Envshed vs SikkerKey

Envshed is a cloud secrets manager for small engineering teams, with a CLI that works across monorepos. It manages secrets and environments, supports per-user overrides, warns about expirations, allows project duplication and keeps an audit trail. For pnpm or npm workspaces, the CLI can detect workspaces and retrieve secrets from the repository root. Listed integrations include GitHub Actions, Docker, a Node.js SDK, a CLI for any shell and Coolify; a REST API supports languages including Python, Go and Rust. Secret values are encrypted at rest with AES-256-GCM, traffic uses TLS 1.3, and encryption keys are held separately from encrypted data. Envshed offers role-based access control and an immutable audit trail, including records of secret reads and changes. The maker says it is not a zero-knowledge vault: a small on-call group with production credentials could technically decrypt a secret value. Data is stored in one region on US-based cloud infrastructure. Self-hosting is unavailable, and the service is not yet SOC 2 or ISO 27001 certified. The Developer plan is free forever for up to two members and three projects; Team is $5/user/month and Business is $9/user/month.

SikkerKey is a secrets manager and vault for application and infrastructure credentials. It supports standard, structured, managed, leased, certificate, canary, and TTL secrets, as well as secret rotation and dynamic secrets. Machines authenticate by signing each request with an Ed25519 private key that stays on the host. Teams can connect it to CI/CD, containers, app platforms, serverless functions, servers, and on-premise systems through its CLI, SDKs, or signed HTTP. Official SDKs are available for Go, Python, Node.js,.NET, Kotlin, and PHP. Its CLI supports Linux x64 and ARM64, macOS Intel and Apple Silicon, and Windows x64. The service describes a three-layer encryption design; its MCP server gives AI agents a separate identity class that cannot retrieve plaintext secret values. SikkerKey says its vault, secrets, and audit trail stay in the EU and are operated from Denmark. The free Developer plan is free and includes 10 machines; paid plans start at $29/mo. Every plan includes direct in-dashboard support and unlimited secret, project, read-volume, and rotation counts.