# Secret Server — Password Management Secret Server by Delinea holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined. - Vendor: Delinea (https://www.delinea.com) - Category: [Password Management](https://whats-best.ai/software/password-management.md) - Provenance (editorial classification): provenance unknown - Canonical page: https://whats-best.ai/software/password-management/secret-server - Alternatives: https://whats-best.ai/software/password-management/secret-server/alternatives ([markdown](https://whats-best.ai/software/password-management/secret-server/alternatives.md)) - Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Delinea - Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026 - Data hosting: Not stated on the vendor’s pages as of 20 Oct 2026 - Free plan: Not stated on the vendor’s pages as of 20 Oct 2026 ## The panel's verdict Delinea Secret Server is a password-management vault strongest on audit and policy, where scores cluster at 6-7, and sharing and access control at 5-6. Audit evidence is deep: an immutable audit log, a user audit report recording every action including sharing, dozens of out-of-the-box SQL-based reports schedulable to auditors. Sharing runs through per-collection permissions with rights such as Grant and Edit and Dual Control requiring approver credentials before a report or recording is viewed; SAML single sign-on with Okta, single logout, a SCIM provisioning connector and a PGP-encrypted escrow export for disaster recovery are documented. Security architecture scores sit at 2 — beyond an optional FIPS 140-2 compliant algorithm and a security-advisories page we found no public whitepaper or independent audit — and sovereignty at 1: the contracting entity is Delinea Inc. of San Francisco under Federal Trade Commission jurisdiction, with hosting locations and subprocessors unstated on the captured pages. We found no public information on how the vault is decrypted after single sign-on; pricing is a free 30-day trial plus a quote request. Judges differed by at most one point on any criterion. **Speaks for it:** - An immutable audit log, per-user and per-secret audit reports recording actions including sharing, and behavioral analytics with threat scores and alerts are documented. - Dual Control requires an approver's credentials before a sensitive report or recording can be viewed. - Collection permissions grant rights such as Grant and Edit to users or roles through a documented API. - SAML single sign-on with Okta is documented to the assertion-consumer and single-logout endpoints, with an Okta SCIM connector for provisioning. - A scheduled escrow export delivers vaulted passwords as PGP-encrypted email requiring your own OpenPGP key, framed for disaster recovery. **Held against it:** - Security architecture scores sit at 2; the only public cryptography is an optional FIPS 140-2 compliant algorithm plus a security-advisories page. - We found no public information on a security whitepaper, key derivation, or an independent audit with a named auditor and date. - We found no public information on how the vault is decrypted after single sign-on, and MFA appears only as a short-code program. - The contracting entity is Delinea Inc. at a San Francisco address under Federal Trade Commission jurisdiction, with hosting locations and a subprocessor list unstated on the captured pages. - Okta provisioning matches users by entering the corresponding Secret Server user name manually. **Best for:** - You need audit-ready privileged-access records — an immutable log, SQL-based reports schedulable to auditors, and behavioral analytics scored highest here. - Your team runs Okta and wants SAML single sign-on and SCIM provisioning documented step by step. - You need granular vault governance, with collection-level permissions, delegable Grant rights, and dual-control approvals before sensitive reports or recordings are viewed. - You want a documented disaster-recovery exit path — the scheduled, PGP-encrypted escrow export — and an on-premises edition is referenced. **Avoid if:** - Your procurement requires a published encryption model or an independent audit with a named auditor; the captured pages show only an optional FIPS 140-2 compliant algorithm and a security-advisories page. - You require a European contracting entity or published hosting and subprocessor locations; the named entity is Delinea Inc. of San Francisco, and these are unstated on the captured pages. - Your identity provider is not Okta — ask the vendor: the