How Doppler and Azure Key Vault differ on scope, key custody, deployment and cost.
| Doppler | Azure Key Vault | |
|---|---|---|
| Type | SaaS secrets | Cloud KMS |
| Scope | App secrets and config | Keys, secrets, certificates |
| Deployment | SaaS | SaaS (Azure) |
| Key custody | AES-256 at rest; no customer HSM | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available |
| How it works | One place for environment variables across every environment, synced automatically into hosting platforms, CI and containers. Deliberately narrow: it is not trying to be a cryptographic service, which is why it takes an afternoon rather than a quarter to roll out. | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. |
| Pricing* | Free for 3 users; Team $21/user/mo | Metered per operation; Premium adds HSM |
| Free tier | Yes | No |
| Licence | CLI (Apache-2.0) | — |
| Best for | Small teams that want it working today | Microsoft-centric estates |
Choose Doppler for small teams that want it working today. Choose Azure Key Vault for microsoft-centric estates.
* Published list pricing (vendor pricing pages, August 2026).