Password Management
Secret Server
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Delinea · www.delinea.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Secret Server at a glance
- Vendor
- Delinea
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates Secret Server 2/5, the mean of 6 judges. Delinea Secret Server is a password-management vault strongest on audit and policy, where scores cluster at 6-7, and sharing and access control at 5-6. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Delinea Secret Server is a password-management vault strongest on audit and policy, where scores cluster at 6-7, and sharing and access control at 5-6. Audit evidence is deep: an immutable audit log, a user audit report recording every action including sharing, dozens of out-of-the-box SQL-based reports schedulable to auditors. Sharing runs through per-collection permissions with rights such as Grant and Edit and Dual Control requiring approver credentials before a report or recording is viewed; SAML single sign-on with Okta, single logout, a SCIM provisioning connector and a PGP-encrypted escrow export for disaster recovery are documented. Security architecture scores sit at 2 — beyond an optional FIPS 140-2 compliant algorithm and a security-advisories page we found no public whitepaper or independent audit — and sovereignty at 1: the contracting entity is Delinea Inc. of San Francisco under Federal Trade Commission jurisdiction, with hosting locations and subprocessors unstated on the captured pages. We found no public information on how the vault is decrypted after single sign-on; pricing is a free 30-day trial plus a quote request. Judges differed by at most one point on any criterion.
Speaks for it
- An immutable audit log, per-user and per-secret audit reports recording actions including sharing, and behavioral analytics with threat scores and alerts are documented.
- Dual Control requires an approver's credentials before a sensitive report or recording can be viewed.
- Collection permissions grant rights such as Grant and Edit to users or roles through a documented API.
- SAML single sign-on with Okta is documented to the assertion-consumer and single-logout endpoints, with an Okta SCIM connector for provisioning.
- A scheduled escrow export delivers vaulted passwords as PGP-encrypted email requiring your own OpenPGP key, framed for disaster recovery.
Held against it
- Security architecture scores sit at 2; the only public cryptography is an optional FIPS 140-2 compliant algorithm plus a security-advisories page.
- We found no public information on a security whitepaper, key derivation, or an independent audit with a named auditor and date.
- We found no public information on how the vault is decrypted after single sign-on, and MFA appears only as a short-code program.
- The contracting entity is Delinea Inc. at a San Francisco address under Federal Trade Commission jurisdiction, with hosting locations and a subprocessor list unstated on the captured pages.
- Okta provisioning matches users by entering the corresponding Secret Server user name manually.
Best for
- You need audit-ready privileged-access records — an immutable log, SQL-based reports schedulable to auditors, and behavioral analytics scored highest here.
- Your team runs Okta and wants SAML single sign-on and SCIM provisioning documented step by step.
- You need granular vault governance, with collection-level permissions, delegable Grant rights, and dual-control approvals before sensitive reports or recordings are viewed.
- You want a documented disaster-recovery exit path — the scheduled, PGP-encrypted escrow export — and an on-premises edition is referenced.
Avoid if
- Your procurement requires a published encryption model or an independent audit with a named auditor; the captured pages show only an optional FIPS 140-2 compliant algorithm and a security-advisories page.
- You require a European contracting entity or published hosting and subprocessor locations; the named entity is Delinea Inc. of San Francisco, and these are unstated on the captured pages.
- Your identity provider is not Okta — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 1 of 5 |
| Sharing, roles & recovery | 3 of 5 |
| SSO, directory sync & provisioning | 2 of 5 |
| Audit logs, policies & reporting | 3.5 of 5 |
| Hosting choice, offline access & export | 2 of 5 |
| European sovereignty | 0.5 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Security described in adjectives ("bank-grade", "military encryption") with no architecture, no audit and no statement of what the vendor can read.
3 — Encryption algorithms named and "zero knowledge" claimed, but no whitepaper, no statement of which fields stay unencrypted, and audits mentioned without dates, auditors or results.
