Oracle Database Vault is one of Oracle's most expensive database options and one of the most commonly mis-licensed. As a separately priced Enterprise Edition-only security feature, Database Vault adds $11,500 per processor (or $230 per Named User Plus) on top of the Oracle Database Enterprise Edition licence. The licensing rules are strict: the option must use the same metric as the underlying database licence, coverage must be one-to-one, and in multitenant environments the entire container database must be licensed. Yet Database Vault's components are installed by default, making accidental activation trivially easy. This guide provides the complete Database Vault licensing framework.
This advisory is part of our comprehensive Oracle Licensing Knowledge Hub. For Oracle licence metrics, see Oracle Licence Metrics and Definitions. For related security options, see Oracle Advanced Security Licensing.
Oracle Database Vault is a security option for Oracle Database that enforces access controls beyond standard Oracle database privilege management. It creates "realms" around sensitive data that restrict access even for highly privileged users such as DBAs. Command rules control when, where, and how specific database commands can be executed. Separation of duties prevents any single user from having unchecked administrative power.
Enterprises deploy Database Vault primarily for regulatory compliance (SOX, GDPR, HIPAA, PCI-DSS) and insider threat protection. From a licensing perspective, the critical point is that Database Vault is a separately licensed, extra-cost option. It is not included with Oracle Database Enterprise Edition.
| Attribute | Detail |
|---|---|
| Product classification | Oracle Database option (extra-cost, separately licensed) |
| Required database edition | Oracle Database Enterprise Edition only. Cannot be used on Standard Edition, Standard Edition 2, or Express Edition |
| List price (Processor) | $11,500 per processor + 22% annual support ($2,530/year) |
| List price (NUP) | $230 per Named User Plus + 22% annual support ($50.60/year) |
| Metric matching rule | Must use the same metric as the underlying database licence (Processor or NUP). Cannot mix |
| Coverage rule | One-to-one: licence quantity for Database Vault must exactly equal the database licence quantity |
| Installation default | Database Vault components are installed by default with Oracle Database. Enabling requires explicit configuration but no separate software installation |
| Feature tracking | Usage recorded in DBA_FEATURE_USAGE_STATISTICS. Oracle auditors check this view specifically for unlicensed option activation |
Database Vault components ship with every Oracle Database installation. No separate download or installation is required. A DBA can enable Database Vault with a few configuration steps on any Enterprise Edition instance, and the activation is permanently recorded in DBA_FEATURE_USAGE_STATISTICS. This means that a single test activation, even if immediately reversed, creates an audit trail that Oracle's LMS team will flag. The default installation is by design. It lowers the barrier to adoption but simultaneously creates a compliance trap for organisations that have not purchased the licence.
| Metric | List Price | How to Count | Best For | Key Requirement |
|---|---|---|---|---|
| Processor | $11,500 per processor | Physical cores multiplied by Oracle Core Factor = processor count (same calculation as the database licence) | Large or undefined user populations; internet-facing databases; high core-count servers | Must licence every processor that the database is licensed on. No partial coverage |
| Named User Plus (NUP) | $230 per user | Count of individual named users with access to the database (minimum 25 NUP per processor) | Small, well-defined user populations; development environments; departmental databases | NUP count must exactly match the database's NUP count. Minimum 25 per processor applies |
Database Vault must use the same licensing metric as the underlying Oracle Database Enterprise Edition licence. If the database is licensed by Processor, Database Vault must also be licensed by Processor. If the database is licensed by NUP, Database Vault must be licensed by NUP at the same quantity. You cannot licence the database by Processor and Database Vault by NUP (or vice versa). You cannot licence Database Vault for fewer processors or fewer users than the database itself. The one-to-one rule means that every processor or named user licensed for the database must also be licensed for Database Vault. There are no exceptions.
| Deployment Scenario | DB EE Licence Cost | Database Vault Cost | Combined Total | Vault as % of DB EE |
|---|---|---|---|---|
| 2-socket / 16-core server (8 proc after core factor 0.5) | $380,000 (8 x $47,500) | $92,000 (8 x $11,500) | $472,000 | 24% |
| 2-socket / 32-core server (16 proc after CF 0.5) | $760,000 | $184,000 | $944,000 | 24% |
| 50 Named Users (minimum met) | $23,750 (50 x $475) | $11,500 (50 x $230) | $35,250 | 48% |
| 200 Named Users | $95,000 | $46,000 | $141,000 | 48% |
| Annual support (8-proc server) | $83,600/year | $20,240/year | $103,840/year | 24% |
Database Vault adds approximately 24% to Processor-based licensing costs but nearly 48% to NUP-based licensing costs. This is because the Database Vault NUP list price ($230) is proportionally higher relative to the DB EE NUP price ($475) than the Processor ratio ($11,500 vs $47,500). For NUP-licensed environments, Database Vault effectively adds nearly half the cost of the underlying database. This makes the breakeven analysis between Processor and NUP even more critical when Database Vault is involved. A deployment with 100 NUP costs $47,500 for DB EE + $23,000 for Vault = $70,500. The same workload on an 8-processor server costs $380,000 + $92,000 = $472,000. The NUP model saves $401,500 if the user count is genuinely capped at 100.
