At a glance
| Supported databases | PostgreSQL, MySQL, MariaDB, SQL Server, Oracle (Enterprise), MongoDB, Atlas, Redshift, Snowflake, Cassandra, Couchbase, Elasticsearch, SAP HANA, InfluxDB, Redis |
| Auditing and activity monitoring | Audit devices log every request; not a query monitor |
| Masking | Transform engine (Enterprise) for masking and tokenization |
| Encryption or tokenization | Transit engine in both editions; transform and KMIP in Enterprise |
| Privileged access | Short-lived database credentials and password rotation |
| Policy enforcement | ACL policies; Sentinel and control groups in Enterprise |
| Compliance reporting | Usage reporting in Vault 2.x; FIPS 140-2 builds in Enterprise (not on HCP) |
| Deployment | Self-managed (Community or Enterprise) or HCP Vault Dedicated on AWS or Azure |
| Licensing | BSL 1.1 Community (free); Enterprise by quote; HCP hourly plus per client |
Vault is a strong fit when applications should get temporary, per-service database logins instead of shared passwords in config files. The Community Edition covers dynamic credentials for the main databases at no licence cost, but note the BSL licence since 2023, that the Oracle plugin needs Enterprise, and that replication and namespaces are Enterprise features.
Overview
Vault is a secrets management and data protection system: it stores static secrets, issues dynamic credentials, manages certificates and offers encryption as a service, all behind an API with policies and audit logs. HashiCorp moved Vault from the MPL 2.0 to the Business Source License 1.1 starting with Vault 1.15 in 2023, and IBM completed its purchase of HashiCorp on 27 February 2025. IBM released Vault 2.0 on 14 April 2026 and announced Vault 2.2 as generally available on 27 October 2026.
For databases, the database secrets engine creates a new database user with a lease each time an application asks, then revokes it when the lease ends (dynamic roles). It can also rotate the password of an existing account on a schedule (static roles) and rotate the root credential Vault uses. Plugins cover PostgreSQL, MySQL and MariaDB, SQL Server, MongoDB, Redshift, Snowflake, Cassandra, Couchbase, Elasticsearch, SAP HANA, InfluxDB and Redis; the Oracle plugin is a separate download that requires a Vault Enterprise licence.
Key features
- Database secrets engine with dynamic roles, static role rotation and root credential rotation
- Leases, renewal and revocation for every issued credential
- Static secrets (key/value), PKI certificates and the transit engine for encryption as a service
- Auth methods for cloud providers, Kubernetes, SSO and MFA in both editions
- Audit logs and event notifications
- Enterprise only: namespaces, performance and disaster recovery replication, HSM auto-unseal, Sentinel, control groups, FIPS 140-2 and seal wrap, and the KMIP, key management and transform engines
- HCP Vault Dedicated: a single-tenant hosted Vault Enterprise on AWS or Azure
Integrations and ecosystem
Pros and cons
Pros
- Removes long-lived database passwords from application configuration
- Dynamic credentials for the common databases are in the free Community Edition
- Published hourly and per-client prices for the managed HCP edition
- Large ecosystem of auth methods and engines beyond databases
Cons
- BSL 1.1 since Vault 1.15 (2023): source-available, not an OSI open source licence
- Oracle dynamic credentials, replication and namespaces need Enterprise
- Running a highly available Vault cluster, unsealing and upgrades take real operational effort
- Branding is in transition between HashiCorp Vault and IBM Vault across IBM pages
Pricing
Vault Community Edition is free to self-host under the BSL 1.1, which allows production use, including internal use, except offering Vault as a competing hosted or embedded paid product. Vault Enterprise (self-managed) is priced by quote. IBM's pay-as-you-go table lists IBM Vault Dedicated (HCP) from USD 0.61644 per hour for an extra-small Development cluster, USD 1.57799 (Essentials) or 1.84299 (Standard) per hour for a small cluster, up to USD 7.48857 or 9.40599 per hour for a large cluster, plus USD 72.92 per client per month; IBM says these prices are indicative and vary by country.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Platform and DevOps teams that want applications and pipelines to fetch short-lived database credentials from a central, audited service.
Typical use cases
- Give each microservice its own PostgreSQL or MySQL login that expires after a set time
- Rotate the password of a shared SQL Server service account on a schedule
- Issue temporary Snowflake or Redshift credentials to CI pipelines
- Encrypt application fields with the transit engine without storing keys in the app
Who should look elsewhere
- Teams that need recorded, brokered human sessions to databases and servers: see CyberArk Privileged Access Manager or StrongDM.
Verdict
Vault is a well-documented way to give applications short-lived database credentials, and the Community Edition covers most databases at no licence cost. Weigh the BSL licence, the Enterprise-only features (Oracle plugin, replication, namespaces) and the work of running Vault yourself against HCP Vault Dedicated's published hourly pricing.
Frequently asked questions
Is HashiCorp Vault now called IBM Vault?
Both names are in use. IBM, which completed the HashiCorp purchase on 27 February 2025, uses IBM Vault in its Vault 2.0 announcement and IBM Vault Dedicated in its price list, but its October 2026 newsroom release says HashiCorp Vault 2.2. The documentation still calls the editions Vault Community Edition, Vault Enterprise and HCP Vault Dedicated.
Is Vault still open source?
No. Since Vault 1.15 (2023) the source is published under the Business Source License 1.1, which allows production and internal use but not offering Vault as a competing paid hosted or embedded product. Each release converts to MPL 2.0 four years after publication.
Which databases does the database secrets engine support?
PostgreSQL, MySQL and MariaDB, SQL Server, MongoDB and MongoDB Atlas, Redshift, Snowflake, Cassandra, Couchbase, Elasticsearch, SAP HANA, InfluxDB, Redis and ElastiCache Redis, plus Oracle with a Vault Enterprise licence. All except MongoDB Atlas support root credential rotation.
How much does HCP Vault Dedicated cost?
IBM's pay-as-you-go table shows hourly cluster prices from USD 0.61644 (Development, extra small) to USD 9.40599 (Standard, large), plus USD 72.92 per client per month, as indicative prices that vary by country.
Sources
- Vault available editions (HashiCorp developer docs)
- Database secrets engine (HashiCorp developer docs)
- Oracle database secrets plugin (HashiCorp developer docs)
- Vault LICENSE (BSL 1.1) on GitHub
- IBM HashiCorp pricing table
- IBM completes acquisition of HashiCorp (IBM newsroom, 27 February 2025)
- IBM Vault 2.0 announcement (HashiCorp blog)
- IBM newsroom: Vault 2.2 general availability (27 October 2026)
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.