Skip to main content

Fully Managed Vault
as a Service

Deploy Vault as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

Vault is a source-available secrets-management platform — KV versioning, dynamic database credentials, PKI for short-lived mTLS certificates, encryption-as-a-service via the Transit engine, and OIDC-backed identity. It combines the convenience of a hosted secrets API with the security and control of running on infrastructure you choose.

Free 7-day trial  99.9% Uptime SLA  No credit card  Cancel anytime

Free 7-day trial  99.9% Uptime SLA
No credit card  Cancel anytime

Vault

Vault

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
Vault Preview Image

ABOUT THE SOFTWARE

What is Vault

Vault is a secrets-management platform from HashiCorp (now an IBM company) — a single API for storing static secrets, generating short-lived database credentials, issuing X.509 certificates, encrypting application data, and authenticating workloads against an identity provider. The Community Edition is licensed under BUSL 1.1.

Vault was open-sourced under MPL 2.0 in 2015 and was the standard self-hosted secrets-management tool for a decade. In August 2023, HashiCorp relicensed Vault to the Business Source License 1.1 — production use is permitted except where you are hosting Vault to compete with HashiCorp's own paid offering. IBM completed its acquisition of HashiCorp in February 2025, and Vault Enterprise 2.0 (April 2026) realigned the release lifecycle to IBM's Support Cycle-2 policy.

The Community Edition has 35,000+ GitHub stars and is used in production at companies ranging from infrastructure-platform startups to global banks. Enterprise-only features — namespaces, performance and DR replication, Sentinel policies, hardware-security-module seal-wrap — are not part of the Community build and are not part of what DANIAN hosts.

FEATURES

What Vault does

Vault is not just a place to store passwords. The platform exposes a dozen secrets engines and auth methods through a single HTTP API. The eight features below are what most of our customers actually use day-to-day on a Community Edition install.

KV v2 secrets engine

Versioned key-value storage with rollback. Older versions of a secret stay readable until you explicitly destroy them, which is useful when a deploy needs to be reverted.

PKI certificate authority

Issue short-lived X.509 certificates for service-to-service mTLS. The intermediate CA lives in Vault; the root signing material can stay offline if you need it to.

Identity-based authentication

OIDC, AppRole, Kubernetes, AWS / Azure / GCP IAM, and userpass are all first-class auth methods. Workload tokens are issued against policies, not against shared secrets.

Cloud-KMS auto-unseal

AWS KMS, Azure Key Vault, GCP Cloud KMS, OCI KMS, and Transit auto-unseal are all supported. The seal key stays inside a managed KMS, not on the Vault host.

Dynamic database credentials

Vault generates a unique short-lived database account per request — Postgres, MySQL, MSSQL, MongoDB, Snowflake, and others — and revokes it when the lease ends.

Encryption-as-a-service

The Transit engine encrypts and decrypts data your application sends, without storing the plaintext. Key versions and rotation are managed centrally rather than scattered across services.

Audit logging

Every API request and response is logged to one or more configured audit devices — file, syslog, or socket. DANIAN configures two by default so a single failure does not halt requests.

Path-scoped ACL policies

Policies are written in HCL and scoped to API paths. Multi-tenant patterns like secret/data/tenants/{tenant_id}/* work cleanly without needing Enterprise namespaces.

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app you deploy includes the full managed service — security, backups, updates, and support from day one.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers on chat. DNS, SMTP & migration help. All included in €9.

WHY MANAGED

Why teams pick managed Vault

HashiCorp announced HCP Vault Secrets end-of-sale in June 2025, with final retirement on June 30, 2026. Teams that adopted the cheap hosted Vault-as-a-service are now choosing between HCP Vault Dedicated at over a thousand dollars per month, or running Vault themselves. Managed Vault on infrastructure you pick is the third option.

Running Vault yourself is not the install. The install is a single binary. The work starts after.

The cluster starts sealed after every reboot, every patch, and every kernel upgrade. Without auto-unseal configured against a cloud KMS, an engineer has to be available with Shamir key shares before the cluster can serve a single API request. Most production Vault outages we have seen across our customer fleet start with this problem.

Vault's audit subsystem is failsafe in a way operators don't always expect. The documentation is explicit: with a single audit device enabled and that device unable to accept writes, Vault refuses to service the corresponding API requests until you recover the device. The right answer is to run at least two audit devices on independent backends. Most self-hosted Vault deployments don't, until they learn this the hard way at 2am.

