{ "data": { "similar": [ { "grade": "A", "json": "https://www.anchorterminal.com/tools/infisical.json", "name": "Infisical", "score": 83.7, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host" ], "slug": "infisical" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/hashicorp-vault.json", "name": "HashiCorp Vault + Vault MCP Server", "score": 64.2, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host" ], "slug": "hashicorp-vault" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/aws-secrets-manager.json", "name": "AWS Secrets Manager", "score": 77.7, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "aws-secrets-manager" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-secret-manager.json", "name": "Google Cloud Secret Manager", "score": 76.5, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "google-secret-manager" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/azure-key-vault.json", "name": "Azure Key Vault", "score": 74.7, "shared": [ "secrets.store", "secrets.machine-identity", "secrets.audit", "secrets.rotate" ], "slug": "azure-key-vault" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/akeyless.json", "name": "Akeyless (SecretlessAI and MCP server)", "score": 73.6, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "akeyless" } ], "tool": { "slug": "phase", "name": "Phase", "vendor": "Phi Security Inc.", "vendorUrl": "https://phase.dev", "kind": "http-api", "category": "secrets", "summary": "Phase is an open-source secrets manager from Phi Security Inc. with end-to-end encryption, service accounts, secret rotation and audit logs. Agents reach it through a REST API, a CLI and SDKs, on Phase Cloud or self-hosted.", "url": "https://www.anchorterminal.com/tools/phase", "markdownUrl": "https://www.anchorterminal.com/tools/phase.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/phase.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/phase.json", "repo": "https://github.com/phasehq/console", "license": "MIT outside the `ee/` directories, which are under the proprietary Phase Console Enterprise licence", "transports": [ "http" ], "remoteUrl": "https://api.phase.dev", "packages": [ { "registry": "npm", "name": "@phase.dev/phase-node" }, { "registry": "pypi", "name": "phase-dev" }, { "registry": "go", "name": "github.com/phasehq/golang-sdk" } ], "auth": "mixed", "authNotes": "Self-serve. A person signs in to the console with Google, GitHub or GitLab, creates a service account and a token with an optional expiry, and the agent sends it as `Authorization: Bearer ServiceAccount \u003ctoken\u003e`. Personal access tokens use `Bearer User \u003ctoken\u003e` and inherit the user's role. Tokens can also be created and deleted over the API for service accounts with server-side key management. Workloads on AWS or Azure can log in with an external identity and receive a token with a TTL. Access follows the account's role and its apps and environments, not the individual token.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 5 users or service accounts, 3 apps, 3 environments, 24-hour audit logs and 120 API requests a minute. Pro is $10 a user a month ($120 billed yearly) with a 14-day trial, unlimited apps, rotation, custom roles, network access policies, 90-day audit logs and 240 requests a minute. Enterprise is $25 a user a month ($300 yearly) with dynamic secrets, OIDC SSO, SCIM, log forwarding and a 99.99 per cent uptime SLA listed. Only human users are charged, and service accounts are free. The pricing page does not say whether a card is taken. Self-hosting the MIT core is free, and the Pro and Enterprise tiers need a licence (https://phase.dev/pricing/).", "priceSummary": "$10 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the API reference or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 928, "npmWeekly": 2485, "pypiWeekly": 235, "asOf": "2026-10-08" }, "docsUrl": "https://docs.phase.dev", "llmsTxt": "https://docs.phase.dev/llms.txt", "capabilities": [ "secrets.store", "secrets.machine-identity", "secrets.audit", "secrets.self-host", "secrets.rotate" ], "tags": [ "hosted", "self-hosted", "open-source", "freemium", "free-tier", "cli", "llms-txt", "go", "typescript", "python", "eu", "status-page", "soc2" ], "lastRelease": "2026-10-04", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 194, "ranked": true, "rankOf": 722, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 56, "maintenance": 83, "payments": 25, "reliability": 91, "schema": 58, "security": 83, "transparency": 73 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 91, "points": 18.2, "reason": "Graded as a hosted service, Phase Cloud. Atlassian Statuspage at phase.statuspage.io with components for the console and the API (20). No incident since 10 July 2026. The newest entries are an emergency database scaling on 30 June and a 50-minute partial API outage on 15 June 2026, both outside the 90 days (30). Rate limits published per plan, 120 requests a minute on Free and 240 on Pro, per account (15). A 429 carries a `retry-after` header and a duplicate create returns 409, but no idempotency keys or retry guidance for writes were found (11 of 15). The pricing page lists a 99.99 per cent uptime SLA on Enterprise. No SLA document