Keyorix vs Phase
Keyorix
keyorix.com
Phase
phase.devSide by side
| Figure | Keyorix | Phase |
|---|---|---|
| Price from | — | $10/mo |
| Free plan | — | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 3 |
| Spec score · Secrets Management Tools | 7.7 (#20) | 8.1 (#11) |
| Access control | The repository lists role-based and group-based permissions, service tokens for CI/CD, and dynamic secrets with time-to-live. | Phase offers managed and custom RBAC roles, scoped per app and environment, plus IP allow-lists for users and service accounts. |
| Deployment | The project describes itself as on-premise, air-gap ready, and available as a single binary. | Phase can run as fully managed Cloud or self-hosted on your own infrastructure, including air-gapped environments. |
| Headquarters | Valencia, Spain | Dover, Delaware, United States |
| Integrations | The maker lists Go, Python, Node.js, and Java SDKs and an MCP server with read-only secret tools. | Listed integrations include AWS, Azure, HashiCorp Vault, Docker, Kubernetes, Cloudflare, GitHub, GitLab, Vercel and Railway. |
| Product | Keyorix describes itself as open-source secrets management for teams that cannot use SaaS. | Phase is an open source platform to securely access, manage and deploy application secrets from development to production. |
| Security | The maker says access actions use cryptographic proofs and zero-knowledge protocols, and that interactions can be verified without exposing sensitive data. | Phase says end-to-end encryption is enabled by default and its servers store only ciphertext in that mode. |
| Support | The terms say paid services such as support are governed by a separate written agreement. | Pricing lists community, email and Slack support, with dedicated live support and SLAs as an optional add-on. |
Plans
In their own words
Phase
Phase is an open-source platform for managing application secrets from development through production. It runs as a managed cloud service or on your infrastructure, including in air-gapped environments. Phase says end-to-end encryption is enabled by default, with servers storing ciphertext in that mode. Its CLI keeps secrets encrypted at rest locally and can inject them while offline; it also installs skills for Claude Code, Codex, Cursor, OpenCode, and VS Code Copilot to work with secrets using natural language. Teams can assign managed or custom roles by app and environment, set IP allow-lists, review records of access and changes, and use point-in-time rollback. Integrations include AWS, Azure, HashiCorp Vault, Docker, Kubernetes, Cloudflare, GitHub, GitLab, Vercel, and Railway. Phase lists SOC 2 Type 2 and penetration testing by Oneleet. The Free plan is limited to 5 users or service accounts, 3 apps, and 3 environments. Pro costs $10 per month, billed annually at $120 ($144 shown), with a 14-day trial.