Fully Managed OpenBao
as a Service

Deploy OpenBao as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

OpenBao is an open-source secrets and encryption manager. It holds API tokens, database passwords and private keys in one encrypted store, issues short-lived credentials on demand, and encrypts application data so your services never handle raw key material. It is a Linux Foundation project, forked from the last openly licensed release line of HashiCorp Vault.

✓Free 7-day trial  ✓99.9% Uptime SLA  ✓No credit card  ✓Cancel anytime

✓Free 7-day trial  ✓99.9% Uptime SLA
✓No credit card  ✓Cancel anytime

Start free trial
Pricing
OpenBao

OpenBao

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region — 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
OpenBao Preview Image

ABOUT THE SOFTWARE

What is OpenBao

OpenBao stores secrets, issues credentials and performs cryptographic operations behind an identity-aware policy layer. Applications ask it for a credential rather than reading one from a file, and every request is recorded. It speaks the same HTTP API as the project it was forked from.

The project is licensed under the Mozilla Public License 2.0. That is weak, file-level copyleft: changes to the project's own files must be shared back, while the software around it is untouched by the licence. Contributors sign off under the Developer Certificate of Origin rather than assigning copyright through a contributor agreement, so no single company holds the rights needed to relicense the codebase later. Governance sits with the Linux Foundation, under a technical steering committee drawn from several unrelated companies.

Capabilities that are paid-tier features in the upstream product ship here at no cost, including namespaces for tenant separation and horizontal scaling of read traffic. Named adopters include GitLab, which runs it as the engine behind its own secrets manager, along with SAP, NVIDIA and Fermilab. The practical consequence for a small team is that the feature ceiling is set by the software, not by a plan tier, and the exit path is a snapshot file rather than a negotiation.

FEATURES

What OpenBao does

The feature set below is OpenBao's own, not ours. It covers storing secrets, issuing them on demand with an expiry attached, performing encryption on behalf of applications, and deciding who may do which of those things. Everything listed is available on a €9 instance.

Versioned key-value store

Secrets are stored encrypted, with version history and soft delete, so a bad write can be rolled back rather than recovered from a backup.

Dynamic credentials

Databases and cloud accounts hand out credentials created on request, tied to a lease, and revoked automatically when the lease ends.

Encryption as a service

The transit engine encrypts, decrypts and signs on behalf of applications. Keys never leave the store, and rotation does not require re-encrypting old data.

Internal certificate authority

The PKI engine issues short-lived X.509 certificates, supports ACME, and publishes revocation lists, with multiple issuers for rotation.

Identity-based authentication

Humans sign in through OIDC or LDAP; machines use AppRole, certificates or their platform identity. Every path resolves to one identity model.

Policy language

Access is granted per path and per operation in a readable policy file, so least privilege is something you can review rather than infer.

Leases and revocation

Every issued secret carries a time to live. Revoking a parent revokes everything issued beneath it, in one call.

Request logging devices

A record of every request and response can be written to a file, a socket, or an HTTP endpoint, and shipped to whatever you already collect logs with.

Software Source
Documentation
Video Tutorials

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app on DANIAN ships with the same operational baseline. You do not choose a backup add-on or a monitoring tier. Hosting, patching, backups, SSL, and support are part of the €9, and they apply to OpenBao the same way they apply to everything else in the catalog.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers by email and ticket. DNS, SMTP & migration help. All included in €9.

Start 7-day free trial

WHY MANAGED

Why teams pick managed OpenBao

Most teams arrive after the upstream product moved to a restricted licence and its low-cost hosted tier was retired. They want the same API without a vendor able to change the terms, and without owning the part of the job that wakes people up: keeping the store unsealed, backed up and patched.

Running this software is not the same as installing it. The install is an afternoon. The ongoing work is a seal strategy, a snapshot schedule that has actually been restored from, and someone who notices when the node stops answering. None of that appears in a quickstart guide.