was found and the terms carry no uptime commitment (5 of 10). The REST API and CLI are generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 58, "points": 9.43, "reason": "No OpenAPI or other machine-readable contract was found in the docs or the repositories (0). llms.txt at docs.phase.dev indexes Markdown copies of every page (10). The API reference describes each parameter and says when an endpoint refuses, such as rotating secrets rejecting `PUT` and the need for server-side encryption (14 of 20). Types, enums and required fields are given in prose only, and `lease_ttl` is typed as a boolean while described in seconds (9 of 15). Each of the 47 operations has curl, JavaScript and Python examples, and an errors page lists the status codes, with one free-text `error` field (12 of 15). Paths are versioned under `/v1`, with a public changelog of 39 entries and release notes on GitHub (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "`GET /v1/secrets` filters by path, key and tags, and the CLI skill is one document, but there is no field selection or names-only read (15 of 25). No pagination or limit parameter was found in the API reference (8 of 20). Status codes are documented with their causes, and the body is a single free-text `error` string with no code (12 of 20). No idempotency keys. A repeated create returns 409, and there is no MCP server to carry annotations (8 of 20). Reads need two parameters, `app_id` and `env`, and there are SDKs for Go, Node, Python and browser JS, the Node and Python ones last published in 2025 (13 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 83, "points": 14.53, "reason": "Service account tokens take an expiry, can be deleted, and inherit the account's role and its apps and environments. AWS IAM and Azure identities receive tokens with a TTL. Scope belongs to the account, not the token (27 of 30). A read-only Service role, custom roles and network access policies on Pro, write-only sealed secrets, and CLI guardrails that block `printenv` and `phase shell` for agents. No approval step for destructive calls was found in the docs (16 of 20). Secrets are not untrusted content, and the CLI masks values from agents (13 of 15). Every read is logged with actor and IP address, kept 24 hours on Free and 90 days on Pro (12 of 15). security.txt valid to 2030, a disclosure policy in `SECURITY.md`, SOC 2 Type II and yearly penetration tests claimed. No bug bounty was found, and GitHub advisories were not read (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "Graded on the hosted option. No x402, MPP or L402 (0). Plan prices are public at $10 and $25 a user a month, with no per-call price (10). A Free plan and 14-day trials. The pricing page does not say whether a card is taken (15 of 20). A person signs in to the console in a browser with Google, GitHub or GitLab before any token exists (0). Service accounts are free on every plan." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "Console v2.77.2 was released on 4 October 2026, four days before this check, and a v2.77.3 version bump was merged on 8 October (30). Eleven console versions between 24 July and 8 October 2026, and CLI v2.3.1 and v2.3.2 on 28 July and 20 September (20). 85 open issues and pull requests. Of the two newest issues, one had a pull request opened the next day and the other had no reply after one day. The sample is small (15 of 25). The Go SDK was bumped to v2.4.1 in September 2026, while `@phase.dev/phase-node` 3.2.0 dates from October 2025 and `phase-dev` 2.1.2 from April 2025 (9 of 15). CI passed on the default branch on 8 October and dependency update pull requests are open and current (9 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "note": "editorial 58, provenance 87", "reason": "MIT outside the `ee/` directories, with billing, licensing and some access and integration code under a proprietary enterprise licence (24 of 30). The privacy policy of 11 March 2026 covers the services but gives no retention period, and the subprocessor list sits in a trust centre our reader could not load. No DPA was found on the public pages (16 of 30). The terms allow products to be changed or discontinued with notice by email or on the site. No deprecation policy or dated notices were found (5 of 20). The hosting region (AWS eu-central-1) and egress IP addresses are published, and the docs say self-hosted instances send no usage telemetry. The subprocessor list was not read (13 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`GET /v1/secrets` filters by path, key and tags, and the CLI skill is one document, but there is no field selection or names-only read (15 of 25). No pagination or limit parameter was found in the API reference (8 of 20). Status codes are documented with their causes, and the body is a single free-text `error` string with no code (12 of 20). No idempotency keys. A repeated create returns 409, and there is no MCP server to carry annotations (8 of 20). Reads need two parameters, `app_id` and `env`, and there are SDKs for Go, Node, Python and browser JS, the Node and Python ones last published in 2025 (13 of 15).", "maintenance": "Console v2.77.2 was released on 4 October 2026, four days before this check, and a v2.77.3 version bump was merged on 8 October (30). Eleven console versions between 24 July and 8 October 2026, and CLI v2.3.1 and v2.3.2 on 28 July and 20 September (20). 