What is vendor lock-in for secrets?

Vendor lock-in is the situation in which moving away from a product would cost so much time, money or risk that a team stays even when the product no longer suits it, because its data, workflows or integrations depend on that one vendor.

What locks you into a secrets manager

Secrets are small, so the values themselves are rarely the problem. A few hundred KEY=VALUE lines export in minutes. The lock-in sits around them:

• Integrations. Every pipeline, server and app that fetches values through the vendor's API, CLI or SDK has to change.
• Server-side features. Dynamic database credentials, automatic syncs into hosting platforms and rotation run by the vendor have no equivalent in a tool that works differently.
• Access structure. Roles, groups, policies and their history, which rarely export in a form another product reads.
• History and audit. Old versions and the audit log, which compliance may require you to keep after you leave.
• Hosting. A service only the vendor can run, or a self-hosted product that only runs on one platform.
• The vendor leaving first. Products get discontinued. HCP Vault Secrets reached end of life on July 1, 2026, or earlier at the end of a customer's contract (IBM), and EnvKey Cloud shut down on February 1, 2025 (EnvKey README). Their users moved on someone else's schedule.

Exit questions to ask before moving in

1. Can I export every value, in a format I can read without the product?
2. Can I export the history and the audit log?
3. What breaks in my pipelines and servers if the product disappears tomorrow?
4. Where can it run, and can I move it myself?
5. Can I still read my data if the vendor's service is down?

Common mistakes

• Testing only the import. Every vendor makes it easy to come in.
• Spreading the vendor's SDK through your code, instead of injecting values at start time.
• Ignoring the people side. A migration also means new accounts and new habits for everyone.

How Crunu answers the exit questions

Being direct about both sides:

• Values leave in their own formats. An environment holds files: .env, INI, flat YAML or text. You can download them, write them with crunu pull, or export an environment to an Ansible Vault file that ansible-vault view opens.
• Reading without the server. The offline copy puts every environment you can access, except network-restricted ones, into one encrypted file that opens with your password and Secret Key, without any server.
• Moving the server. A self-hosted server, available on the Enterprise plan, moves between Docker, Cloudflare Workers, Vercel and Google Cloud Run with one archive, crunu-server export and import, history and audit log included. The server's address stays the same across a move.
• Integration surface. Programs get values as environment variables through crunu run; there is no SDK in your code to remove.
• What it doesn't have. No import from 1Password, HashiCorp Vault, Doppler or Infisical, beyond dropping in files. No dynamic secrets or syncs, so there is nothing of that kind to migrate away from either.

Self-hosting options and their exits are compared in self-hosted secrets manager: options and trade-offs. Moving off a discontinued product: HCP Vault Secrets shutdown and migrating from EnvKey.

Sources

• IBM Support: HCP Vault Secrets end of life, checked October 30, 2026.
• EnvKey README, checked October 30, 2026.