterprise path before choosing the architecture.
Which Infisical capabilities are in the core and which are gated
This table sorts Infisical's capabilities into features the README describes, and the plan gates Infisical publishes for SSO, SCIM, approvals and HSM. Read the middle column as the vendor's stated position and the right column as the check to run before you buy. Where the README and the pricing page appear to disagree, treat the pricing page gate as the one to verify.
| Capability | Where it sits today | Confirm before purchase |
|---|---|---|
| License boundary | MIT Expat for the repository, except code in any ee directory under ee/LICENSE | Map each module you need to the MIT core or the ee directory |
| Secret syncs to GitHub, Vercel and AWS | Listed in the README; the Free plan includes 10 secret syncs | Sync count and supported targets on the current plan page |
| Secret rotation and point-in-time recovery | Listed in the README; no plan gate in the published pricing facts | Which rotation providers are available and on which plan |
| Dynamic secrets for PostgreSQL and MySQL | Listed in the README; the pricing page starts dynamic secrets at Advanced | Current plan tier and the license file, since the two sources differ |
| Kubernetes operator and injection agent | Listed in the README; no plan gate in the published pricing facts | Licensing terms for running the operator and agent on self-hosted editions |
| Private PKI, KMS and privileged access | Listed in the README; no plan gate in the published pricing facts | Which of the three sit in the MIT core and which need a license |
| SAML SSO | Starts at Pro, with 30-day audit retention | Audit retention and SSO terms in the current pricing table |
| SSO or MFA enforcement | Starts at Advanced | Whether enforcement is available on your self-hosted edition |
| SCIM, approval workflows, KMIP and external KMS or HSM | Enterprise only on the pricing page | Quote scope and self-hosted enterprise licensing through Infisical sales |
How licensing, support and updates differ between the editions
Infisical's open source core and its paid tiers are governed by different licenses, and self-hosted enterprise features depend on a separate licensing step. The cards below separate what the MIT repository grants from what the ee directory, the pricing page and the vendor contract control, so you know which questions to put in writing before you commit.
MIT core and the ee directory
The repository is licensed under the MIT Expat license, except content in any ee directory, which falls under the separate license in ee/LICENSE. For a self-hoster this means the MIT grant covers the core you can read and run, but code under ee carries different terms. Before you build a production plan, have someone on your team read ee/LICENSE and map which features you need against the directories they live in.
Enterprise features need licensing
Infisical's self-hosting documentation says enterprise features such as SSO or gateways require enterprise licensing. Treat this as the gate for the decision: a self-hosted deployment that is entirely on the MIT core does not automatically include SSO, SCIM or other paid capabilities. Confirm with the vendor which features your license covers and whether any feature you rely on, such as a gateway, falls outside the core.
Supported, licensed self-hosting
The pricing page says supported, licensed self-hosting is available after talking to one of Infisical's experts. This is a sales conversation, not a published tier you can buy off the page. Ask what the license covers, which versions it supports, who answers incidents and what happens to your deployment if the license lapses or is not renewed.
Support and update terms in writing
Published pricing does not state response times, support hours or the upgrade cadence for self-hosted licensed customers, so do not assume them. Ask for the support severity levels, the response targets for each, the versions covered and how security patches reach a self-hosted install. Get the answers in the order form or contract, because a sales email is not an SLA.
Release cadence and your upgrade plan
Infisical published v0.166.8 on October 15, 2026, according to its GitHub releases page. Because the core and the licensed modules ship together in one self-hosted stack, plan upgrades as a tested change, not a pull of the latest image. Ask the vendor which releases carry enterprise modules, how long older versions remain supported and whether you receive advance notice of breaking changes.
Who carries the risk if licensing changes
Infisical's core is MIT, so the code you already run stays under that grant even if the company changes its commercial plans. Licensed modules are the part that can change in terms or price. Ask in writing how renewals are priced, what notice you get before changes, and what you can keep running on the MIT core if you stop paying for enterprise licensing.
What the MIT core gives a team that self-hosts it
The MIT core gives a self-hosting team the day-to-day secrets tooling: a dashboard per project and environment, secret syncs to platforms such as GitHub, Vercel and AWS, secret versioning with point-in-time recovery, and secret rotation. Dynamic secrets for databases such as PostgreSQL and MySQL are also in the core, so applications can receive short-lived database credentials rather than long-lived shared passwords. Machine identities can authenticate with Kubernetes, AWS, GCP, Azure, OIDC or Universal Auth, and access is governed by RBAC, temporary access, access requests and approval workflows. Before you plan a rollout, confirm in the Infisical README which of these items your chosen version ships under the MIT license.