85 open issues and pull requests. Of the two newest issues, one had a pull request opened the next day and the other had no reply after one day. The sample is small (15 of 25). The Go SDK was bumped to v2.4.1 in September 2026, while `@phase.dev/phase-node` 3.2.0 dates from October 2025 and `phase-dev` 2.1.2 from April 2025 (9 of 15). CI passed on the default branch on 8 October and dependency update pull requests are open and current (9 of 10).", "payments": "Graded on the hosted option. No x402, MPP or L402 (0). Plan prices are public at $10 and $25 a user a month, with no per-call price (10). A Free plan and 14-day trials. The pricing page does not say whether a card is taken (15 of 20). A person signs in to the console in a browser with Google, GitHub or GitLab before any token exists (0). Service accounts are free on every plan.", "reliability": "Graded as a hosted service, Phase Cloud. Atlassian Statuspage at phase.statuspage.io with components for the console and the API (20). No incident since 10 July 2026. The newest entries are an emergency database scaling on 30 June and a 50-minute partial API outage on 15 June 2026, both outside the 90 days (30). Rate limits published per plan, 120 requests a minute on Free and 240 on Pro, per account (15). A 429 carries a `retry-after` header and a duplicate create returns 409, but no idempotency keys or retry guidance for writes were found (11 of 15). The pricing page lists a 99.99 per cent uptime SLA on Enterprise. No SLA document was found and the terms carry no uptime commitment (5 of 10). The REST API and CLI are generally available (10).", "schema": "No OpenAPI or other machine-readable contract was found in the docs or the repositories (0). llms.txt at docs.phase.dev indexes Markdown copies of every page (10). The API reference describes each parameter and says when an endpoint refuses, such as rotating secrets rejecting `PUT` and the need for server-side encryption (14 of 20). Types, enums and required fields are given in prose only, and `lease_ttl` is typed as a boolean while described in seconds (9 of 15). Each of the 47 operations has curl, JavaScript and Python examples, and an errors page lists the status codes, with one free-text `error` field (12 of 15). Paths are versioned under `/v1`, with a public changelog of 39 entries and release notes on GitHub (13 of 15).", "security": "Service account tokens take an expiry, can be deleted, and inherit the account's role and its apps and environments. AWS IAM and Azure identities receive tokens with a TTL. Scope belongs to the account, not the token (27 of 30). A read-only Service role, custom roles and network access policies on Pro, write-only sealed secrets, and CLI guardrails that block `printenv` and `phase shell` for agents. No approval step for destructive calls was found in the docs (16 of 20). Secrets are not untrusted content, and the CLI masks values from agents (13 of 15). Every read is logged with actor and IP address, kept 24 hours on Free and 90 days on Pro (12 of 15). security.txt valid to 2030, a disclosure policy in `SECURITY.md`, SOC 2 Type II and yearly penetration tests claimed. No bug bounty was found, and GitHub advisories were not read (15 of 20).", "transparency": "MIT outside the `ee/` directories, with billing, licensing and some access and integration code under a proprietary enterprise licence (24 of 30). The privacy policy of 11 March 2026 covers the services but gives no retention period, and the subprocessor list sits in a trust centre our reader could not load. No DPA was found on the public pages (16 of 30). The terms allow products to be changed or discontinued with notice by email or on the site. No deprecation policy or dated notices were found (5 of 20). The hosting region (AWS eu-central-1) and egress IP addresses are published, and the docs say self-hosted instances send no usage telemetry. The subprocessor list was not read (13 of 20)." }, "sources": [ { "what": "pricing page", "url": "https://phase.dev/pricing/", "seen": "2026-10-08" }, { "what": "API overview, authentication and rate limits", "url": "https://docs.phase.dev/public-api", "seen": "2026-10-08" }, { "what": "secrets API reference", "url": "https://docs.phase.dev/public-api/secrets", "seen": "2026-10-08" }, { "what": "service accounts API reference", "url": "https://docs.phase.dev/public-api/service-accounts", "seen": "2026-10-08" }, { "what": "API errors", "url": "https://docs.phase.dev/public-api/errors", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://docs.phase.dev/llms.txt", "seen": "2026-10-08" }, { "what": "docs source, read from a clone", "url": "https://github.com/phasehq/docs", "seen": "2026-10-08" }, { "what": "Claude Code integration", "url": "https://docs.phase.dev/integrations/agents/claude-code", "seen": "2026-10-08" }, { "what": "external identities", "url": "https://docs.phase.dev/access-control/external-identities", "seen": "2026-10-08" }, { "what": "rotating secrets", "url": "https://docs.phase.dev/console/rotating-secrets", "seen": "2026-10-08" }, { "what": "security