public pages we read do not show it ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price. | Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Encryption model & independent audits | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | | Sharing, roles & recovery | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | | SSO, directory sync & provisioning | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | | Audit logs, policies & reporting | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | | Hosting choice, offline access & export | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | | European sovereignty | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 | | Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r | | **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2/5** | **2/5** | **2/5** | ### The judges - **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press. - **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself. - **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named. - **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up. - **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing. - **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Ownership | Not determined | — | — | | Data residency | Not determined | — | — | | Subprocessors | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Advisories page purpose: yes [S3] - DPA offered: data processor / service provider role, incl. cloud-hosted solutions · yes [S2] - Dpf certified: yes · yes · yes [S2] - Dpf dispute resolution: no cost to you · TRUSTe [S2] - End user rights handling: yes [S2] - Fips 140 2: FIPS 140-2 · yes [S8] - Ftc jurisdiction: Federal Trade Commission [S2] - Intl transfer mechanisms: adequacy decisions · 2021 SCCs · EU-US DPF [S2] - No children data: no [S2] - No selling personal info: no [S2] - Transfer safeguards: yes [S2] **Data** - Correction response days: 30 [S2] - Deletion on request: yes [S2] - Retention policy: yes [S2] - Support deletion ticket: support ticket [S2] **Integrations** - API documented languages: Shell · Node · Ruby · PHP · Python [S9] **Legal** - Disclaimer liability: liability_disclaimer [S3] - Entity name: Delinea Inc. [S2] - Policy last modified: 2026-09-29 [S2] - Processor role: data processor [S2] - UK entity: Delinea Europe Ltd. · 5 New Street Square, London, EC4A 3TW, United Kingdom [S2] - US address: 221 Main Street, Suite 1300, San Francisco, CA 94105, United States of America [S2] **Pricing** - Free trial: yes · 30 [S8] **Product** - Addreport endpoint: POST · Add a report · /Report/AddReport [S9] - Addreport error fields: ErrorID · Message [S9] - Addreport name required: string · yes [S9] - Addreport optional params: string · array of objects [S9] - Addreport required params: string · yes [S9] - Addreport result object: newly created report object [S9] - Addreport settings object: object · Description of the report [S9] - Addreport success response: boolean · yes [S9] - AI sessions authorized: Millions of AI sessions authorized each week [S1] - API documentation age: Updated about 1 year ago [S4] - Article scope: Secret Server · All · All [S6] - Body params: ID · Set to null for global permissions · string · Grants · object · Principal · PType · Rights · yes [S4] - Control: Real-time authorization, least privilege enforcement, policy-based access controls [S1] - Custom reports sql: Custom reports created with database queries; reports are SQL-based [S8] - Customer count: 9000 [S1] - Customer data marketing share: no [S2] - Customer retention: 95 [S1] - Customer self service controls: access · control access · correct · download · delete [S2] - Dual control: Dual Control requires approver credentials before a report or recording can be viewed [S8] - Endpoint: /Collection/SetCollectionPermissions · POST [S4] - Escrow authentication: bearer token via Centrify-InteractiveLogin-GetToken [S10] - Escrow commands: Set-Escrowkey · Set-EscrowEmail · Get-EscrowEmail · Run-Escrow · Schedule-Escrow · Unschedule-Escrow · Get-EscrowScheduleStatus [S10] - Escrow output CSV: CSV · disaster recovery [S10] - Escrow pgp email: PGP-encrypted email · OpenPGP secret key [S10] - Escrow role requirement: PAS System Administrator [S10] - Escrow scheduling: yes [S10] - Escrow smtp onprem: SMTP configured and working [S10] - Escrow version prerequisite: 19.1 [S10] - Event subscription triggers: Unlimited Administration Mode toggle · Secret Edit/Add/View · Role and Group Assignment changes · Secret expiration · Configuration