Oracle Key Vault licensing: included or extra? A separate product, priced per server.

Oracle Key Vault is a separately licensed product at $100,000 per server, and it sits on top of the Advanced Security option every encrypting database already needs. Most small deployments manage keys with the wallet instead.

Is Oracle Key Vault included with Oracle Database, or licensed separately?

Oracle Key Vault (OKV) is a separate product with its own price. It does not ship as a feature of Enterprise Edition, and there is no free tier. The Oracle Technology Price List shows a license of $100,000.00 and annual software update license and support of $22,000.00, on a Per Server metric.

When a DBA or security architect says Key Vault is "included," they almost always mean wallet based key management, which is bought through a different line and covered below. For the other security products Oracle sells around the database, see our Oracle Database security options licensing guide.

Why the Per Server metric is unusual

Oracle licenses OKV per server installation, with no per processor charge. The licensing documentation also places no limit on the number of endpoints that connect to an OKV server, whether those are databases, application servers or clients storing secrets.

In 25 years of Oracle negotiations I have seen few metrics that favor the customer this clearly. Your bill depends on how many OKV servers you install. Adding databases behind those servers does not change it, so the design decision that matters is the server count.

What have we seen when companies buy or get audited on Key Vault?

The same few problems come up in Key Vault purchases and in the audits that follow them. Few of them concern the OKV price itself.

• The standby server is missing from the order. A project scopes one server, the engineers build the recommended pair, and the second server first appears at true up.
• Encryption goes live without a licensing check. A security team turns on TDE to satisfy a compliance requirement and never routes the request through license management.
• The larger exposure is Advanced Security. The expensive finding next to an OKV deployment is rarely OKV. It is Advanced Security in use on databases that never licensed it.
• Clusters add nodes and rarely shed them. Nodes get added for a new data center or cloud region, and we rarely see one retired, so support on the cluster rises year after year.

Do you need Key Vault for TDE, or is the Oracle Wallet enough?

For most single databases and small groups of databases, the wallet is enough. Transparent Data Encryption (TDE) needs a keystore for its master encryption key, and Oracle offers three choices. Only one of them is a separate product purchase.

• Oracle Wallet. A local PKCS #12 file keystore. Wallet based master key management comes with the Advanced Security license. It is not free, but if you already licensed Advanced Security for TDE, it adds nothing to the bill.
• Oracle Key Vault. A centralized keystore that speaks KMIP and PKCS #11. This is the product with its own per server price.
• OCI Key Management Service, or OCI Vault. A cloud service priced by consumption. It only matters if the database runs in OCI, and it is covered further down.

You choose the keystore. TDE works with the wallet or with Key Vault, and nothing in TDE forces you to buy OKV. Companies buy OKV when they want centralized, audited key management with high availability across many databases.

If the requirement is to encrypt one database at rest, the wallet already arrived with the Advanced Security option you had to buy anyway. Security teams often default to OKV because a reference architecture showed it. Ask them for the requirement first.

Why do you have to license Advanced Security before Key Vault?

Because TDE is an Advanced Security feature, and Advanced Security is an extra cost option on Enterprise Edition. Before Key Vault enters the discussion, every database that encrypts data at rest needs that option licensed.

What Advanced Security costs and covers

Advanced Security lists at $15,000 per processor, with $3,300 annual support, or $300 per Named User Plus with $66 support. It covers TDE for columns and tablespaces, Data Redaction, Data Pump export file encryption, RMAN backup encryption to disk and the encrypted database file system.

Oracle expects the option on the same metric and count as the database it runs on, as our note on matching option counts to database users explains.

Connecting a database to Key Vault uses Advanced Security

Storing TDE master keys in an external key manager is part of TDE, so connecting a database to OKV for its encryption keys consumes Advanced Security. You cannot buy OKV instead of the option.

Oracle assumes Advanced Security is licensed on every database that uses Key Vault for TDE keys, so centralized key management always costs two lines: the option per processor and Key Vault per server. Our guide to when TDE and redaction start costing you covers the option in detail.

Network encryption is no longer a paid item

Native network encryption, network data integrity and SSL/TLS were taken out of Advanced Security. The 19c licensing manual says they are available in all licensed editions of all supported releases. If a budget still carries network encryption as a cost, remove it. Encryption of data at rest through TDE remains an Advanced Security feature.

How many Key Vault licenses does a production deployment need?

Usually two at minimum. Oracle recommends a primary and a standby OKV server for high availability, and each is a server installation that needs its own license. One production deployment therefore comes to $200,000 at list, plus $44,000 a year in support.

Anyone who scoped OKV as one server has undercounted by half.

Classic HA pair or Multi-Master Cluster

Beyond the classic primary and standby pair, OKV supports a Multi-Master Cluster of 2 to 16 nodes, with at most 8 read/write pairs. It cannot be combined with the classic HA configuration, so you choose one topology. Every cluster node is a licensable server, so a 4 node cluster needs 4 licenses.