overview", "url": "https://docs.phase.dev/security", "seen": "2026-10-08" }, { "what": "token architecture", "url": "https://docs.phase.dev/security/architecture", "seen": "2026-10-08" }, { "what": "status incident history", "url": "https://phase.statuspage.io/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://phase.dev/legal/terms/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://phase.dev/legal/privacy/", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://phase.dev/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "changelog", "url": "https://phase.dev/changelog/", "seen": "2026-10-08" }, { "what": "console repository, licence, releases and CI", "url": "https://github.com/phasehq/console", "seen": "2026-10-08" }, { "what": "CLI repository and tags", "url": "https://github.com/phasehq/cli", "seen": "2026-10-08" }, { "what": "npm registry", "url": "https://registry.npmjs.org/@phase.dev%2Fphase-node", "seen": "2026-10-08" }, { "what": "PyPI", "url": "https://pypi.org/pypi/phase-dev/json", "seen": "2026-10-08" }, { "what": "home page", "url": "https://phase.dev/", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: trust.phase.dev is drawn by script and returned no text, so the subprocessor list, any DPA and the SOC 2 details were not read.", "unchecked: GitHub security advisories for phasehq/console were not read.", "unchecked: whether signing up for the Free plan or a trial takes a card. The pricing page does not say.", "The Phase Agents Relay credential proxy is listed as included on every plan, but no docs page, CLI command or merged code for it was found on 8 October 2026.", "The lead gave the vendor as Phase. The terms and the licence name Phi Security Inc.", "No SLA document was found behind the 99.99 per cent figure on the Enterprise plan.", "Issue responsiveness was judged from two recent issues only." ] }, "negative": 0, "verdict": "Service account tokens can be minted with an expiry over the API, every secret read is logged, and the CLI redacts values when it detects an AI agent. No OpenAPI document or pagination was found in the reviewed documentation, and the Free plan keeps audit logs for 24 hours.", "bestFor": "Small teams that want an open-source secrets manager hosted in the EU or self-hosted, with coding agents kept away from values through the CLI.", "strengths": [ "Service account tokens take an expiry and can be created and deleted through `/v1/service-accounts/:id/tokens`, and service accounts are free on every plan", "The CLI's AI mode redacts `secret` and `sealed` values and blocks `printenv`, `env` and `phase shell` when it detects an agent", "Every reveal and every REST fetch of a secret is recorded as a `READ` event with actor and IP address", "MIT outside the `ee/` directories, self-hosted with Docker Compose or Kubernetes, with no outbound usage telemetry per the docs", "Eleven console versions between 24 July and 8 October 2026, and no incident on the status page since 30 June 2026" ], "weaknesses": [ "No OpenAPI document was found. The REST reference is prose with examples, covering 47 operations", "No pagination, field selection or idempotency keys were found in the API reference, and errors are a single free-text `error` string", "The Free plan keeps audit logs for 24 hours. Rotation, custom roles and network access policies need Pro, and dynamic secrets need Enterprise", "The REST API works only on apps with server-side encryption enabled, which gives up end-to-end encryption for that app", "The pricing page lists a Phase Agents Relay credential proxy on every plan, but no documentation or CLI command for it was found" ], "agentNotes": [ "Enable server-side encryption on the app before calling `/v1/secrets`. Without it the REST API cannot read or write that app's secrets", "Send `Authorization: Bearer ServiceAccount \u003ctoken\u003e` for a service account and `Bearer User \u003ctoken\u003e` for a personal access token. The token type is part of the header", "Stay under 120 requests a minute per account on Free and 240 on Pro, and wait the seconds in the `retry-after` header on a 429", "Treat a 409 on `POST /v1/secrets` as the key already existing at that path, and use `PUT` to change it. Rotating secrets reject `PUT` and `DELETE`", "Have a person run `phase ai enable` and choose masked values. The CLI blocks an agent from running `phase ai enable` or `phase ai disable` itself" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 56, "maintenance": 83, "payments": 25, "reliability": 91, "schema": 58, "security": 83, "transparency": 58 }, "provenanceScore": 87 }, "connect": { "install": "curl -fsSL https://pkg.phase.dev/install.sh | sh # or: brew tap phasehq/cli \u0026\u0026 brew install phase", "http": "curl -G https://api.phase.dev/v1/secrets/ -H \"Authorization: Bearer ServiceAccount $PHASE_TOKEN\" \\\n -d app_id=$PHASE_APP_ID -d env=development", "claudeCode": "phase ai enable" }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/phase" }, "notable": [ "The REST API covers 47 documented operations under `/v1` for secrets, dynamic secret leases, apps, environments, roles, service accounts, members, invites, teams and external identity login (https://docs.phase.dev/public-api)", "REST access to secrets needs server-side encryption enabled per app. The CLI, SDKs and Kubernetes operator decrypt on the client with key material carried in the token (https://docs.phase.dev/public-api, https://docs.phase.dev/security/architecture)", "`phase ai enable` installs a skill document for Claude Code, Cursor, VS Code Copilot, Codex or OpenCode. Secrets have three types, `config` always visible to the agent, `secret` masked by choice and `sealed` never shown (https://docs.phase.dev/integrations/agents/claude-code)", "External identities let a workload log in with a signed AWS STS GetCallerIdentity request or an Azure managed identity token and receive an access token with a TTL (https://docs.phase.dev/access-control/external-identities)", "Rotating secrets mint a new credential on a schedule and revoke the old one after a set delay. The supported providers are LiteLLM and OpenAI, and the feature is on Pro and Enterprise (https://docs.phase.dev/console/rotating-secrets, https://phase.dev/pricing/)", "Dynamic secrets lease short-lived credentials on demand. AWS IAM is the one provider listed, and the feature needs the Enterprise tier (https://docs.phase.dev/console/dynamic-secrets)", "Phase Cloud runs on AWS in eu-central-1 (Frankfurt), per the pricing page's FAQ, and the status page lists the AWS components for that region (https://phase.dev/pricing/, https://phase.statuspage.io)", "The terms of service (last updated 6 October 2025) forbid use of the services for competitive analysis or to build competitive products. Recorded as a fact (https://phase.dev/legal/terms/)", "The home page and pricing page describe an AI egress proxy that swaps decoy credentials for real ones (Phase Agents Relay). No docs page, CLI command or merged code for it was found on 8 October 2026, and pull request #1025 \"feat: AI Agents\" was open (https://phase.dev/, https://github.com/phasehq/console)" ], "area": "agent-runtime", "details": [ { "label": "Surface graded", "value": "Phase Cloud's REST API at `https://api.phase.dev` and the Phase CLI. There is no MCP server. Self-hosted instances serve the same API at `/service/public`" }, { "label": "Free tier", "value": "5 users or service accounts, 3 apps, 3 environments, 24-hour audit logs, 120 requests a minute" }, { "label": "Paid plans", "value": "Pro $10 and Enterprise $25 a user a month, 14-day trial, service accounts free" }, { "label": "Rate limits", "value": "Free 120 and Pro 240 requests a minute per account, Enterprise custom, 429 with `retry-after`. Self-hosted has none by default" }, { "label": "Machine identity", "value": "Service accounts with expiring tokens, AWS IAM and Azure external identities, network access policies on Pro" }, { "label": "Agent integration", "value": "`phase ai enable` installs a skill for Claude Code, Cursor, VS Code Copilot, Codex and OpenCode, with value masking" }, { "label": "SDKs", "value": "Go (`github.com/phasehq/golang-sdk`), Node (`@phase.dev/phase-node` 3.2.0, October 2025), Python (`phase-dev` 2.1.2, April 2025), browser JS" }, { "label": "Hosting", "value": "Phase Cloud on AWS eu-central-1 (Frankfurt), or self-hosted with Docker Compose, Kubernetes, AWS, Azure, GCP or Railway" }, { "label": "Audit logs", "value": "Free 24 hours, Pro 90 days, Enterprise custom with log streams to Datadog" } ], "unitPrices": [ { "item": "Pro plan", "unit": "seat-month", "usd": 10, "note": "$120 a user billed yearly. Service accounts free" }, { "item": "Enterprise plan", "unit": "seat-month", "usd": 25, "note": "$300 a user billed yearly" } ], "provenance": { "legalEntity": "Phi Security Inc.", "domain": "phase.dev", "domainRegistered": "2023-02-03", "endpointOnVendorDomain": true, "terms": "https://phase.dev/legal/terms/", "privacy": "https://phase.dev/legal/privacy/", "statusPage": "https://phase.statuspage.io", "changelog": "https://phase.dev/changelog/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The terms of service (last updated 6 October 2025) name Phi Security Inc. and cover the website, the Phase Console and the self-hosted version. The site footer gives 8 The Green, Ste A, Dover, DE 19901, United States.", "The privacy policy (last updated 11 March 2026) covers phase.dev and the services, gives no retention period in days and refers to the trust centre for the subprocessor list.", "security.txt at phase.dev expires on 10 December 2030, lists three contact addresses and points to `SECURITY.md` in the console repository.", "trust.phase.dev is drawn by script and gave our reader no text, so the subprocessor list and any DPA were not read.", "RDAP for phase.dev gives a registration date of 2023-02-03.", "The status page is an Atlassian Statuspage at phase.statuspage.io with components for the console, the API, Cloudflare and AWS eu-central-1." ], "score": 87, "checks": [ { "check": "Legal entity named", "value": "Phi Security Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "phase.dev, registered 2023-02-03 (3 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "api.phase.dev", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "phase.statuspage.