Deployment is the other part of the core. Infisical's self-hosting documentation lists a single Docker container, Docker Compose, an official Helm chart with bundled PostgreSQL and Redis, Linux packages, and AWS or GCP reference deployments. A small team that runs one environment on Compose can start with the core alone. The core is also sufficient when there is no SSO requirement, few secret consumers, and no need for SCIM provisioning, which is listed as an Enterprise feature. Ask yourself whether every person who opens the dashboard can be managed by local accounts without an audit or offboarding obligation.
The core stops being sufficient once your identity policy depends on a central directory. The pricing page places SAML SSO at Pro and SCIM and secrets approval workflows at Enterprise, so a team that must enforce corporate login or automatic deprovisioning should price those plans before committing. Check also that the self-hosting documentation's note on enterprise features, such as SSO or gateways, applies to your deployment. Confirm the licensing path for self-hosting with Infisical, since its pricing page says supported, licensed self-hosting is available after talking to one of its experts.
How to verify which gates apply to your environment before buying
This sequence turns the published Infisical plan gates into a written list of what your environment needs, what it will cost per identity, and what the vendor confirms about self-hosting before you sign anything.
List the features your environment requires
Your security architect and the team that owns secrets write down every capability the platform must provide on day one, such as SAML SSO, SCIM provisioning, dynamic database secrets, approval workflows, KMIP, or an external KMS or HSM. Separate hard requirements from features you would like later. Record which identity types need access (human users, Kubernetes workloads, CI pipelines, cloud roles) because licensing counts identities. The step is done when the list is signed off by security and platform leads and each item has a named owner.
Map each requirement to its published plan gate
Take each item from the requirements list and find where Infisical's pricing page places it. The published gates place SAML SSO at Pro with 30-day audit retention, dynamic secrets and SSO or MFA enforcement at Advanced, and SCIM, secrets approval workflows, KMIP and external KMS or HSM at Enterprise only. Mark any requirement that falls outside the plan you are considering. The output is a gate table with one row per requirement, the plan it sits in, and a column for whether it sits in the MIT core or in the separately licensed ee directory. Confirm the core versus ee split against the repository license before relying on it.
Confirm current per-identity pricing on the vendor page
Open the pricing page on the day you build the estimate and record the figures as published then. At the time of the researched facts, Free covers 5 identities, Pro lists 20 dollars per identity per month billed annually or 23 dollars monthly, Advanced lists 40 dollars annually or 46 dollars monthly, and Enterprise is custom annual pricing. Multiply the identity count from step one by the tier that holds every mapped gate, and note which costs are recurring subscriptions. Ask the vendor how identities are counted, since machine and human identities may be counted differently. The output is a dated cost sheet with the source URL and the assumptions behind the count.
Ask which enterprise features self-hosting needs
The self-hosting documentation states that enterprise features such as SSO or gateways require enterprise licensing, and the pricing page says supported, licensed self-hosting is available after speaking with the vendor. Put a written question to Infisical asking which features in your gate table need a license when run on your own infrastructure, whether any gate differs between Infisical Cloud and self-hosting, and what a self-hosted license covers. Compare the answer with the pricing page. The output is a written vendor response that lists each feature as included, licensed, or not applicable to self-hosting.
Request support and update terms in writing
Ask for the support scope, response commitments, upgrade responsibilities, and any service levels that come with each plan or license, and confirm whether those terms apply to self-hosted deployments. The published release history includes Infisical v0.166.8, published on October 15, 2026, so ask how the vendor notifies customers of new releases and what upgrade assistance is included. Confirm who applies patches in your environment. The output is a written terms document you can compare across the shortlisted options, with any unstated terms marked as unconfirmed.
Check the outcome against your environment
Run the finished gate table, cost sheet, and vendor answers past the people who will operate the platform and the auditors or assessors who will review it. Confirm that every hard requirement sits in a gate you can buy, that the identity count is current, and that self-hosting terms match your network and data residency constraints. If a requirement is missing from the gate table or the vendor answer is unclear, do not treat it as covered. The step is complete when each hard requirement has a plan, a price basis, a written vendor answer, and an owner who has accepted the result.
