Doppler alternative
Doppler, next to Penv Cloud.
Doppler bills per user and sells roles, groups and syncs as $9 add-ons. We bill per human seat with nothing bolted on, and machines are free on every plan.
The arithmetic
One team. 5 engineers who sign in, 47 machines that never will.
Same estate, two billing models, two monthly bills. The gap is not a discount, it is a definition.
Doppler's figure is its public list price as of August 2026, at the plan named under it. Ours comes from the same price book checkout charges from.
- Penv Cloud
- $90
- Doppler
- $105
5 seats
5 users, Team
Side by side
Penv Cloud and Doppler, every row.
Verified against the vendor's own pricing page and docs, and against our own source. Where a claim could not be checked, it is not here.
| As of August 2026 | Penv Cloud | Doppler |
|---|---|---|
| Billing unit | Per human seat | Per user seat |
| Machines on the invoice | Free and unlimited | Service tokens capped by tier |
| Headline price / mo | $18 annual · $22 monthly | $21 per user (Team)² |
| Per-seat add-ons | None | Custom roles, groups, syncs: +$9 each³ |
| Keyless CI auth (OIDC) | Every plan, including Free | Team and Enterprise, since March 2025⁵ |
| Audit retention, free tier | 7 days, insert-only | 3 days⁶ |
| Encryption at rest | Envelope + AWS KMS, every plan | Tokenized, AES-256-GCM, GCP KMS |
| Ciphertext bound to its address | AAD over the full address⁷ | Not documented |
| Customer-held keys | Your AWS, GCP, Azure or Vault key on Enterprise⁸ | Enterprise Key Management |
| Self-hosting | Cloud only | Cloud only |
| Compliance certifications | No SOC 2 report yet | SOC 2 Type II, ISO 27001 |
| Trust model | Server-side envelope⁹ | Server-side |
- 1.Infisical's own definition, from their pricing page: "An identity is any human or machine that authenticates to Infisical." Billing is per identity object rather than per pipeline run.
- 2.Competitor list prices as of August 2026, monthly equivalents. Infisical's $20 is the annual rate; monthly is $23. We compare published prices rather than negotiated deals.
- 3.Doppler's Team plan sells custom roles, user groups, and integration syncs as separate $9/seat/month add-ons. They are standard on Enterprise.
- 4.Infisical places dynamic secrets on its Advanced tier at $40 per identity per month. Ours are on every plan, with one integration connection on Free.
- 5.Doppler does offer keyless OIDC auth, as Service Account Identities added in March 2025, on Team and Enterprise. The difference we are naming is which plan you need, not whether the capability exists.
- 6.Doppler: 3 days free, 90 days on Team. Infisical: 30 days included from Pro. Check each vendor's current pricing page before relying on a number.
- 7.The additional authenticated data is the full parameter address, so a ciphertext moved to another environment or organization fails to decrypt. Neither competitor documents an equivalent, which is not the same as neither having one.
- 8.All three wrap a data key with a key you control, and in all three the sealed data still lives on the vendor's infrastructure — none of this is zero-knowledge. We support AWS KMS, GCP Cloud KMS, Azure Key Vault and HashiCorp Vault Transit — the Vault must be reachable from the internet, as we cannot dial into a private network. Doppler supports AWS and GCP; Infisical adds HSM and KMIP.
- 9.Our server can decrypt your values to serve them to your machines. Infisical disabled end-to-end encryption by default and now holds keys server-side, as we do. None of the three of us is zero-knowledge. Read the security page →
Credit where it is due
Where Doppler beats us.
- SOC 2 Type II, ISO 27001, with a public trust center. Ours is in progress.
- A wider integration catalog, a mature Kubernetes operator, and a Terraform provider. We ship no operator. Kubernetes reads from us through External Secrets Operator instead.
Fit
Whether this is for you.
Choose us when
- Your machines outnumber your engineers and the invoice keeps noticing.
- You want CI to authenticate by OIDC without paying for the privilege.
- You already run penv and want the hosted provider rather than a new mental model.
- You are leaving one of these two. We import from both, one way, and say what a migration loses.
- You want a vendor that publishes what it has not built.
Choose Doppler when
- Your Vault or key service is only reachable on a private network. We cannot dial into one.
- You need to self-host, or you need data residency in a named region.
- Your procurement gate is a completed SOC 2 report rather than one in progress.
How we source this
Every Doppler figure comes from its own public pricing page or docs, checked in August 2026 and footnoted above. Pricing changes, so verify before you decide. The three-way comparison puts both vendors beside us, and the security page names what our server can do with your values and what we have not built.