Skip to content
inetGeek

AWS Secrets Manager vs Doppler

SEPT 2026 audit

A comparison of AWS Secrets Manager and Doppler built from values read directly from each provider's own documentation, with the source recorded against every figure.

Reviewed by Palash BagchiUpdated 22 criteria comparedSources last checked

The short answer

Choose AWS Secrets Manager if…

Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.

Editorial · Palash Bagchi · approved

Choose Doppler if…

Teams whose secrets access is dominated by CI/CD and service identities rather than human users — those ride free, so cost tracks headcount, not automation volume.

Editorial · Palash Bagchi · approved

Consider something else if…

  • AWS Secrets Manager: Secrets sprawl across many small values rather than a few large ones — at $0.40/secret/month, a service charging per identity or per seat instead can work out cheaper for a team with a handful of engineers and hundreds of individual secrets.
  • Doppler: Dynamic (short-lived) secrets are a requirement now — that's an Enterprise-only feature here, where a competitor may offer it lower in the plan tier.

Neither quite fits? Every other option, ranked by iScore: AWS Secrets Manager alternatives · Doppler alternatives

15 sourced criteria separate them — see where, with sources, below.

Visit AWS Secrets Manager documentationVisit Doppler documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

01.

At a glance.

CriterionAWS Secrets ManagerDoppler
Pricing
Free tier
No
Yes
Kind of free offerIntroductory free tierFree tier
What the free plan includesUp to $200 of AWS Free Tier credits for new customers, and a free plan chosen at sign-up that lasts 6 months. Neither is a standing Secrets Manager allowance.Doppler's pricing page names a free entry point and states that AI agents and non-human identities are not charged; it publishes no per-resource free limits.
Entry paid plan$0.40 per secret per month, plus $0.05 per 10,000 API calls.Team plan: $21/month per user, with a 14-day free trial.
Pricing modelPer-secret monthly fee plus metered API calls. Rotating a secret creates a new version but is not separately charged beyond the API calls it makes.Per-seat pricing for human team members. AI agents and non-human identities are not billed.
Infrastructure
Regions34 commercial AWS Regions plus 2 AWS GovCloud (US) Regions listed in the Secrets Manager service endpoints table.All Doppler Cloud servers run in private VPCs in Google Cloud's us-central1 region, with distinct primary and failover compute infrastructure.
Uptime SLA
99.99% monthly uptime, one figure with no configuration split.
99.95%, published as an SLO on Enterprise. The Developer and Team plans publish none.
Auth
Audit logsAWS CloudTrail records every Secrets Manager API call as an event; the last 90 days are viewable in the CloudTrail console, longer retention by creating a trail that delivers to S3.3 days of activity log retention on Developer (free), 90 days on Team, custom retention on Enterprise.
Secrets
Secret versioningSupported — rotating a secret automatically creates a new version, at no additional per-secret charge.Every version of a secret is retained for the lifetime of that secret; adding, updating and deleting secrets can be rolled back from the activity log.
Compliance
SOC 2Listed as SOC-compliant on AWS's own compliance scope page.SOC 2 certified.
ISO 27001Certified for ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO 9001; Secrets Manager is named in AWS's per-service compliance list.ISO 27001 certified.
GDPR / data residency
Customers choose the geographic Region their data is stored in; AWS states all AWS services can process personal data in compliance with the GDPR. AWS-wide GDPR statement, not a Secrets Manager-specific page.
Doppler's DPA incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in full for EEA and UK data transfers. Contractual transfer mechanism; DPA last updated July 07, 2026.
Encryption at restEnvelope encryption: each secret value is encrypted with a unique 256-bit AES data key, itself encrypted under an AWS KMS key.Secrets encrypted and tokenized with AES-256-GCM.
Customer-managed keysAny symmetric-encryption customer managed KMS key in the same account and Region can encrypt a secret, instead of the aws/secretsmanager AWS managed key. Asymmetric KMS keys are not supported; keys are chosen per secret.Supported on existing AWS or GCP infrastructure — data encrypted with an additional key the customer controls.
Role-based access controlIAM identity-based and resource-based policies define who can take which actions on which secrets; attribute-based access control (ABAC) is also supported.Role based access requires the Team or Enterprise plan; workplace permissions are assigned per user in three tiers: Collaborator, Admin and Owner.