What each edition costs and what drives the bill
This table separates the published per-identity Secrets Management prices from the internal costs of running Infisical yourself, which Infisical's pricing page does not quantify. Read the first rows for the list price of each tier, then the later rows for what drives the total and what to request in a quote.
| Cost component | Who is paid or who pays | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Free plan | Infisical lists 0 dollars per identity per month with 5 identities, 3 environments and 10 secret syncs | Recurring at 0 dollars while within the listed limits | Identity count and environment count; exceeding the caps moves you to a paid tier |
| Pro plan | Listed at 20 dollars per identity per month billed annually or 23 dollars monthly (Infisical pricing page) | Recurring, billed per identity | Number of machine and human identities; annual billing lowers the per-identity rate versus monthly |
| Advanced plan | Listed at 40 dollars per identity per month billed annually or 46 dollars monthly (Infisical pricing page) | Recurring, billed per identity | Identity count; dynamic secrets and SSO or MFA enforcement start here, so these features raise the tier, not just the count |
| Enterprise plan | Custom annual pricing set by Infisical, covering SCIM, approval workflows, KMIP and external KMS or HSM | Recurring annual agreement | Scope of licensed features, identity volume and support terms; request the price in writing before committing |
| Self-hosted licensed deployment | Infisical's pricing page says supported, licensed self-hosting is available after talking to its experts, so the license terms are a sales conversation | Recurring license fee if one applies; confirm with Infisical | Whether your required features sit in a licensed tier; confirm what the license covers before you deploy |
| PostgreSQL and Redis | Your team or your cloud account, since the Helm chart bundles them but production sizing is yours | Recurring infrastructure cost plus one-time setup | Backup and high-availability design, storage growth from secret history and audit data, and managed versus self-run choice |
| Staff time for operations | Your platform, security or DevOps staff, and DeployOpen only if you scope that work in writing | One-time for deployment and integration; recurring for upgrades, backups and access reviews | Number of environments, the number of integrations to syncs and Kubernetes workloads, and how often you upgrade |
| Quote request for Enterprise | Infisical's sales team issues the price | Confirm one-time and recurring fees separately | Ask which features are included, the identity volume basis, self-hosting license scope, support hours and renewal terms |
Moving from the free plan or core to a paid plan, and back
This sequence shows how a team moves Infisical from the MIT-licensed core or Free plan onto Pro, Advanced or Enterprise features, and what must be confirmed before moving back down. It produces a written record of which identities, environments, syncs and SSO settings carry over.
Inventory what runs on the free tier
The platform team lists every project, environment, machine identity, secret sync and any SSO or MFA setting currently in use, whether on Infisical Cloud Free or on a self-hosted core deployment. Identities are counted against the plan because pricing is per identity per month, so this count sets the baseline for any quote. The step is done when the inventory is a single document that security and finance both have reviewed.
Map each feature to its plan gate
Using Infisical's pricing page, the team matches each needed capability to the lowest plan that includes it. SAML SSO starts at Pro with 30-day audit retention, dynamic secrets and SSO or MFA enforcement start at Advanced, and SCIM, secrets approval workflows, KMIP and external KMS or HSM are listed as Enterprise only. The output is a gap list showing which features force the move up. Confirm the current gates in writing, since the page can change.
Confirm self-hosted licensing terms
For a self-hosted deployment, the team asks Infisical how licensed self-hosting is provisioned, since the pricing page directs buyers to its experts for this. Enterprise features such as SSO or gateways need enterprise licensing according to the self-hosting documentation, and anything under the ee directory falls under the separate ee license rather than the MIT core. The step closes when the vendor has confirmed in writing which modules the license covers and how it is activated in your environment.
Request a plan change and carry-over review
The team asks the vendor how an upgrade is applied to an existing Cloud workspace or self-hosted instance, and whether identities, environments, secret syncs and SSO configuration are retained without re-entry. Infisical's published materials do not document the migration path in detail, so these answers must come from Infisical. The output is a written confirmation covering each object type, plus any steps that require manual reconfiguration by your administrators.
Test SSO and sync behavior after upgrade
Before production traffic moves, administrators sign in through the newly enabled SSO path in a non-production project, confirm MFA enforcement behaves as intended, and trigger one secret sync to a downstream platform such as GitHub, Vercel or AWS. They also check that machine identities still authenticate through their configured method, such as Kubernetes, AWS, OIDC or Universal Auth. The step is complete when each test has a recorded result and any mismatch has an owner.
Ask about downgrade and data retention
Before committing, the team asks Infisical what happens to secrets history, audit logs, SSO configuration and SCIM-provisioned users if the subscription is reduced or cancelled. Questions should cover how long audit retention lasts after a move to a lower plan, whether features that depend on Enterprise licensing stop working immediately, and how a self-hosted license is revoked or renewed. The output is a downgrade clause or written answer that the procurement and legal teams can file alongside the contract.