Oracle's multitenant architecture (CDB/PDB) creates a significant Database Vault licensing trap. If Database Vault is enabled at the container database (CDB) level, Oracle requires licensing the entire container. This means every pluggable database (PDB) in that CDB is considered to be using the option, regardless of whether individual PDBs actually use Database Vault features.
| Multitenant Scenario | Licensing Requirement | Cost Impact (8-proc server) | Compliance Risk |
|---|---|---|---|
| Database Vault enabled at CDB level | Must licence the entire CDB (all processors/NUP) for Database Vault. Applies to ALL PDBs | $92,000 (8 x $11,500) regardless of how many PDBs use the feature | High. Most common multitenant compliance gap |
| Only 1 of 10 PDBs needs Database Vault | Still must licence the entire CDB. Cannot licence individual PDBs | $92,000 (full CDB licensing) vs theoretical $9,200 if per-PDB were allowed | 10x cost multiplier for single-PDB requirement |
| Database Vault needed on isolated instance (non-CDB) | Licence only that instance's processors/NUP | Cost proportional to that instance's hardware only | Lower. Clear scoping to single instance |
If only a small number of databases require Database Vault, do not deploy them in a multitenant container alongside databases that do not need the option. Enabling Database Vault at the CDB level triggers licensing for every PDB in that container. Instead, either deploy Database Vault databases in their own dedicated CDB (where all PDBs require the option) or use standalone non-CDB instances. This isolation strategy can reduce Database Vault licensing costs by 50 to 90% compared to enabling the option in a large, shared multitenant container. On an 8-processor server hosting 10 PDBs where only 1 needs Database Vault, isolating that PDB to a separate 2-processor instance saves $69,000 in Database Vault licensing alone.
| Oracle Cloud Service | Database Vault Included? | Pricing Model | Key Consideration |
|---|---|---|---|
| Oracle Cloud DB: High Performance | Yes. Included at no additional cost | OCPU/hour or BYOL. Vault bundled into service tier | Most cost-effective way to access Database Vault if migrating to cloud |
| Oracle Cloud DB: Extreme Performance | Yes. Included | OCPU/hour or BYOL. Includes all database options | Includes Vault plus all other options (ADG, Partitioning, etc.) |
| Autonomous Database | Yes. Included in all Autonomous DB editions | OCPU/hour. All security features bundled | Simplest licensing model. No separate option management |
| Oracle Cloud DB: Standard tier | No. Not included in base cloud tier | Requires upgrading to High Performance or Extreme Performance tier | Tier upgrade cost must be compared against on-premises Vault licensing |
| On-premises BYOL to OCI | Requires existing Database Vault licence with active support | BYOL reduces OCI compute cost. Vault licence must be maintained | Vault licence and support still required on-premises. BYOL enables cloud deployment |
For organisations with significant Database Vault requirements, migrating to Oracle Cloud High Performance or Autonomous Database eliminates the separate option licensing cost entirely. Database Vault is bundled into these service tiers at no additional charge. On an 8-processor on-premises server, Database Vault costs $92,000 in licence fees plus $20,240 per year in support. Migrating that workload to OCI High Performance tier includes Database Vault for free. The cloud migration business case should always include this option licensing elimination as a quantified benefit. It is frequently the tipping point that makes cloud migration financially compelling for security-heavy Oracle deployments.