Only criteria both providers publish appear here; a tinted cell marks a real difference. Criteria only one of them documents are listed below, and an absence there means we found no source — not that the feature is missing. How we source this.

The small bar above a value is inetGeek's own lean toward that side — computed from the same facts shown, never a number the provider published. See the picker below "The short answer" to weigh only the criteria you care about.

02.

Where they differ.

Free tier

AWS Secrets Manager
No
Doppler
Yes
Sources (2) →

Kind of free offer

AWS Secrets Manager
Introductory free tier
Doppler
Free tier
Sources (2) →

What the free plan includes

AWS Secrets Manager
Up to $200 of AWS Free Tier credits for new customers, and a free plan chosen at sign-up that lasts 6 months. Neither is a standing Secrets Manager allowance.
Doppler
Doppler's pricing page names a free entry point and states that AI agents and non-human identities are not charged; it publishes no per-resource free limits.
Sources (2) →

Entry paid plan

AWS Secrets Manager
$0.40 per secret per month, plus $0.05 per 10,000 API calls.
Doppler
Team plan: $21/month per user, with a 14-day free trial.
Sources (2) →

Pricing model

AWS Secrets Manager
Per-secret monthly fee plus metered API calls. Rotating a secret creates a new version but is not separately charged beyond the API calls it makes.
Doppler
Per-seat pricing for human team members. AI agents and non-human identities are not billed.
Sources (2) →

Regions

AWS Secrets Manager
34 commercial AWS Regions plus 2 AWS GovCloud (US) Regions listed in the Secrets Manager service endpoints table.
Doppler
All Doppler Cloud servers run in private VPCs in Google Cloud's us-central1 region, with distinct primary and failover compute infrastructure.
Sources (2) →

Uptime SLA

AWS Secrets Manager
99.99% monthly uptime, one figure with no configuration split.
Doppler
99.95%, published as an SLO on Enterprise. The Developer and Team plans publish none.
Sources (2) →

Audit logs

AWS Secrets Manager
AWS CloudTrail records every Secrets Manager API call as an event; the last 90 days are viewable in the CloudTrail console, longer retention by creating a trail that delivers to S3.
Doppler
3 days of activity log retention on Developer (free), 90 days on Team, custom retention on Enterprise.
Sources (2) →

Secret versioning

AWS Secrets Manager
Supported — rotating a secret automatically creates a new version, at no additional per-secret charge.
Doppler
Every version of a secret is retained for the lifetime of that secret; adding, updating and deleting secrets can be rolled back from the activity log.
Sources (2) →

SOC 2

AWS Secrets Manager
Listed as SOC-compliant on AWS's own compliance scope page.
Doppler
SOC 2 certified.
Sources (2) →
  • AWS Services in Scope — SOC ↗

    “This webpage provides a list of AWS Services in Scope of AWS assurance programs. [...] AWS Secrets Manager ✓ AWS Security Hub CSPM ✓ AWS Serverless Application Repository ✓ AWS”

    Read 2026-09-13 · official site · Report a correction

  • Doppler Security ↗

    “Doppler is SOC 2 certified, ensuring your API keys, credentials, and secrets are stored with industry-leading security standards.”