Raft storage adds its own discipline. A clean snapshot has to be taken against the active leader with vault operator raft snapshot save, then shipped off the cluster on a schedule. Raw disk snapshots of a running Vault are not consistent. The seal key — or the recovery keys, with cloud-KMS auto-unseal — has to be backed up separately from the snapshot, somewhere a single compromise can't reach both. Most teams figure this out the first time they need to restore.

DANIAN ships these defaults pre-configured: cloud-KMS auto-unseal so the cluster recovers itself after every restart, two audit devices on independent paths (file plus syslog), scheduled Raft snapshots uploaded to off-site object storage every 24 hours with a 30-day rolling window, and lease TTLs tuned to a 24-hour default with a 7-day cap rather than Vault's stock 32-day default.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day

USE CASES

Three teams who run Vault on DANIAN

These are representative team types we set up most often. Each starts with the same flat €9 plan.

12-ENGINEER SAAS DEVOPS TEAM

Replacing AWS Secrets Manager before the second cloud lands

Germany region for data residency. ~80 secrets across staging and production, OIDC against Google Workspace for engineers, AppRole for CI runners. Default lease TTL tuned to 24 hours with a 7-day cap. Audit logs ship to a Loki-backed file device plus a syslog device into Grafana. Motivation: portability before adding GCP regions next quarter.

35-ENGINEER FINTECH

Dynamic database credentials plus PKI for service-to-service mTLS

Italy region primary, Raft snapshots replicated nightly to a second region. Postgres database secrets engine issuing 1-hour credentials for the analytics service. PKI engine acting as an intermediate CA for service-to-service mTLS, issuing 24-hour certificates via the Vault Agent injector. Auto-unseal via a KMS key in their own AWS account so the seal key never leaves their trust boundary.

CONSULTING AGENCY, 14 CLIENTS

One Vault per client, path-scoped policies, single Okta tenant

One DANIAN Vault per client because namespaces are Enterprise-only. Path-scoped ACL policies under secret/clients/{client}/*. OIDC against the agency's Okta tenant. Audit logs ship to a per-client S3 bucket. Default lease TTL is 8 hours to match the working day; max lease TTL is 30 days for long-running deployments.

COMPARISON

Four ways to run Vault

The honest comparison covers four paths: the hosted SaaS most teams are coming from, a self-managed Vault on a production-class VPS, a home or office server, and DANIAN's managed instance. The math is below at three workload sizes.

 PATH25 SECRETS100 SECRETS500 SECRETSOPERATOR TIME
AWS Secrets Manager
Hosted SaaS
$10.50/mo$42.50/mo$210/mo~0 hrs/mo
Self-host on a $24 production-class VPS
Plus $5 backup, $15 monitoring
$44/mo$44/mo$44/mo5–10 hrs/mo
Home or office server
HP ProLiant ML30 Gen10 (~€800–1,500) amortised
€60–110/mo€60–110/mo€60–110/mo2–4 hrs/mo
DANIAN Managed Vault€9/mo€9/mo€9/mo0 hrs/mo

AWS Secrets Manager scales linearly with secret count: at 25 secrets and 100,000 API calls per month, the bill is around $10.50; at 500 secrets and 2 million calls, around $210. The math is tied to one cloud region — multi-region replication adds cost.

Self-hosting on a $24 production-class VPS needs $5/month of object-storage backup and $15/month of monitoring to be honest about it, putting infrastructure around $44. The operator time is what the table can't fully show — auto-unseal, two audit devices, Raft snapshots, certificate rotation, and on-call rotation are all your engineer's problem. At €60–120/hour, even five hours a month pushes the effective monthly cost above €300.

A home or office server on a HP ProLiant ML30 Gen10 (~€800–1,500 amortised over three years) plus electricity, business-grade internet with a static IP, and an off-site backup target lands somewhere between €60 and €110 per month — before any operator time. The hardware is yours; so is the failure mode when the UPS dies during a patching window.

DANIAN's path is €9 per month, flat regardless of secret count. Auto-unseal, two audit devices, snapshot schedule, and a monitored seal-state are pre-configured. Operator time on your side is zero.

BY INDUSTRY

Vault for specific industries

Vault's value-per-engineer is highest where regulatory environments require fine-grained audit, short-lived credentials, and encryption that survives a database compromise. Four customer types we configure for most often.

Teams that process card payments work under strict rules about how primary account numbers and authentication codes are stored, transmitted, and accessed. Static credentials with quarterly rotation are typically the minimum auditors accept, and that minimum is hard to defend. Vault changes the math.