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://phase.dev/legal/terms/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-10-06", "words": 5715, "points": 6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: October 6, 2025", "says": "Last updated 2025-10-06" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "If a court of competent jurisdiction finds any provision of these Terms to be invalid, the parties agree that the court should endeavor to give effect, to the maximum extent permitted by law, to the parties' intentions as reflected in the provision, and the other provisions of these Terms will remain in full force and…" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "11.2 IN NO EVENT WILL Phase OR SUPPLIERS' TOTAL LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR FROM THE USE OF OR INABILITY TO USE THE SERVICES EXCEED THE AMOUNTS YOU HAVE PAID TO Phase IN THE PRECEDING TWELVE (12) MONTHS FOR THE SERVICES.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Phase may terminate your license if you breach any material term of these Terms and fail to cure such breach within thirty (30) days after receipt of written notice." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Any notices or other communications provided by Phase under these Terms, including those regarding modifications to these Terms, will be given by Phase: (i) via e-mail;", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not agree to this Agreement, you may not utilize, access, or submit information to the Services." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Service credits may be issued at Phase's sole discretion in cases where: (a) Phase fails to meet its service level commitments as specified in a separate service level agreement, if applicable;" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "using \"bots\" or other automated systems to send requests to our servers at a rate beyond what could be sent by a human user during the same period of time).", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "The use of the Services for competitive analysis or to build competitive products.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Phase may revoke this license at any time, in its sole discretion." } ], "notes": [ { "date": "2026-10-08", "text": "Phase may name the customer and use its logo on its website and in marketing, and the customer may revoke this by email.", "quote": "You agree that Phase may use your company name, logo, and other public information to identify you as a customer on our website and in other marketing materials." }, { "date": "2026-10-08", "text": "No cash refunds are given, and any compensation is issued as service credits against future fees.", "quote": "Phase does not provide cash refunds for any subscriptions, services, or licenses purchased." }, { "date": "2026-10-08", "text": "Claims must be filed within one year of arising, except privacy claims and claims by New Jersey residents.", "quote": "any claim or cause of action arising out of or related to the use of the Services and/or these Terms must be filed within the period of one (1) year after such claim or cause of action arose or be forever barred." } ] }, { "kind": "privacy", "url": "https://phase.dev/legal/privacy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-03-11", "words": 4325, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: 11th March 2026", "says": "Last updated 2026-03-11" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We may collect, use, store and transfer different kinds of personal data:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain your Personal Data as long as we are providing the Services to you." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We will collect Personal Data when you voluntarily provide it to us (including to our service providers or other parties who collect it on our behalf)." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Phase does not sell or rent Personal Data to marketers or unaffiliated third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "This policy also describes how we use your data, with whom we share it, your rights \u0026 choices, and how you can contact us about our privacy practices." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "This policy also describes how we use your data, with whom we share it, your rights \u0026 choices, and how you can contact us about our privacy practices." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "Recorded calls may be used to identify a person by voice for support and security investigations.", "quote": "Call recording data may also be used to authenticate or identify you based on your voice to enable Phase to provide support services and investigate security incidents." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/phase.json", "live": { "slug": "phase", "probe": { "target": "https://api.phase.dev", "method": "get", "lastAt": "2026-10-08T21:41:46.52927519Z", "lastOk": true, "lastStatus": 200, "lastMs": 136, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 126, "p95ms24h": 199, "samples24h": 26, "samples30d": 26, "days": [ { "date": "2026-10-08", "probes": 26, "ok": 26 } ] }, "vendorStatus": { "page": "https://phase.