Each added node costs another $100,000 at list and $22,000 a year in support. Design the topology on paper before anyone builds it, and treat every new node as a purchase decision.

Support for Advanced Security is shown at the standard 22 percent of list. Your actual support ratio is on your ordering document, so check it there. Once HA and clustering are counted properly, a product priced per server with unlimited endpoints becomes a six figure line item.

A single production Key Vault deployment is two licenses. Budget the standby from the first quote.

What does Key Vault cost for a typical deployment?

It depends mostly on how many databases share the servers. The hypothetical example below shows why the same product can be good value for one company and poor value for another.

A worked example at list price

Say you run 18 production databases on hosts covered by 32 Enterprise Edition processor licenses, and a regulator now requires encryption at rest. The table prices each route at list, with five years of support and no annual increases.

You pay the Advanced Security line as soon as TDE is on, whichever keystore you pick. OKV is the optional part. Spread over 18 databases, the HA pair costs about $11,111 of license per database, which is easy to justify if it replaces 18 separately managed wallets.

How the answer changes with size

• A small deployment. Three databases on 4 processor licenses need $60,000 of Advanced Security and $13,200 a year of support. An OKV pair at $200,000 would cost more than three times the option it serves, roughly $66,667 of license per database.
• A large or spread out deployment. Hundreds of databases across data centers and clouds divide the same per server cost thinly. Here OKV usually justifies its price, and the open question is how many nodes you need.

What does the Key Vault license include, and what can you not use it for?

The OKV license includes restricted use rights to the full software stack underneath it. OKV installs as a software appliance on Oracle Linux, with an embedded Oracle Database Enterprise Edition that includes Advanced Security, Advanced Compression, Partitioning and Database Vault.

Every one of those components is licensed solely to run Key Vault, and none of them may be deployed for any other purpose.

• The risk. If a team notices Enterprise Edition and Database Vault inside the appliance and starts running other workloads on it, that is a license breach likely to become an audit finding.
• The cost outside the appliance. Our guides to Database Vault licensing and Advanced Compression licensing show what those options cost when licensed for general use.

The upgrade restriction in release 21.7

Starting with OKV release 21.7, systems upgraded from older releases cannot be added to Multi-Master Clusters. If you inherited OKV servers on an old release and now want clustering, you may need fresh installations instead of upgrades in place.

Build that into any migration plan. Running old and new servers side by side during a cutover can change how many licenses you need, and for how long.

When is centralized key management worth paying for?

When you have many databases, several clouds, or auditors who want central evidence of key custody. OKV now does far more than store TDE keys. The current documentation, Release 21.14 from 2026, covers clustering across OCI, Azure, AWS, Google Cloud and on premises data centers.

• Cloud enrollment. Automatic enrollment of cloud databases across OCI and Cloud@Customer.
• Rotation evidence. TDE master key visibility that identifies databases overdue for key rotation. Release 21.11 added the DB Activated TDE Master Encryption Keys report, which lists recently activated keys across the fleet.
• SSH keys. Central governance of SSH keys as well as database keys.

These are real governance features. OKV earns its per server price, usually doubled for HA, when you need central key custody, enforced rotation, separation of duties between DBAs and key administrators, and reports that show which database holds which key.

Why we would not enroll every encrypted database by default

Security architects often advise putting every encryption key into a central key manager as soon as TDE is on. We disagree with that as a default. With a handful of databases encrypting locally, the wallet does the job, and OKV adds two server licenses and their support for a tidier diagram.

Write down the reason for centralizing: scale, a named compliance control, or the risk of keys scattered across teams. If none applies, stay on wallets and revisit when the fleet grows. For meeting encryption requirements without buying more than you need, see meeting encryption mandates without overbuying.

Can OCI Vault or Autonomous Database replace a Key Vault license?

For databases that run in Oracle managed cloud services, often yes. You do not license Advanced Security separately there, and OCI KMS provides central key management without an OKV server.

• Autonomous Database. Includes nearly all database options, including Advanced Security and Database Vault, at no license cost beyond the service price, and TDE is on by default. Our Autonomous Database licensing guide covers what else changes.
• Exadata Cloud@Customer and Exadata Database Service. In license included mode, both include all Enterprise Edition options, Advanced Security among them.

How OCI Vault is priced

• Software protected keys. Free.
• HSM protected keys in a shared vault. $0.53 per key version, with the first 20 key versions free.
• Private Vault on a single tenant HSM. Priced per hour, with no charge per key version.
• OCI Dedicated KMS. $1.75 per HSM partition per hour, with a minimum of three partitions, so at least $5.25 an hour.

Shared HSM keys stay cheap at typical volumes. Say 18 databases each rotate their master key quarterly for three years, creating 216 HSM key versions. After the 20 free versions, 196 billable versions at $0.53 come to $103.88.

Oracle quotes the rate per key version, so check the billing period on your rate card. Even if all 196 were billed monthly for 36 months, the total would stay under $4,000.

