Secrets Management for Small Teams: What to Ask Vendors

If your engineering team is 3 to 15 people, your secrets probably live in a .env file on one developer's laptop, a shared 1Password vault, or a private Slack channel. That works until it doesn't: someone leaves, you need to rotate a production database password, or a client sends a security questionnaire. The problem is not that you're careless—it's that most secrets management tools are built for 500-person platform teams and priced accordingly.

Start with your actual threat model

Before you talk to any vendor, write down what you're protecting against. For most Indian SMBs, the realistic threats are:

• A departing developer who still has production credentials in their local .env file.
• A leaked .env file in a public GitHub repo (even for a few hours).
• A contractor who needs read-only access to one API key for two weeks.
• A client or auditor asking for evidence that only your app—not humans—can read the production database password.

You probably don't need HSM-backed encryption, multi-region replication, or a dedicated secrets operations team. Knowing this helps you avoid overbuying.

The questions that separate good vendors from expensive ones

Ask every vendor these questions. The answers will tell you more than any feature matrix.

• How do you charge? Per user, per secret, per environment, per API call? If you have 4 environments (dev, staging, QA, prod) and 120 secrets, what's the monthly bill? Ask for a written quote with all add-ons.
• Can we self-host or is it SaaS-only? If SaaS, where is the data stored? Is there an India region? For Indian companies with clients in regulated sectors, data localization under the DPDP Act can be a real constraint.
• How does access control work? Can we give a contractor read-only access to one secret for seven days, then auto-revoke? Can we require approval for production secrets?
• What does the audit log capture? Can we export it as CSV or JSON to prove to a client that no human accessed the production DB password in the last 90 days?
• How do secrets reach our application? SDK, CLI, Kubernetes operator, or just environment variables? Does it work with Node, Django, Laravel, or whatever you use? If it requires rewriting your config loader, that's a cost.
• What's the migration path from .env files? Is there a bulk import? Can we run both systems in parallel for a week?
• What happens if we stop paying? Can we export everything in a standard format, or are we locked in?
• Do you invoice in INR with GST? Can we pay via UPI or NEFT? Do you have an Indian entity? This matters for TDS, procurement, and your finance lead's sanity.

A worked example: what a year of secrets management costs

Suppose you have 10 engineers and 120 secrets. You currently use a shared 1Password vault at $8/user/month—about $960 per year (roughly ₹80,000). It works for humans but not for CI/CD pipelines.

You evaluate three options:

• Vendor A: $20/user/month for 10 users = $2,400/year (₹2,00,000). Includes 5 environments and audit logs.
• Vendor B: $0.10 per secret per month for 120 secrets = $144/year (₹12,000). But it's self-hosted only, so you need a ₹6,000/month EC2 instance = ₹72,000/year. Total: ₹84,000/year.
• Vendor C: open-source HashiCorp Vault, self-hosted. Software is free, but your team spends 8-10 hours/month on upgrades, backups, and debugging. At ₹2,000/hour, that's ₹1,92,000-₹2,40,000/year in opportunity cost.

The cheapest sticker price is not the cheapest total cost. Also factor in the cost of a breach: if a leaked AWS key leads to a ₹5,00,000 bill from crypto miners, that changes the math entirely.

Red flags in a vendor demo

• They can't give you a clear price on the first call.
• "Just use our CLI" but there's no documentation for your language or framework.
• No audit log export.
• No automatic rotation for database passwords or API keys.
• They require a 12-month contract for a 5-person team.
• They don't know what the DPDP Act is, despite claiming to serve Indian clients.
• The free trial requires a credit card and a sales call before you can see the product.

Where to start

Pick one non-critical secret—say, a staging API key—and try two vendors for two weeks. Ask the questions above, and involve your finance or ops lead early because GST and TDS paperwork can delay onboarding by a week or two. A simple policy document ("all production secrets must be in the manager; rotate every 90 days; no secrets in Slack") is worth more than a fancy tool with no process. If you'd rather not spend a month on vendor calls, Maysan Labs helps small teams evaluate, migrate, and document secrets management without enterprise overhead.