Document the move back to core
If the team returns to the free tier or the MIT core, it records which paid features were disabled, which identities and syncs remain, and which SSO or approval workflows must be rebuilt by hand. Access granted through SCIM or approval workflows may need a replacement control before the paid feature is removed. The step is done when the change record shows the new access model and an owner has signed off on any gap.
When a paid Infisical plan is worth the cost
A paid Infisical plan earns its cost when a control you must prove is missing from the free tier. The pricing page places SCIM and secrets approval workflows in the Enterprise plan, SAML SSO from Pro, and dynamic secrets and SSO or MFA enforcement from Advanced. Start by listing which of those controls your auditors, security team or identity policy require, then price only the tier that delivers them. For a workforce that must be deprovisioned automatically when people leave or change roles, SCIM is the feature that matters, because manual removal of user access tends to lag behind HR changes. Ask Infisical to confirm exactly which SCIM behavior and audit retention come with the Enterprise plan before you rely on it in a joint control narrative.
Dynamic secrets are the clearest case for Advanced. Instead of a shared static database password stored in a project, Infisical can issue short-lived credentials for databases such as PostgreSQL and MySQL, which narrows the window of exposure for each workload. Approval workflows are the matching control for production secrets: a change to a production environment can wait for a named approver rather than landing directly. For key custody, an external KMS or HSM is Enterprise only on the pricing page, so the decision depends on whether your policy requires keys to be held outside the software platform. Confirm with Infisical how each of these maps to your environments and whether the self-hosted license covers the same gates as the cloud plans.
A paid plan adds little when one team manages a handful of identities with no audit, SSO or key custody mandate. Consider an illustrative team of three developers sharing a single staging project: the Free plan's 5 identities, 3 environments and 10 secret syncs may cover it, and SAML SSO or approval gates would mostly add cost. Price is charged per identity per month, so the cost grows with machine and human identities, not with projects or secrets. Before you commit, count your identities across all environments, list the controls your auditors have actually asked for, and request a written quote from Infisical that separates what is one-time from what recurs.
Questions buyers ask about Infisical editions, cost and effort
Does SAML SSO require a paid Infisical plan?
Yes. On Infisical's published pricing page, SAML SSO starts at the Pro plan, which includes 30-day audit retention. SSO or MFA enforcement and dynamic secrets start at Advanced, so a team that needs SSO enforcement as well as SAML should check the Advanced gate. The MIT-licensed core in the repository does not include these paid features, and the self-hosting documentation states that enterprise features such as SSO require enterprise licensing. Confirm the current gate with Infisical before you budget, because plan contents can change between pricing page revisions.
What is the Free Infisical plan missing for enterprise needs?
The Free plan lists 0 dollars with 5 identities, 3 environments and 10 secret syncs. Against an enterprise requirement, the gaps are the features the pricing page reserves for higher tiers: SAML SSO (Pro and above), dynamic secrets and SSO or MFA enforcement (Advanced and above), and SCIM, secrets approval workflows, KMIP and external KMS or HSM support (Enterprise only). Teams that need approval gates on production secrets, automated identity lifecycle through SCIM, or HSM-backed key custody should expect to pay for a higher tier or an enterprise license. Map your control requirements to these gates before choosing the edition.
Does self-hosting Infisical require a license?
It depends on which features you run. The core repository is MIT licensed, except content in any ee directory, which falls under the separate license in ee/LICENSE. Infisical's self-hosting documentation says enterprise features such as SSO or gateways require enterprise licensing, and the pricing page says supported, licensed self-hosting is available after talking to one of its experts. If your design needs any gated feature, treat licensed self-hosting as a required line in the quote. Ask Infisical to confirm in writing which features your deployment uses and whether the license covers the number of identities you expect.
How is the per-identity price counted in Infisical?
Infisical's Secrets Management plans are priced per identity per month. The published figures are Pro at 20 dollars billed annually or 23 dollars monthly, and Advanced at 40 dollars annually or 46 dollars monthly, with Enterprise at custom annual pricing. Each machine or human identity that authenticates to the platform is the unit that drives the count, so the more workloads, services and users you onboard, the higher the bill. Before you buy, ask Infisical to define in writing what counts as an identity, whether environments or projects change the count, and how the bill changes if identities are removed mid-term.
How long does it take to move between Infisical editions?