The failure mode that catches teams first is the seal. After any restart the process comes back sealed and refuses every request until a threshold of key shares is supplied by hand. The project's own documentation acknowledges that this makes automated installation difficult. In practice a host reboots at 03:00, the readiness check fails, and every service that reads a credential from it starts failing too, until a person with key shares wakes up. Teams then reach for automatic unsealing and hit the second problem: the key that opens the store must not be the only copy, and must not sit exclusively beside the data it opens.

Storage moves are the other recurring trap. Migrating between the file backend and integrated Raft storage has left nodes unable to unseal afterwards on recent releases, and a migration in the other direction has dropped key-value mounts entirely. A full disk panics the Raft store rather than degrading. These are known, reported, and avoidable by anyone who tests the path before running it in production.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day
5 stars review

No more maintenance headaches!

Finally, I can relax and not bother with maintenance. Each of the softwares that we run on DANIAN is automated and running stable for couple months already. They even assist us with modifying the DNS records. Once we needed to modify the config of Nextcloud so that we are able to upload higher than 5GB files and they assisted us fast. I also love their documentation!

Review from Kevin Blackwell

Kevin Blackwell

Review Origin United States
5 stars review

Best managed service

I previously ran Peertube, Mastodon, Mattermost and Mirotalk on other providers before switching to DANIAN. I was tired of handling the updates and backups myself. Not only that the performance is "out of this world" fast, but their tech support is amazing. Since then I added 5-10 more Apps on my account. I also love how they add more softwares on their list constantly!

Review from William Northfield

William Northfield

Review Origin United Kingdom
5 stars review

Love the personalized service!

I own an ecommerce startup. I knew that I need some softwares so that I add automations in my biz. I contacted their support team and I explained my needs. Albert recommended me couple softwares, each for a specific use-case. I signed up for the free trial and tested all. Ended up activating 6 apps. Everything is running smooth 2 months so far. I love the personalized service that I get with them!

Review from George Adams

George Adams

Review Origin United States
5 stars review

n8n runs excellent

We needed to add the ffmpeg functionality to our n8n instance. I contacted their support team. They made the required changes in couple minutes and notified me. Usually for this type of service I would need to hire a developer on a hourly basis. Love them!

Review from David Hartmann

David Hartmann

Review Origin Germany
5 stars review

Smooth experience

I needed a way to manage the projects and files for my company. This was the first time I learn about opensource. I asked their support team and they assisted me immediately. I started with Openproject. Later I added Nextcloud. My team were able to get used to the apps fast.

Review from Levi Nilsso

Levi Nilsson

Review Origin Norway
5 stars review

Bye GA

I wanted to replace GA with something but I didn't know the options. I talked with Jack from support. Couple minutes after that, I have a running Matomo Analytics. They even configured the tracking and connected it with my website. I have only words of appreciation and respect!

Review from Wyatt Mitchell

Wyatt Mitchell

Review Origin Canada
5 stars review

Love the freedom

I wanted to use a crm for my startup. I signed up for the free trial. Tried out espocrm and dolibar and picked one. Their dashboard is very easy for a beginner. I recommend them and feel confident in choosing them.

Review from Elias Koch

Elias Koch

Review Origin Germany
5 stars review

Wow just wow

After discovering DANIAN, I wished I'd found them sooner — their solution is excellent and deserves wider recognition. Very good solution!

Review from Tyler Hollander

Tyler Hollander

Review Origin Canada
5 stars review

Professional tech support!

I thought that I knew what I was doing and I made changes in the Mattermost backend config file. Then it broke. I reached out to their tech and received an incredibly specific and fast response. They found the error fast and provided a clear solution.

Review from Bastian Engel

Bastian Engel

Review Origin Germany
5 stars review

Their support team is the best!

I had a problem with my card and the subscription could not be renewed in time. I notified their support and surprisingly, they showed much understanding. They basically left my apps run until I solved the card issue. Other providers would have deleted my data in a heartbeat. This is the way to build client-vendor trust!