What a dedicated HSM costs by comparison

Dedicated KMS is a running hourly charge. Three partitions for a full year is 8,760 hours at $5.25, or $45,990, more than the annual support on an OKV pair. Model your key version count and whether you need a single tenant HSM before assuming OKV on a virtual machine is cheaper.

For the wider cloud question, compare BYOL versus license included and the ExaCC OCPU model before moving workloads for the sake of key management.

How does Oracle find TDE and Key Vault usage in an audit?

Through DBA_FEATURE_USAGE_STATISTICS. The view records TDE and Data Redaction usage, and the collection tool used by Oracle's audit team (LMS, now called GLAS) reads it. When the auditor pulls that view, every database that ever used TDE is a potential Advanced Security shortfall at the full per processor list price.

Because OKV connectivity for TDE is an Advanced Security feature, a database enrolled in Key Vault shows up in the same records, whether or not license management approved it. Our note on GLAS and LMS explains who runs Oracle audits today.

How to check your own position

• Feature usage. Query DBA_FEATURE_USAGE_STATISTICS on every database, including test and development copies, for Transparent Data Encryption, Encrypted Tablespaces, Backup Encryption and Data Redaction, and note the first and last sample dates. Our note on running the feature usage report before the LMS script shows the method.
• Keystore type. V$ENCRYPTION_WALLET shows whether each database uses a file keystore or an external one, and the TDE_CONFIGURATION parameter shows whether OKV is configured.
• Key Vault endpoints. The Endpoints page in the OKV console lists every enrolled endpoint. Each database endpoint using OKV for TDE keys should map to an Advanced Security entitlement.
• Server count. Count every OKV installation, including the standby and every cluster node, and match it to per server licenses on your orders.

If you find features enabled that you never bought, act before any audit notice arrives. Read the audit finding you didn't buy. Also check Audit Vault and Database Firewall licensing, a different product with a different metric that is often confused with OKV in security purchasing.

What will Oracle's account team say about Key Vault, and how should you answer?

Expect the conversation to push toward more servers and toward treating Key Vault as the default. These are the lines we hear most often, with the reply we recommend.

• "Start with one server and add high availability later." Reply that production will run as a pair, so the quote should price two servers now, with the second at the same discount as the first.
• "Your compliance standard needs centralized key management." Ask which specific control the wallet fails to meet, and get your own auditor's answer on paper before accepting the account team's.
• "Buy a larger cluster now to allow for growth." Buy the nodes you will deploy this year. Negotiate a fixed price for future nodes instead of paying support on idle licenses.
• "Move to Autonomous Database and all of this is included." That is true for the options. Compare five years of Advanced Security and OKV support with the service cost of the workloads before moving databases for a key manager.

Contract wording to ask for

• Server count by role. List each OKV server as primary, standby or cluster node, so the order matches the topology and the standby is not later disputed.
• Price hold on added servers. Fix the unit price for further OKV servers for your planning period, because clusters grow after the first order.
• Support on net price. Confirm annual support is calculated at 22 percent of the net license fee you paid, not list.
• Restricted use confirmation. Record that the embedded Oracle Linux, database and options are covered by the OKV license for OKV use only, with no separate counting.
• Retirement terms. Ask in writing how support will be priced if you later retire a node, since Oracle's support policies allow repricing when part of a license set is dropped.

Our support renewal contract checklist covers the renewal side of these clauses.

What mistakes make Key Vault more expensive than it should be?

Most overspend on Key Vault traces back to four errors, each of which is cheap to avoid before the order and expensive after it.

1. Quoting one server. The standby then arrives as a separate purchase, often at a weaker discount, with its own support stream starting on a different date.
2. Encrypting test copies without licenses. Development and test databases need Advanced Security too, and TDE is often switched on there first.
3. Using the appliance database. Running any other workload on the embedded Enterprise Edition turns a restricted use right into an unlicensed deployment.
4. Upgrading old servers and planning a cluster later. After release 21.7, upgraded systems cannot join a Multi-Master Cluster, so the plan may need new installations.

If a renewal is coming, include this in a wider footprint review before renewal, so idle OKV servers and orphaned TDE usage are found by you first.

What to do next

1. This month. Run DBA_FEATURE_USAGE_STATISTICS on every database and reconcile each TDE and Data Redaction hit against your Advanced Security entitlements.
2. Count OKV servers. List every installation, including standby servers and cluster nodes, and match each to a per server license.
3. Record the keystore decision. Before any new encryption project, choose wallet or OKV deliberately and write down the reason.
4. Price both lines. Put Advanced Security per processor and OKV per server in the same business case, with five years of support.
5. Check cloud options. For databases already on Autonomous or license included Exadata, compare OCI Vault costs before extending OKV to them.
6. Negotiate the order. Ask for the server count by role, a price hold on added servers and support on net price before you sign.

Frequently asked questions