Twelve services outgrew one encrypted credentials file — what decides whether you operate a secret store yourself or take a hosted one?

## Why this is not a feature comparison Once credentials move out of the file, the store is on the **start-up path of every service in the estate**. That single fact reorders the decision: the question is no longer which option has more capabilities, it is which failure you would rather own and which one you could actually survive. Both options can express rights over a branch of names, record reads and withdraw a holder. The difference is who is awake when it stops answering. ## What operating it yourself actually buys and costs Buys: - **Custody.** The key that protects the store, the read record and the backups stay inside your boundary, and nothing about your inventory of names is visible to a third party. - **Placement.** It can live inside your own network boundary, reachable by workloads that cannot reach the public internet, and constraints on where material may reside are yours to satisfy directly. - **Fit.** You choose the unlock model, the retention of the record, and how it degrades. Costs, all of which are recurring and none of which are the software: - Supplying the protecting key after an **unattended restart**, at whatever hour that happens. - Replicas, upgrades and capacity for a read volume that grows with every deploy. - **Backups that somebody has restored**, at least once, on purpose. An untested restore is a plan, not a capability. - On call, continuously, for a dependency whose outage looks like the whole estate failing to start. ## What a hosted store buys and costs Buys: the provider runs all of the above, usually with no visible locked state to manage and with availability arithmetic you do not have to do. For a twelve-service estate with a handful of engineers, that is often decisive on its own. Costs, which are real and frequently under-counted: - **A dependency on somebody else's availability**, with their maintenance windows and their incident communications, on the start-up path of your estate. - **Their tenant boundary**, which you cannot inspect and must accept. - **Reaching them.** Every workload must be able to authenticate to the provider from wherever it runs, including from environments that are partitioned or offline, and the first credential that gets it there is still your problem. - **The read record on their terms** — whatever export, retention and query they offer is what an audit will get. - **Charging shape.** Where a provider bills per secret and per read, a high-volume fleet re-reading on every start can turn a small bill into a large one; measure the read pattern before committing. ## The questions that actually decide it 1. **How many consumers, how many names, and how often are they read?** A dozen services reading at start-up is a different problem from thousands of short-lived workloads reading continuously. 2. **Do you need credentials minted on downstream systems**, or only held? Generation raises the store's own authority and makes its correctness more consequential. 3. **Who restores it at three in the morning, and have they done it once?** If the honest answer is nobody, self-operating is a decision you have already lost. 4. **What does the estate failing to start cost per hour**, and does either option demonstrably beat that number? 5. **Where may the material reside**, and does a hosted option satisfy that without argument? 6. **What happens during a partition** between your workloads and whichever option you pick? ## The third option nobody states For a genuinely small estate with few readers and few credentials, an encrypted file with a well-held key is a defensible arrangement, and saying so is a sign of judgment rather than a lapse. The moment it stops being defensible is identifiable: when you cannot give one service only what it needs, when you cannot say who read what, when a departure means re-keying everything, or when the credentials must be minted rather than typed. Those are the four thresholds — and if none of them has been crossed, the store's operational cost is buying you very little. ## What a strong answer sounds like A strong answer picks a side and names the cost accepted. "Twelve services, one small platform team, no round-the-clock on call: we take a hosted store, accept the dependency on their availability, and hold a tested fallback for the two credentials that must survive losing them." A weak answer compares capability tables. The decisive facts are the operations you will really perform, and the one nobody performs is the restore they never rehearsed.