Bitting and Infisical, on what an auditor asks about one live key.
Infisical's side comes from its own pages and docs, read in October 2026. Its agent proxy, Agent Vault, is in preview with no published price.
Criterion | Bitting Book a call | Infisical | A scanner on its own |
|---|---|---|---|
After a leak is found | Holders named, rotation prepared | Scanning on Enterprise only; an email to admins | Confirms the key works, stops |
Rotation, with approval | Every plan, signed by your approvers | Pro: public databases only; full rotation from Advanced; access approvals Enterprise-only | None |
Audit logs | The period you set, in Stockholm | 30 or 90 days under Enterprise; 17 subprocessors, all in the US | Wherever you run it |
Its own model | A holder model it fine-tunes | Close to absent; its AI insights page returns 404 | Some score findings; none rotates |
Hosting it yourself | No: Stockholm only | An MIT core you can host | Open source, runs where you put it |
Criterion | Bitting Book a call | Infisical | A scanner on its own |
If you need a secrets manager you can host yourself, Infisical is the stronger product.
An auditor will ask for a SOC 2 report, and Bitting cannot show one yet.
Self-hosting
an MIT core, or its cloud in the US or EU
A full secrets manager
CLI, SDKs in 9 languages, Kubernetes operator, Terraform, 40+ syncs
Certificates and PAM
private CAs, recorded database and server sessions
Self-serve prices
published tiers, 5 free identities, 30-day trial, no card
Assurance
SOC 2 Type II; FIPS 140-3 modules in Enterprise FIPS mode
A finder's last word on the processor key is an email to admins.
The email leaves the admin alone with the rest: find which services hold the key, judge what breaks, book a maintenance window.
Infisical's scanning emails organization admins when it finds a secret, and its scanning docs describe no revocation or rotation.
Here the model does that part: the four holders, what stops for each, and a replacement in order, waiting for the platform lead's signature.