5 — A published security whitepaper naming algorithms, key derivation and the client-side encryption model, a stated list of what is and is not encrypted (including URLs and metadata), and a named independent audit or certification (ISO 27001, SOC 2) with its date.
8 — Recurring independent penetration tests or code audits with reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
The only architecture facts I can point to are an optional FIPS 140-2 compliant algorithm mode and a security advisories page committing to transparency on vulnerabilities and patches; I found no public security whitepaper, no independent audit or penetration test with a named firm and date, and no public information on a bug bounty or past incidents. The pages also never state which fields the vendor can read versus which are encrypted client-side, which is the first question my board will ask. 3 8
The Identity Engineer
The only cryptographic statement I can find is that Secret Server can enable a FIPS 140-2 compliant algorithm, alongside a security advisories page that publishes vulnerability and patch notices. There is no whitepaper naming key derivation or the client-side encryption model, and we found no public information on independent audits, a bug bounty, incident history, or what the vendor itself can read. 3 8
The Compliance Auditor
The captured pages let Delinea enable a FIPS 140-2 compliant algorithm and run a security advisories page for vulnerability and patch updates, but we found no public information on a security whitepaper, key derivation, which fields remain unencrypted, or any independent audit with a named auditor and date. For an ISO 27001 file I have named standards but no architecture and no statement of what the vendor itself can read. 3 8
The SME Owner
The only concrete specifics are that Secret Server can be told to use a FIPS 140-2 compliant algorithm and a page that promises timely vulnerability advisories; there is no whitepaper, no named cipher or key derivation, and we found no public information on independent audits, certifications, or what Delinea itself can read. Moving my team off Excel on adjectives and one standard reference is not a sale. 3 8
The DevOps Engineer
The only concrete cryptography on the captured pages is an optional FIPS 140-2 compliant algorithm, plus a security-advisories page that posts vulnerability and patch updates. I found no public information on a whitepaper, key derivation, which fields stay unencrypted, or any independent audit or penetration test with auditor, date or result — a standard citation is not an architecture I can review. 8 3
The Skeptic
The captured pages name a FIPS 140-2 compliant mode and maintain a security advisories page for vulnerability and patch updates, which is more than adjectives. But we found no public information on a security whitepaper, key derivation, which fields stay readable to the vendor, any independent audit with a date and auditor, a bug bounty, or disclosed incidents — and for a vault, that silence decides it. 3 8
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — Personal vaults only, or sharing by sending a password to another user with no permissions and no record.
3 — Shared folders with all-or-nothing access, no roles, and no stated process for recovering an account or reclaiming credentials from a departing employee.
5 — Shared vaults or collections with read, edit and manage permissions, groups and admin roles, an admin recovery mechanism documented with its key model, and offboarding that transfers a leaver's shared items.