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T21:36:44.315351229Z" }, "updatedAt": "2026-10-08T21:41:46.52927519Z" } }, "verify": { "accepts": "a page on phase.dev or one of its subdomains, or the README of github.com/phasehq/console", "badgeUrl": "https://www.anchorterminal.com/badges/phase.svg", "body": { "slug": "phase", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/phase", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/phase\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/phase.svg\" alt=\"Phase on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Phase on Anchor Terminal](https://www.anchorterminal.com/badges/phase.svg)](https://www.anchorterminal.com/tools/phase)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/phase\"\u003ePhase on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/phase", "json": "https://www.anchorterminal.com/tools/phase.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/phase.md", "slim": "https://www.anchorterminal.com/tools/phase.min.md" }, "markdown": "## Overview\n\n**Grade B · 68/100 · rank #194 of 722 · #10 in Secrets \u0026 credential vaults · not agent-ready · confidence medium**\n\n\n## Assessment\n\nService account tokens can be minted with an expiry over the API, every secret read is logged, and the CLI redacts values when it detects an AI agent. No OpenAPI document or pagination was found in the reviewed documentation, and the Free plan keeps audit logs for 24 hours.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Phi Security Inc. (https://phase.dev) |\n| Kind | HTTP API |\n| Category | Secrets \u0026 credential vaults (https://www.anchorterminal.com/categories/secrets) |\n| Transport | HTTP |\n| Endpoint | `https://api.phase.dev` |\n| Auth | OAuth or key · Self-serve. A person signs in to the console with Google, GitHub or GitLab, creates a service account and a token with an optional expiry, and the agent sends it as `Authorization: Bearer ServiceAccount \u003ctoken\u003e`. Personal access tokens use `Bearer User \u003ctoken\u003e` and inherit the user's role. Tokens can also be created and deleted over the API for service accounts with server-side key management. Workloads on AWS or Azure can log in with an external identity and receive a token with a TTL. Access follows the account's role and its apps and environments, not the individual token. |\n| Pricing | Freemium ($10 / seat-mo) · Free plan at $0 with 5 users or service accounts, 3 apps, 3 environments, 24-hour audit logs and 120 API requests a minute. Pro is $10 a user a month ($120 billed yearly) with a 14-day trial, unlimited apps, rotation, custom roles, network access policies, 90-day audit logs and 240 requests a minute. Enterprise is $25 a user a month ($300 yearly) with dynamic secrets, OIDC SSO, SCIM, log forwarding and a 99.99 per cent uptime SLA listed. Only human users are charged, and service accounts are free. The pricing page does not say whether a card is taken. Self-hosting the MIT core is free, and the Pro and Enterprise tiers need a licence (https://phase.dev/pricing/). |\n| x402 | No · No x402, MPP or L402 in the docs, the API reference or the pricing page (checked 2026-10-08). |\n| Licence | MIT outside the `ee/` directories, which are under the proprietary Phase Console Enterprise licence |\n| Packages | npm: `@phase.dev/phase-node`; pypi: `phase-dev`; go: `github.com/phasehq/golang-sdk` |\n| Source | https://github.com/phasehq/console |\n| Docs | https://docs.phase.dev |\n| llms.txt | https://docs.phase.dev/llms.txt |\n| Last release | 2026-10-04 |\n| GitHub stars | 928 (as of 2026-10-08) |\n| npm downloads / week | 2,485 |\n| PyPI downloads / week | 235 |\n| Surface graded | Phase Cloud's REST API at `https://api.phase.dev` and the Phase CLI. There is no MCP server. Self-hosted instances serve the same API at `/service/public` |\n| Free tier | 5 users or service accounts, 3 apps, 3 environments, 24-hour audit logs, 120 requests a minute |\n| Paid plans | Pro $10 and Enterprise $25 a user a month, 14-day trial, service accounts free |\n| Rate limits | Free 120 and Pro 240 requests a minute per account, Enterprise custom, 429 with `retry-after`. Self-hosted has none by default |\n| Machine identity | Service accounts with expiring tokens, AWS IAM and Azure external identities, network access policies on Pro |\n| Agent integration | `phase ai enable` installs a skill for Claude Code, Cursor, VS Code Copilot, Codex and OpenCode, with value masking |\n| SDKs | Go (`github.com/phasehq/golang-sdk`), Node (`@phase.dev/phase-node` 3.2.0, October 2025), Python (`phase-dev` 2.1.2, April 2025), browser JS |\n| Hosting | Phase Cloud on AWS eu-central-1 (Frankfurt), or self-hosted with Docker Compose, Kubernetes, AWS, Azure, GCP or Railway |\n| Audit logs | Free 24 hours, Pro 90 days, Enterprise custom with log streams to Datadog |\n| Capabilities | secrets.store, secrets.machine-identity, secrets.audit, secrets.self-host, secrets.rotate |\n| Tags | hosted, self-hosted, open-source, freemium, free-tier, cli, llms-txt, go, typescript, python, eu, status-page, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/phase.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 91 | 18.2 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 58 | 9.4 |\n| Agent ergonomics | 13% | 16.2 | 56 | 9.1 |\n| Security \u0026 auth | 14% | 17.5 | 83 | 14.