Review from George Adams

George Adams

Review Origin United States
5 stars review

Fair price and fast

4 months ago I activated n8n, Uptime kuma, Vaultwarden and Paperlessngx. So far everything is perfect. The performance of all apps is excellent. I contacted their support team couple times for using custom subdomains for the apps and they were fast and kind. I'm constantly recommending them to my network!

Review from Atanas

Atanas

Review Origin Macedonia
5 stars review

Vaultwarden 10/10

I wanted to selfhost a passwords manager for my company but I didn't trust the mainstream providers. I tried out Vaultwarden for the free trial. I loved how their support team communicated with me professionally but still kind. I know that I can contact them whenever with whatever question I have. Recommended!

Review from James Smith

James Smith

Review Origin United States
5 stars review

Multiple locations options

I run an agency. The majority of our clients are in different countries. I love that DANIAN has 20+ countries and I can spin up any app in any location. This gives us the freedom to focus on our clients. Sure, I can employee a dev in my team, but honestly, I prefer to not have those headaches. With DANIAN everything is running 24/7.

Review from Edward Nelson

Edward Nelson

Review Origin United States
5 stars review

Everything just works!

My focus is on my business, not running servers. I love that I can lauch any app without having to think about the tech behind it. Everything just works!

Review from Tony Roy

Tony Roy

Review Origin United States
5 stars review

Awesome support team!

I signed up for the free trial in order to test Chatwoot. I needed to put a livechat widget on my website but I don't have much tech experience. I contacted their support to see if they can assist. They went above and beyond by generating the livechat widget code for me and inserting it in my website. They answered all my additional questions. 

Review from Filip

Filip

Review Origin Austria
5 stars review

Very proactive!

Today couple of the videos on my Peertube got viral. Before I even noticed, their support have notified me via email that they proactively upgraded my app with more cpu & ram so that it continues to work without any downtime. They left the upgraded app with the added resources for couple days until the traffic stabilizes. After that I had the possiblity to stay on the same plan or keep the upgraded plan. Out of gratitude I stayed on the upgraded one.

Review from Luke Hall

Luke Hall

Review Origin Australia
5 stars review

Win-win!

I run a web design biz. After I perform the work for my clients, they constantly ask me for more software solutions. So I partnered with DANIAN. Not only I provide the requested softwares for my clients and get the increased revenue boost by delegating all to DANIAN, but also for those clients that wish to order directly from DANIAN, I send them an affiliate link. Win-win on all sides!

Review from Luke Walker

Luke Walker

Review Origin United Kingdom
5 stars review

Flexible

For the past couple months I was running many apps with DANIAN for my clients. But one of my clients wanted a software that isn't on the current list. I talked with their tech support. They accomodated me and added the software the same day. The next day, I signed for their Partners program. We will go long way together!

Review from Jeffrey Johnson

Jeffrey Johnson

Review Origin United States
5 stars review

Awesome customer service

I needed to add analytics on my website but I didn't know anything about DNS. Their team guided me at all phases and they performed the changes for me. Additionally they were transparent and notified me of every change applied and steps performed.

Review from Gabriele Marino

Gabriele Marino

Review Origin Italy
5 stars review

Good admin dashboard

Not only that I got Chatwoot, I also have access to the management dashboard. I love that I can view my hourly/daily usage and perform manual backups and restorations if needed. I don't need the level of control but it feels good to know that I have it if I need it.

Review from Matthew Turner

Matthew Turner

Review Origin Canada
5 stars review

Financially wise decision

Why install Chatwoot on a VPS that will cost me $20-25/month. Then worry about security, updates, backups, etc. Instead, I can activate it on DANIAN the same day for half the price. Plus, less headaches for maintenance. So happy I found out about this company!

Review from Andreas Schmitt

Andreas Schmitt

Review Origin Germany
5 stars review

Great service!

I configure custom Matomo tracking for my clients as a monthly service. Many of my clients were asking if they can selfhost Matomo instead of using the Cloud service. My employee recommended DANIAN. Basically, I can activate as much Matomo's in any of 20+ countries the same day. Additionally the affiliate revenue is a nice bonus.