8 — Granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Collection permissions are real and structured — the API grants rights such as Grant and Edit to users and roles, gated on system-administrator or per-collection Grant permission — and dual control requires an approver's credentials before a report or recording can be viewed, with policy-as-code role enforcement on top. What I cannot find is the recovery story beyond a PGP-encrypted escrow export, and I found no public information on offboarding a leaver, emergency access, or time-limited sharing. 4 5 8 10
The Identity Engineer
Collection permissions are set per user or role with rights such as Grant and Edit, a policy playbook forbids access unless the user sits in an approved role, and dual control requires approver credentials before a report or recording can be viewed. We found no public information on admin account recovery and its key model, emergency access, time-limited sharing, or what happens to a leaver's shared items. 4 5 8
The Compliance Auditor
Permissions are set per collection through a documented API with rights granted to users or roles, grant authority itself is delegable to collection administrators, policy-as-code restricts access to approved roles, and dual control demands an approver's credentials before a sensitive report or recording can be viewed. We found no public information on time-limited or one-time sharing, emergency access, a documented account-recovery key model, or how a leaver's shared items are transferred. 4 5 8
The SME Owner
Collections with permissions for users and roles (rights such as Grant and Edit), a dual-control feature where an approver must enter credentials before a sensitive report or recording can be viewed, and role-based forbid rules in the platform playbooks are all genuinely documented. What I could not find anything on is the way back in when someone forgets the master password, emergency access, or what happens to shared items when an employee leaves — the three problems I actually need solved. 4 5 8
The DevOps Engineer
Collection permissions are role-based with distinct rights per user or role, assignable through the API, and Dual Control requires an approver's credentials before a sensitive report or recording can be viewed — real governance, not all-or-nothing folders. I found no public information on admin account recovery, emergency access, time-limited or one-time sharing, or what happens to a leaver's shared items. 4 8 5
The Skeptic
Collection permissions are granted per user or role with distinct rights, restricted to those holding Grant permission on the collection, and Dual Control can require an approver's credentials before a recording is viewed — real granular, role-based sharing with an approval workflow. We found no public information on admin account recovery and its key model, emergency access, or what happens to shared credentials when an employee leaves. 4 8 5
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — Each user creates an account by email; no SSO, no directory sync and no MFA beyond an app code.
3 — SSO available only to sign in to the admin console or on the top tier with no description of how the vault is then decrypted, and users provisioned by CSV invite.
5 — SSO with named identity providers (Entra ID, Okta, Google) documented with how the vault key is derived or released, SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — SSO unlock designed so the vendor cannot derive the vault key and stated so, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
SAML single sign-on with Okta is documented down to the assertion-consumer endpoint and single logout, and a SCIM connector provisions Okta users, so directory sync genuinely exists. But the pages never say how the vault is decrypted after a SAML assertion — whether the vendor can derive the key — and I found no public information on Entra ID or Google providers, hardware-key MFA, or passkeys. 6 7
The Identity Engineer
SAML single sign-on with Okta is documented end to end, including metadata import, single logout and certificate handling, and an Okta SCIM Connector integration exists — but the documented provisioning path matches Okta users to Secret Server user names manually. We found no public information on how the vault is decrypted after single sign-on, on Entra ID integration, on automated suspension when a leaver is deprovisioned, or on FIDO2 keys and passkeys for the vault. 6 7
The Compliance Auditor
SAML single sign-on with Okta and an Okta SCIM connector for provisioning are documented step by step, and the privacy policy references an MFA short-code program. We found no public information on how the vault is decrypted after a single sign-on, on FIDO2 or hardware-key MFA, on identity providers beyond Okta, or on passkey support, so the trust shortcut question stays open. 2 6 7
The SME Owner
SAML single sign-on with Okta is documented step by step including single logout, and a SCIM Connector application handles Okta provisioning, though matching users is done by typing the Secret Server user name manually. There is no description of how the vault is decrypted after an SSO sign-in, MFA appears only as a passing mention of a short-code program, and we found no public information on hardware keys, Entra ID or Google as providers, or passkeys. 2 6 7
The DevOps Engineer
SAML single sign-on with Okta is documented down to endpoints, metadata import and single logout, and a SCIM connector application handles provisioning — a named provider with a documented path. Nothing describes how the vault is decrypted after SSO, and I found no public information on MFA with hardware keys, Entra ID or Google as providers, passkeys, or what deprovisioning revokes. 7 6
The Skeptic
SAML single sign-on with Okta is documented down to metadata import and single-logout endpoints, and an Okta SCIM connector handles provisioning. We found no public information on how the vault key is derived or released under SSO, on MFA beyond a short-code program for texted codes, or on hardware keys and passkeys. 7 6 2
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No audit log and no admin policies; the administrator sees a user list.
3 — A basic activity list and a password-strength score, but no exportable log, no enforceable policies, and no record of who viewed or copied a shared credential.