| Audit Finding | How It Occurs | Typical Cost Impact | Prevention Strategy |
|---|---|---|---|
| Database Vault enabled without licence | DBA enables Vault for testing or compliance project. Licence never purchased. DBA_FEATURE_USAGE_STATISTICS records activation permanently | $92,000 to $184,000 per server (back-licensing at list + support) | Require licence verification before enabling any Oracle option. Implement DBA change control process |
| Database Vault on Standard Edition | Vault components present in SE installation. DBA enables on SE2 instance. Oracle requires full EE licence + Vault licence as remediation | $380,000+ per server (EE upgrade + Vault licensing) | Remove or disable Vault components on all SE/SE2 installations. Implement edition verification checks |
| Partial coverage (fewer licences than database) | Organisation purchases Vault for 4 of 8 processors. Oracle requires 1:1 matching = 8 processor licences | $46,000 (4 x $11,500 shortfall) | Always licence Vault at identical quantity to database. No partial coverage permitted |
| Multitenant container violation | Vault enabled at CDB level but only licensed for 1 PDB. Oracle requires licensing entire CDB | $50,000 to $150,000+ (full CDB licensing) | Isolate Vault-requiring PDBs in dedicated CDB or standalone instances |
| Metric mismatch | Database licensed by Processor, Vault purchased on NUP (or vice versa). Metrics must match | $20,000 to $100,000+ (relicensing on correct metric) | Verify metric alignment at time of purchase. Review annually during compliance audit |
| DR/failover server not licensed | Database Vault enabled on primary. Standby becomes active during failover. Standby not licensed for Vault | $92,000+ (full Vault licensing on standby) | If standby is actively licensed for DB EE (ADG, logical standby), Vault must also be licensed on standby |
Oracle's DBA_FEATURE_USAGE_STATISTICS view records any activation of Database Vault permanently, even if it was enabled briefly for testing and then disabled. During an Oracle audit, this historical usage will be flagged as a compliance finding. The "we only tested it for a day" argument does not reduce the licensing obligation. Oracle treats any recorded activation as usage that requires a licence. The only reliable prevention is a mandatory approval process requiring ITAM/licence manager sign-off before any Oracle database option is enabled. Technical curiosity should never be allowed to create six-figure compliance exposure.
| Strategy | How It Works | Typical Savings | Implementation Approach |
|---|---|---|---|
| Multitenant isolation | Deploy Vault-requiring databases in dedicated CDB or standalone instances to avoid licensing non-Vault PDBs | 50 to 90% Vault licensing reduction | Migrate Vault-requiring PDBs to dedicated container. Restructure CDB architecture |
| NUP vs Processor evaluation | For databases with small, well-defined user populations, NUP licensing for both DB EE and Vault can be dramatically cheaper | 60 to 85% savings for eligible deployments | Audit actual named user counts. Calculate NUP cost vs Processor. Switch metric if NUP is cheaper (requires new licence purchase) |
| Hardware right-sizing | Reduce physical core count on servers running Database Vault. Fewer cores = fewer Vault Processor licences | $11,500 per processor eliminated | Consolidate Vault workloads onto smaller, dedicated servers. Right-size VM core allocations |
| Oracle Cloud migration | Migrate Vault-requiring databases to Oracle Cloud High Performance or Autonomous Database where Vault is included free | Eliminates separate Vault licensing entirely | Compare OCI High Performance tier cost vs on-premises DB EE + Vault total. Cloud tier includes Vault at no additional cost |
| ULA / ELA inclusion | Include Database Vault in an Unlimited Licence Agreement or Enterprise Licence Agreement for unlimited deployment rights during the term | 30 to 50% effective discount vs purchasing individually | Negotiate Vault inclusion during ULA/ELA renewal. Ensures coverage across all deployments without per-server tracking |
| Disable unused Vault deployments | Identify databases where Vault was enabled but is no longer actively used. Disable and document to stop audit exposure | Eliminates licensing obligation for disabled instances | Query DBA_FEATURE_USAGE_STATISTICS. If CURRENTLY_USED = FALSE and no business requirement exists, formally disable and document |
Of all optimisation strategies, multitenant isolation consistently delivers the largest cost reduction for Database Vault licensing. The mathematics are straightforward. On an 8-processor server hosting 10 PDBs where only 1 needs Database Vault, licensing the entire CDB costs $92,000. Isolating that PDB to a dedicated 2-processor instance costs $23,000. That is a $69,000 savings from a single architectural change. Multiply this across multiple servers and the savings frequently reach six figures. Before purchasing additional Database Vault licences, always evaluate whether restructuring the CDB/PDB architecture can reduce or eliminate the requirement.
1. Quarterly DBA_FEATURE_USAGE_STATISTICS audit. Run DBA_FEATURE_USAGE_STATISTICS on every Oracle database instance quarterly. Check specifically for "Oracle Database Vault" feature entries. Any detection of usage, even if CURRENTLY_USED = FALSE, indicates historical activation that will appear in an Oracle audit. Investigate and document.
2. Edition verification on all instances. Verify that Database Vault is not enabled on any Standard Edition or Standard Edition 2 instance. The Vault components may be present in SE installations by default. Implement checks to prevent DBA activation on non-EE databases.