Review from Jacob Turner

Jacob Turner

Review Origin United States
5 stars review

Smooth experience

I was listing through youtube tuts on how to install Bookstack myself. Then randomly, I found their video playlist exactly for Bookstack. Got curious and went at their website. For the same price (or higher) that I would pay for just the VPS, with them I'm getting a fully managed Bookstack. It's a no-brainer decision!

Review from Elias Gustafsson

Elias Gustafsson

Review Origin Sweden
5 stars review

I love opensource software

2 days ago I haven't heard about opensource softwares. Today I'm running 4 apps and enjoying the trip. Hey, 1 month later I may become a developer, haha just kidding. Love you guys!

Review from Mason Hayes

Mason Hayes

Review Origin United Kingdom
5 stars review

Its a great service

Its a great service. I love the performance of my Mastodon community. It keeps on growing and I don't have any worries about backups, secuirity, updates, etc.

Review from Vinícius Rocha

Vinícius Rocha

Review Origin Brazil
5 stars review

Very intuitive solution!

I wanted to use a nocode software for my company. A friend recommended them so I tried both Baserow and NocoDB, couple days later picked one.

Review from Haruto Hashimoto

Haruto Hashimoto

Review Origin Japan
5 stars review

Top-notch security

Honestly, I don't care much about performance and functionalities. I just wish to not bother with hacking attacks so that I can focus on my firm. I recommend them!

Review from Henrik Otto

Henrik Otto

Review Origin Germany
See more reviews

USE CASES

Three teams who run OpenBao on DANIAN

Three shapes of team we see on this app. What they have in common is a credential sprawl problem that outgrew environment files, and no appetite for owning a seal strategy. What differs is which engine does the work.

NINE-PERSON PLATFORM TEAM, FINTECH

Field-level encryption without holding the keys

One instance in the region closest to their payment processor. The transit engine encrypts personal data before it reaches the database, so the application never sees a raw key. Database credentials are issued dynamically on one-hour leases. The request log is exported nightly into the log store they already run.

FOUR-PERSON AGENCY, CLIENT ESTATES

One instance, one namespace per client

Namespaces separate each client's secrets, with policies scoped so a contractor working on one account cannot read another. When someone rotates off an account, their credentials expire within the lease period rather than waiting for a manual cleanup pass that everyone forgets.

RESEARCH GROUP LEAVING A CLOUD KEY SERVICE

An internal certificate authority they control

The PKI engine issues short-lived internal TLS certificates for services that were previously using long-lived self-signed ones. Staff sign in through the identity provider they already use. Snapshots are written off-box, and the whole store can be exported to a single file if the funding model changes.

COMPARISON

Four ways to run OpenBao

A secrets manager is bought per seat, per stored secret, or per call almost everywhere else, so the bill grows as the team grows. The four paths below hold the workload constant and change only who owns the operational work and how the price behaves as you add people.

Path1 user5 users10 usersWho does the work
Doppler, Team plan$21/mo$105/mo$210/moVendor. Price scales linearly per user; the free tier stops at three.
Self-host on a production-class VPS$24/mo$24/mo$24/moYou. Seal strategy, snapshots, restores, patching and the 03:00 alert are yours.
Home server~$450 once, ~$4/mo powersamesameYou, plus your home connection. No second site for snapshots without extra work.
DANIAN managed OpenBao€9/mo€9/mo€9/moUs. Flat per app, whatever the head count or the secret count.

Two cross-checks on the first row. Per-secret pricing behaves the same way: a store holding a few hundred secrets on AWS Secrets Manager runs around $120 a month at $0.40 per secret before request charges. Any surviving managed tier from the upstream vendor starts an order of magnitude above that. The self-hosted row is honest about the machine cost and silent about the hours, which is where that option actually gets expensive.

BY INDUSTRY

OpenBao for specific industries

Four sectors where the demands on a secrets manager come from outside engineering: a regulator, a funder, or a client contract. Each block names the rule that applies, what we set differently because of it, and a number you can check against your own situation.