changes · Heartbeat failure when a password is invalid [S8] - Event subscriptions: Event Subscriptions send email notifications for specified events [S8] - Export icon param: ExportIcon · boolean · yes [S11] - Export identifier override: The supplied identifier is used in the export rather than the identifier saved in the resource profile. [S11] - Export offline otp settings: Returns offline OTP settings for the enrolled machine (API) [S11] - Export password profile param: ExportPasswordProfile · boolean · no [S11] - Export resource profile package: ExportResourceProfilePackage - zips a resource profile into a package. [S11] - Export URL validity: The URL for the resource package is valid for at least one hour. [S11] - Fastpath: Delinea Fastpath: governance of ERP and business application access [S1] - Github policy available: yes [S5] - Grants principal types: User · Role · Grant · Edit [S4] - Identity types: AI agents, human and machine identities [S1] - Immutable audit log: yes [S8] - Import resource profile package: OpenResourceProfilePackage - unzips and validates a resource profile package. [S11] - Industries: Financial Services · Healthcare · Public Sector (Federal and SLED) · Energy & Critical Infrastructure · Education [S1] - Insights: Insights: shared platform capability with audit and behavioral analytics, threat scores and alerts [S8] - Known environments: Privilege Access Service · Cloud Suite [S10] - Listed products: Account Lifecycle Manager · Connection Manager · Delinea Platform · Fastpath Access Control · Fastpath Access Provisioning · Fastpath Access Review · Fastpath Change Tracking · Identity Threat Protection · Privilege Control for Cloud Entit… [S5] - Okta SCIM integration: Secret Server supports integration with Okta via a SCIM Connector application [S6] - Out of box reports: Dozens of out-of-the-box reports [S8] - Owned web properties: delinea.com · cloud.centrify.com · authomize.com · gofastpath.com · portal.thycotic.com [S2] - Pas escrow export: Cloud Suite Privileged Access Service · Escrow export of vaulted account passwords for Systems, Accounts, Domains, and Databases [S10] - Permission requirement: system administrator · Grant permission on the collection · global Grant permission on collections [S4] - Platform modules: Delinea Iris AI · Discovery & Inventory · Identity Posture & Threat Analysis · Protected Credentials & Vaulting · Privileged Secure Access · Just in Time & Zero Standing Privilege · Segregation of Duties & GRC [S1] - Platform modules: Delinea Iris AI · Discovery & Inventory · Identity Posture & Threat Analysis · Protected Credentials & Vaulting · Privileged Secure Access · Just in Time & Zero Standing Privilege · Segregation of Duties & GRC [S5] - Platform modules footer: Delinea Iris AI · Discovery & Inventory · Identity Posture & Threat Analysis · Protected Credentials & Vaulting · Privileged Secure Access · Just in Time & Zero Standing Privilege · Segregation of Duties & GRC [S3] - Policy code language: Policy expressed as code referencing StrongDM::Resource and StrongDM::Role [S5] - Policy forbid access unless approved role: Policy playbook that forbids database access unless user is in an approved role, implementing RBAC via fine-grained authorization [S5] - Posture: Identify excessive privileges, policy violations, stale accounts, shadow AI and emerging threats [S1] - Privileged behavior analytics: add-on · yes [S8] - Product list: Account Lifecycle Manager · Connection Manager · Delinea Platform · Fastpath Access Control · Fastpath Access Provisioning · Fastpath Access Review · Fastpath Change Tracking · Identity Threat Protection · Privilege Control for Cloud Entit… [S1] - Products footer: Account Lifecycle Manager · Connection Manager · Delinea Platform · Fastpath Access Control · Fastpath Access Provisioning · Fastpath Access Review · Fastpath Change Tracking · Identity Threat Protection · Privilege Control for Cloud Entit… [S3] - Realtime authorization: Real-time authorization of every action before execution for AI, human and machine identities [S1] - Reports API capabilities: yes · yes · yes · yes [S9] - Reports default categories: yes [S9] - Reports email results: email report results to recipient · yes [S9] - Reports rbac: Reports protected through RBAC to limit who can create or view reports [S8] - Response fields: string · string · string · boolean · 200 [S4] - SAML assertion consumer URL: SAML Assertion Consumer Service endpoint: /saml/assertionconsumerservice.aspx [S7] - SAML browser