A Doppler alternative.
Doppler bills per user. We bill per human seat with no add-ons, and machines are free on every plan.
5 engineers, 47 machines.
One team's monthly bill under both billing models- Penv Cloud
- $90
- 5 seats on Pro, annual. 47 machines, none billed.
- Doppler
- $105
- 5 users on Team.
Public list prices, checked 24 September 2026.
Row by row | Penv Cloud | Doppler |
|---|---|---|
| Billing unit | Per human seat | Per user |
| Machine identities | Unlimited on every plan, none billed | Not billed. None on Developer, capped on Team2 |
| List price per month | $18 annual, $22 monthly | $21 per user, Team3 |
| Free plan | 3 seats, unlimited machine identities | 3 users, then $8 each. No service accounts |
| Add-ons and tier gates | None. Custom roles on Pro | Roles, groups, syncs: +$9 per seat each4 |
| OIDC sign-in for CI | Every plan, Free included | Team and Enterprise6 |
| Audit log on the free plan | 14 days, insert-only | 3 days7 |
| Ciphertext bound to its address | Yes, the full address is the AAD8 | Not documented |
| Encryption at rest | AES-256-GCM envelope under AWS KMS, every plan | AES-256-GCM, per-workplace key under GCP KMS |
| Your own wrapping key | AWS, GCP, Azure or Vault, Enterprise9 | AWS or GCP, Enterprise |
| Who holds the keys | Server-side10 | Server-side |
| Self-hosting | Cloud only | On-prem on Enterprise |
| Certifications | No SOC 2 report yet; Enterprise gets our security questionnaire and a DPA. | SOC 2, ISO 27001 |
10 Our server decrypts values to deliver them to your machines, and so does Doppler's. Neither is zero-knowledge. Footnotes 1 to 9 cite each vendor's pricing page and docs.
- 1Infisical's pricing page: "An identity is any human or machine that authenticates to Infisical."
- 2Doppler's pricing FAQ says machine identities are free. Its platform limits allow no service accounts on Developer and 250 on Team.
- 3Public list prices as of September 2026. Infisical's $20 is the annual rate; monthly is $23. A negotiated deal may differ.
- 4Doppler's Team plan sells custom roles, user groups and integration syncs as separate $9 per seat per month add-ons. They are standard on Enterprise.
- 5Infisical's Advanced tier is $40 per identity per month, annual. Our dynamic secrets are on every plan, with 3 engines on Free.
- 6Doppler added keyless OIDC, as Service Account Identities, in March 2025.
- 7Doppler: 3 days on Developer, 90 days on Team. Infisical: none on Free, 30 days on Pro, 90 days on Advanced.
- 8The additional authenticated data is the full parameter address, so a ciphertext moved to another environment or organization fails to decrypt. Neither competitor documents an equivalent.
- 9The Vault must be reachable from the internet; we cannot connect to a private network. Doppler encrypts a second time with the customer key. Infisical adds KMIP as an Enterprise add-on.
Choose Penv Cloud when
- You run more machines than engineers.
- You want OIDC sign-in for CI on the free plan.
- You want custom roles without an add-on or a higher tier.
- You use the penv CLI.
- You are moving from Doppler or Infisical. We import from both and report what the import drops.
Where Doppler is stronger
- Your Vault or key service is reachable only on a private network. We cannot connect to it.
- You need to self-host, or data residency in a named region.
- Your procurement gate is a completed SOC 2 report. We have none yet; Enterprise gets our security questionnaire and a DPA.
- Doppler: a Kubernetes operator and a Terraform provider. Kubernetes reads from us through External Secrets Operator.
Start on Free.
3 seats, unlimited machines and OIDC for CI, with no card.