DANIAN enables the Postgres dynamic-secrets engine with a 1-hour TTL by default, so settlement jobs receive a fresh database credential per run that is automatically revoked when the lease expires. The Transit engine handles tokenization without storing plaintext, so application code never holds clear card numbers in process memory. A typical pattern: a nightly settlement job calls the AppRole login endpoint, receives a 60-minute Postgres credential, runs the day's queries, and the credential is revoked at lease expiry. Sixty-minute credential lifetime replaces the quarterly rotation that static credentials still require.
Patient-data protection rules in the United States — and equivalent regulations in most other jurisdictions — require detailed audit logging of who accessed what and when, plus strong encryption for data at rest and in transit. Self-hosted Vault deployments often run a single audit device and discover the blocking failure mode the first time it fires.

DANIAN configures two audit devices on every Vault instance by default: a file device written to local disk, and a syslog device shipped to your SIEM. KV v2 versioning preserves the change history of encryption keys, so a rotation never erases the previous version's metadata. A clinician-portal service calling the Transit engine to decrypt patient records will have that request logged on both audit devices, with HMAC-SHA256 hashing applied to string parameters by default. Two audit devices, not one, removes the single-device-blocking failure mode entirely.
Enterprise buyers ask multi-tenant SaaS vendors how tenant secrets are isolated from each other. Auditors who run trust-services reviews ask for the answer in writing, with specific reference to the access-control mechanism. Sharing a single KV mount across tenants and trusting application code to scope reads is rarely the answer that passes.

DANIAN sets up path-scoped ACL policies at provisioning, so tenant T-217 gets a policy granting only secret/data/tenants/T-217/* and its worker fleet receives tokens that cannot enumerate sibling tenants. When a new tenant onboards, a Terraform run creates the tenant-scoped policy and AppRole; tenant workers authenticate, receive tokens scoped only to their prefix, and are blocked from sibling tenants at the Vault layer rather than the application layer. Default token TTL is 8 hours to align with a working-day re-auth cadence, rather than Vault's stock 32-day default.
Platform-engineering teams running Kubernetes workloads at scale want short-lived credentials everywhere — no static service-account tokens, no long-lived database passwords baked into ConfigMaps, no long-lived API keys in a secret manager that any pod can read. Vault is the standard answer; the configuration is where teams burn time.

DANIAN's managed Vault ships with the Kubernetes auth method enabled, the Vault Agent injector pattern documented, and the default lease TTL tuned to 1 hour. A GitOps deployment lands a new Pod; the Pod's ServiceAccount JWT is validated against the Vault Kubernetes auth role, Vault issues a 1-hour token, the agent sidecar renews the lease until the Pod terminates, and the credential is automatically revoked at Pod exit. One-hour credential lifetime, automatic revocation on Pod termination, no long-lived service-account tokens to manage. Standard hardening guides for Vault — including the CIS Benchmark recommendations — are applied at provisioning.

FAQ

Frequently asked questions

Everything teams ask before signing up — answered straight, without sales speak.

Three groups: technical setup, migration, and how DANIAN works as a service.

01

Technical and configuration

No. We run Vault Community Edition under BUSL 1.1. Namespaces, performance and DR replication, Sentinel policies, hardware-security-module seal-wrap, and SCIM identity provisioning are Enterprise-only. For multi-tenant isolation we set up path-scoped ACL policies; for cross-region redundancy we replicate Raft snapshots to a second region.
Yes. The Vault HTTP API is standard. The official Terraform Vault provider, external-secrets-operator's Vault provider, Consul Template, and the Vault Agent injector all work against the managed instance without modification. We do not run a patched fork or a wire-incompatible build.
A root token is generated once during initialization and revoked after admin OIDC is set up. Day-to-day administration runs against an OIDC-backed admin policy. New root tokens, if needed, are generated through sys/generate-root against the recovery keys plus a valid Vault token from an existing operator.
Yes for almost every commercial use. The Business Source License 1.1 permits production use except where you are hosting or embedding Vault to compete with HashiCorp's paid version. Internal company production use is explicitly permitted. The official HashiCorp license FAQ is the authoritative reference.

02

Migration and onboarding

We can activate your app on your own custom domain/subdomain. Examples: mydomain.com, anyword.mydomain.com.
Or, on our randomized free subdomain. Example: 963.apps.danian.cloud
If you wish to use a custom domain/subdomain, select that option when ordering your app (or notify us later). We will send you the required DNS records and if needed, our tech team will modify them for you.
21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.
Yes. We support OIDC auth against any standards-conformant identity provider — Google Workspace, Microsoft Entra ID, Okta, Authentik, Keycloak, and others. Configuration is one API call plus the client-credentials exchange with your IdP; we do this with you during onboarding rather than asking you to puzzle it out.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on Email/LiveChat. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 Live chat and email support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map

Try managed Vault for 7 days

No card. Cancel from the dashboard.