5 — Event logs covering logins, item access, sharing and admin changes, exportable or available through an API, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Native SIEM integration with named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
This is the strongest area: an immutable audit log of privileged activity, per-user and per-item audit reports recording every access and change, dozens of out-of-the-box SQL-based reports plus a reports API, scheduled reports emailed to auditors, and behavioral analytics with threat scores and alerts. It stays below the top band because no SIEM destination is named, log retention is not stated, and I found no public information on enforceable master-password or MFA policies or breach-monitoring reports. 1 8 9
The Identity Engineer
Secret Server maintains an immutable audit log, per-user and per-secret audit reports record every access and action including sharing, event subscriptions alert on role and group assignment changes and administrative toggles, and dozens of out-of-the-box plus custom SQL-based reports can be scheduled to auditors through a documented API. We found no public information on SIEM integration targets, log retention, or enforceable master-password and MFA policies. 8 9
The Compliance Auditor
This is the strongest area: an immutable audit log of privileged activity, a user audit report that shows every secret a person accessed in a date range and records actions including sharing and updating, event subscriptions alerting on secret views, role changes and configuration changes, behavioural analytics with threat scores and alerts, and SQL-based custom reports manageable through an API and schedulable to auditors by email. We found no public information on export to a named SIEM target, stated log retention, or enforceable master-password and MFA policies, which is what an auditor will ask for next. 8 9
The SME Owner
This is the deepest part of the product: an immutable audit log of privileged activity, a User Audit Report recording every action a user takes on a password including sharing, dozens of out-of-the-box reports that are SQL-based, a reports API with create, copy and email, and behavioral analytics with threat scores and alerts. Missing for a real audit are enforceable master-password and MFA policies, named SIEM destinations, and any statement of how long logs are kept. 8 9
The DevOps Engineer
An immutable audit log, a user audit report recording every secret accessed and every action including sharing, per-secret activity monitoring, behavioural analytics with threat scores and alerts, and dozens of reports creatable, scheduled and exportable through a documented API — that is material I could hand an auditor. I found no public information on named SIEM targets, stated log retention, or enforceable master-password and MFA policies, which caps it. 8 9
The Skeptic
An immutable audit log, per-secret and per-user audit reports covering creation, update and sharing, dozens of out-of-the-box SQL-based reports, scheduled delivery to auditors, event subscriptions and behavioral analytics with threat scores and alerts make the logging story documented and strong. We found no public information on SIEM integration with named targets, enforceable master-password or MFA policies, or log retention. 8 9
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Cloud only in an unstated region, no offline access, and no export or an export that drops attachments and shared items.
3 — Cloud with a region named, apps for common platforms, and an export in CSV only that leaves out attachments, folders, TOTP seeds or custom fields.
5 — An EU region or self-hosted option, offline read access on desktop and mobile, clients for Windows, macOS, Linux, iOS, Android and the major browsers, and an export that covers all item types including attachments.