3. Metric and quantity alignment review. Annually verify that every Database Vault licence matches the underlying database licence in both metric type (Processor or NUP) and quantity. Any mismatch creates audit exposure. Update Vault licences whenever database licences change.
4. Multitenant architecture review. If using Oracle Multitenant (CDB/PDB), verify that Database Vault is not enabled at the CDB level unless all PDBs in that container are intended to be licensed for Vault. Restructure CDB architecture if Vault licensing scope is broader than necessary.
5. Change control for option enablement. Implement a mandatory approval process requiring ITAM/licence manager sign-off before any Oracle database option is enabled, including Database Vault. This prevents accidental activation that creates licensing obligations.
6. DR and standby licensing verification. If Database Vault is enabled on a primary database with an actively licensed standby (ADG, logical standby), verify that the standby also has Database Vault licensing. Passive standbys under the 10-day rule do not require separate option licensing, but active standbys do.
The six governance disciplines above take a few hours per quarter to execute. The cost of not executing them is measured in six and seven figures during an Oracle audit. Every governance activity in this checklist exists because we have seen the corresponding audit finding in client engagements, repeatedly. The organisations that never face Database Vault compliance surprises are the ones that run DBA_FEATURE_USAGE_STATISTICS quarterly, enforce change control on option enablement, and review their multitenant architecture annually. These are not theoretical best practices. They are the minimum viable controls for any organisation running Oracle Database Enterprise Edition.
No. Database Vault is a separately licensed, extra-cost option for Oracle Database Enterprise Edition. It costs $11,500 per processor or $230 per Named User Plus at list price, plus 22% annual support. The Database Vault components may be installed by default with the Oracle Database software, but enabling and using them requires a separate licence purchase. Using Database Vault without a licence is a compliance violation that Oracle auditors specifically look for.
No. Database Vault is exclusively available on Oracle Database Enterprise Edition. It cannot be used on Standard Edition, Standard Edition 2, or Express Edition. If Database Vault is found enabled on a Standard Edition instance during an audit, Oracle will require the organisation to purchase a full Enterprise Edition licence ($47,500/processor) plus a Database Vault licence ($11,500/processor), potentially $380,000+ per server on a 2-socket/16-core system. Remove or disable Vault components on all non-Enterprise Edition installations.
If Database Vault is enabled at the container database (CDB) level, Oracle requires licensing the entire CDB, meaning all processors or named users for the full container, covering every pluggable database (PDB). You cannot licence individual PDBs separately for Database Vault. If only one PDB out of ten requires the option, you must still licence the entire CDB. The cost-effective approach: isolate Database Vault-requiring PDBs in their own dedicated CDB or use standalone non-CDB instances to minimise licensing scope.
Yes, in certain Oracle Cloud tiers. Database Vault is included at no additional cost in Oracle Cloud Database High Performance and Extreme Performance service tiers, and in all Autonomous Database editions. It is not included in the base/standard Oracle Cloud Database tier. For organisations with significant Database Vault requirements, migrating to Oracle Cloud High Performance or Autonomous Database eliminates the separate option licensing cost entirely, often making cloud migration the most cost-effective way to access Database Vault functionality.
Oracle's DBA_FEATURE_USAGE_STATISTICS view permanently records any activation of Database Vault, even if it was enabled briefly for testing and then disabled. During an Oracle audit, this historical usage will be flagged as a compliance finding. The organisation will be required to purchase back-dated licences (at current list price) plus back-dated support fees (22% per year for each year of unlicensed use). On an 8-processor server, this can result in $92,000+ in licence fees plus $20,240/year in retrospective support charges.
The most effective strategies: (1) Isolate Vault-requiring databases in dedicated containers or instances to avoid licensing unrelated PDBs (50 to 90% savings). (2) Evaluate NUP licensing for small user populations (60 to 85% cheaper than Processor for eligible deployments). (3) Right-size hardware to reduce core count on Vault-licensed servers. (4) Migrate to Oracle Cloud High Performance or Autonomous Database where Vault is included free. (5) Include Database Vault in a ULA/ELA for unlimited deployment rights (30 to 50% effective discount). (6) Disable and document any Vault deployments that are no longer actively required.
Not sure whether your Database Vault, Advanced Security, or other Oracle Database option deployments are fully compliant? Our licensing assessment identifies every Oracle option in use, quantifies compliance exposure, and develops optimisation strategies before Oracle's audit team does.
Oracle Licence ManagementIndependent licensing assessment. Option usage audit. Multitenant architecture review. Compliance verification. 100% vendor-independent.