    Read 2026-09-11 · official site · Report a correction

ISO 27001

AWS Secrets Manager
Certified for ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO 9001; Secrets Manager is named in AWS's per-service compliance list.
Doppler
ISO 27001 certified.
Sources (2) →

GDPR / data residency

AWS Secrets Manager
Customers choose the geographic Region their data is stored in; AWS states all AWS services can process personal data in compliance with the GDPR. AWS-wide GDPR statement, not a Secrets Manager-specific page.
Doppler
Doppler's DPA incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in full for EEA and UK data transfers. Contractual transfer mechanism; DPA last updated July 07, 2026.
Sources (2) →
  • GDPR - Amazon Web Services (AWS) ↗

    “AWS customers can use all AWS services to process personal data (as defined in the GDPR) that is uploaded to the AWS services under their AWS accounts (customer data) in compliance with the GDPR [...] Determine where their customer data will be stored, including the type of storage and geographic region of that storage.”

    Read 2026-09-13 · official site · Report a correction

  • Doppler Data Processing Addendum ↗

    “Doppler agrees to abide by and process such data in compliance with the EU SCCs and UK International Data Transfer Addendum, as applicable, which are incorporated herein in full and form an integral part of this Addendum. [...] Last Updated: July 07, 2026”

    Read 2026-09-13 · official site · Report a correction

Encryption at rest

AWS Secrets Manager
Envelope encryption: each secret value is encrypted with a unique 256-bit AES data key, itself encrypted under an AWS KMS key.
Doppler
Secrets encrypted and tokenized with AES-256-GCM.
Sources (2) →

Customer-managed keys

AWS Secrets Manager
Any symmetric-encryption customer managed KMS key in the same account and Region can encrypt a secret, instead of the aws/secretsmanager AWS managed key. Asymmetric KMS keys are not supported; keys are chosen per secret.
Doppler
Supported on existing AWS or GCP infrastructure — data encrypted with an additional key the customer controls.
Sources (2) →

Role-based access control

AWS Secrets Manager
IAM identity-based and resource-based policies define who can take which actions on which secrets; attribute-based access control (ABAC) is also supported.
Doppler
Role based access requires the Team or Enterprise plan; workplace permissions are assigned per user in three tiers: Collaborator, Admin and Owner.
Sources (2) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

03.

Documented by only one.

These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing — except where we say we read the other provider's own page on a given date and it does not state it. Those rows lean, and the provider can correct them with a link.

When the free offer endsAWS Secrets Manager: 6 months after account creation; Free Tier credits expire 12 months after that date.
Dynamic (short-lived) secretsDoppler: Not included on Developer or Team. Available on Enterprise.
Support on entry paid planDoppler: Priority support on Team; enterprise support options on Enterprise. The free Developer plan names no support level.
HIPAAAWS Secrets Manager: Listed as a HIPAA-eligible service on AWS's own reference page.
PCI DSSAWS Secrets Manager: Attestation of Compliance for PCI DSS version 3.2 at Service Provider Level 1; can be used for cardholder-data workloads.
Private networking / VPCAWS Secrets Manager: Interface VPC endpoints powered by AWS PrivateLink reach the Secrets Manager API with no internet gateway; traffic does not leave the AWS network.
Dedicated infrastructureDoppler: Doppler On-prem runs entirely within customer-managed infrastructure, designed for enterprises where external SaaS platforms are restricted or prohibited.
04.

Questions this comparison answers.

Entry paid plan: AWS Secrets Manager or Doppler?

AWS Secrets Manager: $0.40 per secret per month, plus $0.05 per 10,000 API calls.

Doppler: Team plan: $21/month per user, with a 14-day free trial.

Free tier: AWS Secrets Manager or Doppler?

AWS Secrets Manager: No

Doppler: Yes

Should I choose AWS Secrets Manager or Doppler?

Pick AWS Secrets Manager if Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.

Pick Doppler if Teams whose secrets access is dominated by CI/CD and service identities rather than human users — those ride free, so cost tracks headcount, not automation volume.

Provider pages

AWS Secrets ManagerAWS-native secrets store billed per secret per month plus per API call, integrated with IAM, Lambda and RDS.DopplerSecrets manager billed per human seat, with AI agents and machine identities free on every plan.

Related comparisons

AWS Secrets Manager vs InfisicalDoppler vs Infisical

Comments

Every page here is sourced and dated.