8 — Both EU cloud and self-hosted or on-premises deployment documented, a status page with incident history, encrypted full-fidelity export and import from named competitors, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
An on-premises deployment is implied — the escrow instructions speak of an OnPremises edition and the SAML setup uses customer instance names — and there is a documented PGP-encrypted escrow export of vaulted passwords to CSV for disaster recovery plus package export and import for resource profiles. But I found no public information on hosting regions, client coverage across operating systems and browsers, or offline access beyond offline one-time-password settings for an enrolled machine. 7 10 11
The Identity Engineer
An on-premises variant of the Privileged Access Service is referenced, vaulted passwords for systems, accounts, domains and databases can be exported through a scheduled, PGP-encrypted escrow job into a CSV file, and resource profile packages can be exported and imported; a cloud status link exists on the site. The escrow lands in CSV, and we found no public information on an EU hosting region, offline access during an outage, client coverage across platforms, or a status page with incident history. 1 10 11
The Compliance Auditor
An on-premises Privileged Access Service deployment is referenced, and there is a documented escrow export of vaulted account passwords for systems, accounts, domains and databases, delivered as PGP-encrypted email with a CSV output for disaster recovery, alongside package export and import endpoints for resource profiles. We found no public information on cloud region choice, offline access during a vendor outage, or client coverage across operating systems and browsers, and a cloud status link is present without incident history. 1 10 11
The SME Owner
There is a documented disaster-recovery path — an escrow export of vaulted passwords for systems, accounts, domains and databases delivered as a PGP-encrypted email attachment, plus resource-profile export and import packages — and an on-premises deployment is referenced in passing, with a Cloud Status link on the site. We found no public information on selectable hosting regions, offline access during a vendor outage, which desktop or mobile clients exist, or any incident history behind that status link. 1 10 11
The DevOps Engineer
An on-premises edition of the Privileged Access Service is referenced, the escrow export runs from PowerShell on a schedule, PGP-encrypts the mailed file and is explicitly framed for disaster recovery, and the API ships examples in Shell, Node, Ruby, PHP and Python — a genuine exit path and pipeline hooks. But the escrow output is CSV, scoped to systems, accounts, domains and databases, and I found no public information on documented high availability or backup for self-hosting, client coverage across operating systems and browsers, offline access, or an export preserving full structure. 10 11 9
The Skeptic
An on-premises variant is implied by prerequisites written for the privileged access service running on-premises, a cloud status page exists, and the escrow export ships vaulted passwords as PGP-encrypted email requiring the customer's own OpenPGP key — an encrypted, documented exit path. We found no public information on hosting region choice, offline access during a vendor outage, or client coverage across operating systems and browsers. 10 11 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Non-EU vendor and contracting entity, hosting unstated, and subprocessors unnamed.
3 — An EU data region offered while the contracting entity and parent are non-EU without a stated safeguard, or the subprocessor list is absent.
5 — EU hosting as standard or selectable and an EU contracting entity, but the parent company or parts of the chain (support, analytics, email, client distribution) are non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
The contracting entity is Delinea Inc. of San Francisco under Federal Trade Commission jurisdiction, with a London entity for the UK and a DPA carrying standard contractual clauses and Data Privacy Framework certification. Hosting location is unstated, and I found no published subprocessor list, no EU contracting entity, and no EU data region — the transfer paperwork is real, but the chain itself is undocumented. 2
The Identity Engineer
The named contracting entity is Delinea Inc. with a San Francisco address, the Federal Trade Commission holds jurisdiction over its data privacy framework commitments, and a Delinea Europe Ltd. entity exists in the United Kingdom with a DPA covering cloud-hosted solutions and standard transfer mechanisms. We found no public information on where vault data and metadata are hosted or on any subprocessor list. 2
The Compliance Auditor
The contracting entity is Delinea Inc. at a San Francisco address, with the Federal Trade Commission named as regulator for its Data Privacy Framework commitments, and we found no public information on where vault data and metadata are hosted or on any subprocessor list. A data processing agreement with standard contractual clauses and a UK entity at a London address exist, but no EU region, EU entity or published subprocessor locations are evidenced; the referenced on-premises deployment is the only path that could take the vendor out of the data chain. 2 10
The SME Owner
The privacy policy names Delinea Inc. of San Francisco as the entity, puts the Federal Trade Commission over its Data Privacy Framework commitments, and gives Delinea Europe Ltd. in London as a European contact; vault data location is not stated and the subprocessor picture is not confirmed on the vendor's own captured pages. Standard Contractual Clauses and the EU-US framework are offered as transfer safeguards, but nothing I could find shows European hosting of the vault itself. 2
The DevOps Engineer
The contracting entity named is Delinea Inc. at a San Francisco address with a UK company alongside, the Federal Trade Commission holds jurisdiction over its Data Privacy Framework commitments, and hosting locations and every subprocessor are unstated on the captured pages. Standard Contractual Clauses and the DPF are the only transfer safeguards evidenced; I found no public information on an EU data region, an EU contracting entity, or a subprocessor list with locations. 2
The Skeptic
The entity named in the privacy policy is a US company with a San Francisco address and Federal Trade Commission jurisdiction under the EU-US Data Privacy Framework, with a UK entity for privacy correspondence; hosting locations and the subprocessor list are not published on the captured pages. A vault whose metadata and client update chain sit on unstated infrastructure behind US transfer mechanisms is not a European-sovereignty story. 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but which business features (SSO, SCIM, audit logs) sit in which tier is unclear — the invoice is unknowable.
