How Doppler and Google Cloud KMS differ on scope, key custody, deployment and cost.
| Doppler | Google Cloud KMS | |
|---|---|---|
| Type | SaaS secrets | Cloud KMS |
| Scope | App secrets and config | Encryption keys |
| Deployment | SaaS | SaaS (GCP) |
| Key custody | AES-256 at rest; no customer HSM | HSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys |
| How it works | One place for environment variables across every environment, synced automatically into hosting platforms, CI and containers. Deliberately narrow: it is not trying to be a cryptographic service, which is why it takes an afternoon rather than a quarter to roll out. | Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy. |
| Pricing* | Free for 3 users; Team $21/user/mo | Metered per key version + operations |
| Free tier | Yes | No |
| Licence | CLI (Apache-2.0) | — |
| Best for | Small teams that want it working today | GCP workloads and hold-your-own-key rules |
Choose Doppler for small teams that want it working today. Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules.
* Published list pricing (vendor pricing pages, August 2026).