Enterprise Secret Governance for a Fraction of the Enterprise Tax
Stop paying $60,000/year for HashiCorp Vault or $78,000/month in raw AWS KMS query meters. Run Sovereign Vault in your private cloud for $0/mo in infrastructure and pay only for zero-knowledge fleet governance.
Self-Hosted
For individual developers, homelab self-hosters, and hobbyists building standalone projects.
- ✓ Single static Rust binary (<5MB)
- ✓ Native embedded TLS 1.3 by default
- ✓ Autonomous zero-config ECDSA certs
- ✓ Process RAM lock (mlock against swap leaks)
- ✓ Local 256-bit SQLCipher volume encryption
- ✓ Zero-history CLI & local REST API
- ✗ Cloud fleet health telemetry
- ✗ Centralized multi-cluster console
Startup BYOC
For seed-stage through Series B startups running microservices. Discretionary card-friendly pricing.
- ✓ Up to 3 Sovereign Clusters (dev, staging, prod)
- ✓ Centralized Fleet Console: sovereign.oakai-security.com
- ✓ 24/7 Automated Health Telemetry: ping heartbeats & alerts
- ✓ Workload Identity Federation: GitHub Actions, GCP, AWS
- ✓ Active Directory / OIDC CIAM: Human operator SSO
- ✓ Zero KMS Fees: Saves $75k+/mo vs raw KMS meters
- ✓ 1-Click Terraform drop-in for Google Cloud & AWS
- ✓ Priority Email & Private Discord Support
Enterprise Sovereign
For fintech, healthtech, and enterprises with strict SOC 2, HIPAA, or multi-VPC requirements.
- ✓ Unlimited Clusters across Multi-Cloud (GCP, AWS, OCI, Azure)
- ✓ Tamper-Evident SIEM Forwarding: HMAC-SHA512 audit chaining
- ✓ SOC 2 & HIPAA Compliance Reports: Exportable attestation
- ✓ Proactive Security Scanner: Stale secret & token analyzer
- ✓ Custom Terraform Topology: Engineered for bespoke VPCs
- ✓ Dedicated Shared Slack Channel with core security team
- ✓ 4-Hour Emergency SLA & Break-Glass Recovery Support
Need additional clusters on Startup BYOC?
Additional isolated Sovereign Vault clusters can be added to any Startup BYOC plan for $99 / cluster / month. Keep dev, staging, QA, and individual client tenancies completely isolated without buying a new plan.
How Sovereign Vault Pays for Itself on Day 1
Based on a high-throughput microservice fleet (200 services making 10,000 queries/second):
Frequently Asked Questions
Can Oakai Security see or decrypt my secrets?
No. Sovereign Vault is strictly Zero-Knowledge. The vault container runs inside your private VPC, wrapped by your own Cloud KMS key, with no public IP address. Your plaintext secrets are decrypted only on your node and sent directly to your browser RAM over your internal IAP or WireGuard line. Oakai Security servers receive only aggregate telemetry (health: active, secret count: 3) and tamper-evident HMAC hash chains.
What cloud infrastructure is required in my Google Cloud or AWS account?
Sovereign Vault is engineered to run 100% within Google Cloud's Always Free Tier: a single e2-micro virtual machine, a 30 GB pd-standard persistent disk, and Cloud KMS. Your total cloud provider bill for running the vault is $0.00 / month.
Why is $499/mo better than per-seat pricing (e.g., $18/user)?
Per-seat pricing penalizes growing engineering teams and forces companies to restrict secret access. With Sovereign Vault, you pay a predictable flat fee of $499/month for your entire team. You can connect unlimited developers and microservices without worrying about sudden license jumps.
Can I migrate from HashiCorp Vault or Doppler?
Yes. Sovereign Vault provides a simple JSON import/export tool and compatible REST endpoints. In our Enterprise tier, our security team provides white-glove migration assistance to export your existing paths and configure your workload identity bindings.