Infisical does not publish a migration duration, so the honest answer is that the effort depends on your environment. Upgrading a plan on a hosted or licensed deployment is largely a commercial and configuration step, while moving from a free or unlicensed self-hosted setup to licensed self-hosting may also involve changes to the deployment, PostgreSQL and Redis dependencies, and identity federation. The team needs access to the admin console, a plan for re-testing SSO and machine authentication, and someone who can validate secret access after the change. Ask Infisical for its upgrade path and a rollback plan before you commit.
Can a small team run self-hosted Infisical alone?
A small team can deploy and operate a basic setup, because Infisical offers a single Docker container, Docker Compose, an official Helm chart with bundled PostgreSQL and Redis, and Linux packages. The effort rises when you add licensed features, high availability, backups, upgrades, and integration with your identity provider and Kubernetes workloads. Check whether your team has someone who owns the database, the secret rotation and dynamic secret configuration, and the on-call response for a secrets platform, since an outage or a mishandled upgrade affects every workload that reads from it. A small team that cannot cover those roles should price a managed option or outside help.
What does a fixed-scope DeployOpen engagement cover for Infisical?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For Infisical, a fixed-scope engagement would typically cover agreed deployment design, integration with your identity provider and workloads, hardening, backup and upgrade procedures, and documentation, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, and a quote follows from the written scope. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen is not an Infisical partner or reseller unless that is stated elsewhere, and licensing for Infisical's paid features is a separate decision you make with Infisical.
Which quote details should I request before buying Infisical?
Ask for a written breakdown that separates one-time work from recurring cost. The recurring items are the Infisical subscription or license, priced by identity count, and any retainer for support or upgrades. The one-time items are design, deployment, integration, migration and documentation. Request the identity count assumptions, the list of gated features in scope, the edition each feature requires, the environments and syncs included, and the upgrade and backup responsibilities. Also ask who owns the database and secret material after handover, and what happens to access if you stop paying.
Where outside help changes the edition decision
A regulated team benefits from an implementation partner when the edition decision is really a scoping decision. Before choosing between the MIT core and a paid plan, list every capability you need and check each against Infisical's published gates: SAML SSO starts at Pro, dynamic secrets and SSO or MFA enforcement start at Advanced, and SCIM, secrets approval workflows, KMIP and external KMS or HSM are Enterprise only on the Infisical pricing page. Pricing is per identity per month, so the identity count that drives cost also depends on how many machine workloads you onboard. A partner can help turn that list into a written scope, including which gated features are required on day one and which can wait.
Self-hosting inside your own infrastructure is where the edition decision gets operational weight. The self-hosting documentation states that enterprise features such as SSO or gateways require enterprise licensing, and it lists options from a single Docker container to the official Helm chart with bundled PostgreSQL and Redis. Confirm with Infisical which licensing applies to your chosen topology before you commit to an architecture, and ask how the license is delivered and renewed. An implementation partner can plan the deployment, the database and cache dependencies, backups and upgrades within your cloud accounts, data centers or air-gapped network, and document the result for your operations team.
Integration and evidence are the parts most often underestimated. SSO must be wired to your existing identity provider, and secret syncs must reach the platforms your teams already use without creating unmanaged copies. Compliance assessors will ask for proof of how access was granted and reviewed, so plan the evidence trail early. DeployOpen plans, implements, integrates and documents self-hosted platforms and prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications; independent auditors and certification bodies do. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, so ask any partner for that written scope and confirm which edition and license each deliverable depends on.
How DeployOpen scopes and supports either Infisical edition
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Infisical, that means agreeing in writing which edition, feature set and deployment path your team actually needs before any work starts.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope states which Infisical features are in use, including any SSO, SCIM, approval workflow or HSM requirement that needs a paid plan or enterprise license.
- We ask you to confirm the identity count and environment count the scope assumes, because the plan tiers are priced per identity.
How we build
- We set up the chosen deployment path, whether single container, Docker Compose, Helm or Linux packages, inside your own environment.
- We connect machine identities through the authentication methods you select, such as Kubernetes, AWS, GCP, Azure, OIDC or Universal Auth.
- We configure secret syncs, dynamic secrets and access policies only for the features your edition includes, and test each one before handover.
How we hand over
- We document the edition boundary, so your team knows which controls depend on the MIT core and which depend on a licensed module.
- We deliver runbooks for upgrades, backups of the PostgreSQL and Redis dependencies, and access review tasks your staff will own.
- We walk your team through the evidence produced for internal reviews, noting that independent auditors, not DeployOpen, issue any assessment outcome.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
- Retainers can cover version upgrades as new Infisical releases ship, with the upgrade plan confirmed against your change process.
- Ask for the retainer scope in writing, including who handles licensed-module renewals and how quoted seats are tracked.