requirement: SLO configuration section requires Firefox or IE; Chrome known to fail certificate upload [S7] - SAML certificate upload: Secret Server accepts .pfx certificates; Okta SLO requires corresponding .cer public key upload [S7] - SAML configuration location: SAML configuration located at Admin > Configuration > SAML tab [S7] - SAML metadata import: Import Identity Provider from XML metadata [S7] - SAML metadata URL: SAML metadata available at instance /samlmetadata URL [S7] - SAML okta integration: Secret Server supports SAML SSO configuration with Okta as Identity Provider [S7] - SAML slo support: SAML Single Logout (SLO) between Secret Server and Okta · yes [S7] - SAML slo URL: Single Logout Service endpoint: /saml/sloservice.aspx [S7] - Scheduled reports: Scheduled Reports generated on a schedule and sent via email [S8] - Scheduled reports health check: Health Check option emails only when a report has content [S8] - Secret audit report: Secret Audit Report provides details and activity monitoring per Secret [S8] - User audit report: User Audit Report displays every Secret a user accessed in a date range and allows expiring each Secret [S8] - User audit report records actions: User Audit Report records all actions a user takes on a password [S8] - User provisioning okta: Okta users assigned to the Secret Server app by matching the Secret Server User Name manually [S7] - Video demo available: yes [S5] - Visibility: Continuous discovery of every AI, human and machine identity [S1] **Support** - Cloud status: yes [S1] - Customer community: yes [S1] - Demo quote available: yes · yes [S5] - Documentation available: yes · yes [S5] - Gartner rating: 5 · 4.6 · Gartner [S1] - Interactive demo: yes · no [S1] - Live demo: Live demo with a Delinea expert, tailored to requirements [S1] - Open case: yes [S6] - Opt out channels: unsubscribe link · subscription center · email privacy@delinea.com · Privacy Rights tool [S2] - Privacy rights tool: OneTrust · yes [S2] - Product documentation: yes [S1] - Professional services: yes [S1] - Technical support: yes [S1] - Trial available: yes [S5] - User training: yes [S1] ## Questions ### Is Secret Server European? Not determined: the vendor’s pages as captured do not say where Secret Server is based. ### Where does Secret Server store data? Not stated on the vendor’s pages as of 20 Oct 2026. ### Does Secret Server have a free plan? Not stated on the vendor’s pages as of 20 Oct 2026. ### What are the best alternatives to Secret Server? As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Secret Server alternatives](https://whats-best.ai/software/password-management/secret-server/alternatives). ## What this page leaves out - 37 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. ## Sources - [S1] Vendor page: https://www.delinea.com (checked 2026-10-20) - [S2] Privacy policy — found from the homepage: https://delinea.com/privacy-policy (checked 2026-10-20) - [S3] Encryption model & independent audits — found from sitemap: https://delinea.com/security-advisories (checked 2026-10-20) - [S4] Sharing, roles & recovery — found from sitemap: https://developer.delinea.com/reference/post_collection-setcollectionpermissions (checked 2026-10-20) - [S5] Sharing, roles & recovery — found from sitemap: https://delinea.com/playbooks/forbid-access-unless-user-in-approved-role (checked 2026-10-20) - [S6] SSO, directory sync & provisioning — found from sitemap: https://support.delinea.com/s/article/SS-EXT-INTG-Okta-SCIM-Integration (checked 2026-10-20) - [S7] SSO, directory sync & provisioning — found from sitemap: https://support.delinea.com/s/article/SS-Setting-up-OKTA-for-SAML (checked 2026-10-20) - [S8] Audit logs, policies & reporting — found from sitemap: https://delinea.com/products/secret-server/features/enhanced-reporting-auditing-compliance (checked 2026-10-20) - [S9] Audit logs, policies & reporting — found from sitemap: https://developer.delinea.com/reference/post_report-addreport (checked 2026-10-20) - [S10] Hosting choice, offline access & export — found from sitemap: https://support.delinea.com/s/article/HOWTO-Using-PAS-Escrow-Functions-to-Export-Vaulted-Data (checked 2026-10-20) - [S11] Hosting choice, offline access & export — found from sitemap: https://developer.delinea.com/reference/post_resourceprofile-exportresourceprofilepackage (checked 2026-10-20) --- Cite as: whats-best.ai, "Secret Server — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/secret-server Corrections: https://whats-best.ai/correct/928?target=page