5 — Per-user tier prices public with the main features per tier, but at least one commonly needed piece (SSO, SIEM integration, self-hosting, minimum seats) is unpriced or "on request".
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO
The only public commercial terms are a free 30-day trial and an invitation to get a quote; I found no public per-user price, tier structure, seat minimum or term, and the Privileged Behavior Analytics add-on is named without a price. A buyer cannot compute even a rough annual invoice from public pages. 5 8
The Identity Engineer
The only public commercial facts are a free 30-day trial and a "Get a quote" path; no per-user prices, tier feature mapping, seat minimums, minimum term or prices for the Privileged Behavior Analytics add-on appear anywhere captured. Every tier is a sales conversation. 5 8
The Compliance Auditor
The captured pages show a free 30-day trial, a get-a-quote flow, and Privileged Behavior Analytics offered as an add-on with no figure attached. We found no public information on any per-user price, tier structure, seat minimums, minimum term or VAT treatment, so a real annual invoice is not computable from public pages alone. 5 8
The SME Owner
No per-user price, no tiers and no seat minimums are published anywhere in the captured pages — the only public figures are a free 30-day trial and a Get a quote button, so the annual invoice for my forty people is unknowable without a sales conversation. Where single sign-on sits relative to the tiers is likewise not stated, which is precisely the game I refuse to play. 5 8
The DevOps Engineer
The only public commercial facts I can find are a free 30-day trial and a "Get a quote" button; no per-user price, tier breakdown, seat minimum, add-on or term appears anywhere. Which edition carries SSO, SCIM or audit export is a sales conversation, so the annual invoice is not computable from public pages. 8 5
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Secret Server
Is Secret Server European?
Not determined: the vendor’s pages as captured do not say where Secret Server is based.
Where does Secret Server store data?
Not stated on the vendor’s pages as of 20 Oct 2026.
Does Secret Server have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to Secret Server?
As of 21 Oct 2026, the panel rates Password Depot (3.5/5), Keeper (3/5) and Passbolt (3/5) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Secret Server alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 37 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.delinea.com Checked 20 Oct 2026 Details →
- 2 Privacy policy — found from the homepage delinea.com Checked 20 Oct 2026 Details →
- 3 Encryption model & independent audits — found from sitemap delinea.com Checked 20 Oct 2026 Details →
- 4 Sharing, roles & recovery — found from sitemap developer.delinea.com Checked 20 Oct 2026 Details →
- 5 Sharing, roles & recovery — found from sitemap delinea.com Checked 20 Oct 2026 Details →
- 6 SSO, directory sync & provisioning — found from sitemap support.delinea.com Checked 20 Oct 2026 Details →
- 7 SSO, directory sync & provisioning — found from sitemap support.delinea.com Checked 20 Oct 2026 Details →
- 8 Audit logs, policies & reporting — found from sitemap delinea.com Checked 20 Oct 2026 Details →
- 9 Audit logs, policies & reporting — found from sitemap developer.delinea.com Checked 20 Oct 2026 Details →
- 10 Hosting choice, offline access & export — found from sitemap support.delinea.com Checked 20 Oct 2026 Details →
- 11 Hosting choice, offline access & export — found from sitemap developer.delinea.com Checked 20 Oct 2026 Details →