Financial entities in scope of DORA, the Digital Operational Resilience Act (Regulation 2022/2554), must protect cryptographic keys across their whole lifecycle, with strong authentication and key protection required under Article 9. For these instances we configure the transit engine with a scheduled rotation policy, so encryption keys move forward on a fixed cadence while previously encrypted data stays readable without a re-encryption run. Request logging is switched on and exported to the customer's own log store rather than kept only on the instance. A typical setup: card-adjacent personal data encrypted through transit before it reaches the database, database credentials issued dynamically on one-hour leases, and the key ring rotated quarterly. The rules have applied since January 2025, and firms that fall short face penalties reaching 10% of annual turnover.


NIST SP 800-57 Part 1 sets out cryptoperiods, the working principle that a key should have a defined lifetime rather than living until someone remembers it. The same logic drives credential lifetimes in a pipeline. For engineering teams we enable the database engine with dynamic credentials and set the default lease to one hour with a bounded maximum, so a credential leaked in a build log is worthless by the next working day. Pipelines authenticate with their platform identity or AppRole rather than a long-lived token held in a variable. A common shape: a build job requests a database credential, uses it for the duration of the job, and the lease expires unrenewed. GitLab runs this same software as the engine behind its own secrets manager, which is a reasonable signal that the pattern holds at scale.


NIS2, Directive 2022/2555, obliges essential and important entities to manage cryptographic and access controls and to report significant incidents quickly: an early warning within 24 hours and a fuller notification within 72 hours. Meeting that second deadline depends on having a record of who read what and when. For these instances we enable a request-logging device from provisioning and stream it off the instance, so the evidence exists before it is needed rather than being reconstructed afterwards. We also configure the PKI engine as an internal certificate authority issuing short-lived service certificates, which removes the long-lived self-signed certificates that tend to accumulate in research environments. Fermilab contributes to the project directly, which says something about its fit here.


Client master service agreements usually require separation of duties between accounts: staff working on one client must not hold credentials for another, and access must end when the engagement does. Namespaces make that structural rather than procedural. For provider instances we set up one namespace per client with policies scoped to that namespace, so a policy mistake in one estate cannot reach into a neighbouring one. Credentials are issued with leases rather than created permanently, which means offboarding happens by not renewing rather than by remembering to delete. A working cadence: shared client credentials rotated every 30 days, and individual access revoked within one lease period of someone leaving an account. Namespaces are a paid-tier feature upstream and are included here.


FAQ

Frequently asked questions

Three groups of questions. The first covers how this instance is configured and what it can do. The second covers getting your existing secrets in, and getting them back out. The third covers billing, support and how the platform behaves regardless of which app you run on it.

01

Technical and configuration

Yes. We configure automatic unsealing, so a restarted instance returns to service without a person supplying key shares. That is the largest operational difference from a fresh install, which comes back sealed and refuses every request until someone unseals it by hand.
Yes, both. The project keeps the API shape of the software it was forked from, so existing clients, libraries and pipeline steps generally work unchanged. You also get terminal access to the container for the initial setup.
Yes. Applications send data to be encrypted or decrypted and never hold the key. Rotation moves the key ring forward while older data stays readable, so you avoid a re-encryption run each time. It is the engine our finance-adjacent customers enable first.
Yes. The PKI engine issues short-lived X.509 certificates, supports ACME for automatic renewal, and publishes revocation lists. Multiple issuers can exist side by side, which is what makes rotating a root certificate possible without a flag day.
You configure a connection and a role; the engine creates a database user on request, hands it back with a lease, and deletes it when the lease ends.

02

Migration and onboarding

21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.
Yes. A snapshot is a single file you can restore anywhere the software runs, and the software is openly licensed, so nothing about your data depends on us continuing to exist. That is the point of the licence test we run before adding any app.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on email and the ticket section in the client portal. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 email and ticket support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map
Browse all 150+ apps →

Try managed OpenBao for 7 days

No card. Cancel from the dashboard.
Start free trial