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 25 | 3.1 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 83 | 7.3 |\n| Transparency \u0026 trust (editorial 58, provenance 87) | 7% | 8.8 | 73 | 6.4 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **68 → B** |\n\n### Why each score\n\n- Reliability 91: Graded as a hosted service, Phase Cloud. Atlassian Statuspage at phase.statuspage.io with components for the console and the API (20). No incident since 10 July 2026. The newest entries are an emergency database scaling on 30 June and a 50-minute partial API outage on 15 June 2026, both outside the 90 days (30). Rate limits published per plan, 120 requests a minute on Free and 240 on Pro, per account (15). A 429 carries a `retry-after` header and a duplicate create returns 409, but no idempotency keys or retry guidance for writes were found (11 of 15). The pricing page lists a 99.99 per cent uptime SLA on Enterprise. No SLA document was found and the terms carry no uptime commitment (5 of 10). The REST API and CLI are generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 58: No OpenAPI or other machine-readable contract was found in the docs or the repositories (0). llms.txt at docs.phase.dev indexes Markdown copies of every page (10). The API reference describes each parameter and says when an endpoint refuses, such as rotating secrets rejecting `PUT` and the need for server-side encryption (14 of 20). Types, enums and required fields are given in prose only, and `lease_ttl` is typed as a boolean while described in seconds (9 of 15). Each of the 47 operations has curl, JavaScript and Python examples, and an errors page lists the status codes, with one free-text `error` field (12 of 15). Paths are versioned under `/v1`, with a public changelog of 39 entries and release notes on GitHub (13 of 15).\n- Agent ergonomics 56: `GET /v1/secrets` filters by path, key and tags, and the CLI skill is one document, but there is no field selection or names-only read (15 of 25). No pagination or limit parameter was found in the API reference (8 of 20). Status codes are documented with their causes, and the body is a single free-text `error` string with no code (12 of 20). No idempotency keys. A repeated create returns 409, and there is no MCP server to carry annotations (8 of 20). Reads need two parameters, `app_id` and `env`, and there are SDKs for Go, Node, Python and browser JS, the Node and Python ones last published in 2025 (13 of 15).\n- Security \u0026 auth 83: Service account tokens take an expiry, can be deleted, and inherit the account's role and its apps and environments. AWS IAM and Azure identities receive tokens with a TTL. Scope belongs to the account, not the token (27 of 30). A read-only Service role, custom roles and network access policies on Pro, write-only sealed secrets, and CLI guardrails that block `printenv` and `phase shell` for agents. No approval step for destructive calls was found in the docs (16 of 20). Secrets are not untrusted content, and the CLI masks values from agents (13 of 15). Every read is logged with actor and IP address, kept 24 hours on Free and 90 days on Pro (12 of 15). security.txt valid to 2030, a disclosure policy in `SECURITY.md`, SOC 2 Type II and yearly penetration tests claimed. No bug bounty was found, and GitHub advisories were not read (15 of 20).\n- Payments \u0026 pricing 25: Graded on the hosted option. No x402, MPP or L402 (0). Plan prices are public at $10 and $25 a user a month, with no per-call price (10). A Free plan and 14-day trials. The pricing page does not say whether a card is taken (15 of 20). A person signs in to the console in a browser with Google, GitHub or GitLab before any token exists (0). Service accounts are free on every plan.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 83: Console v2.77.2 was released on 4 October 2026, four days before this check, and a v2.77.3 version bump was merged on 8 October (30). Eleven console versions between 24 July and 8 October 2026, and CLI v2.3.1 and v2.3.2 on 28 July and 20 September (20). 85 open issues and pull requests. Of the two newest issues, one had a pull request opened the next day and the other had no reply after one day. The sample is small (15 of 25). The Go SDK was bumped to v2.4.1 in September 2026, while `@phase.dev/phase-node` 3.2.0 dates from October 2025 and `phase-dev` 2.1.2 from April 2025 (9 of 15). CI passed on the default branch on 8 October and dependency update pull requests are open and current (9 of 10).\n- Transparency \u0026 trust 73: MIT outside the `ee/` directories, with billing, licensing and some access and integration code under a proprietary enterprise licence (24 of 30). The privacy policy of 11 March 2026 covers the services but gives no retention period, and the subprocessor list sits in a trust centre our reader could not load. No DPA was found on the public pages (16 of 30). The terms allow products to be changed or discontinued with notice by email or on the site. No deprecation policy or dated notices were found (5 of 20). The hosting region (AWS eu-central-1) and egress IP addresses are published, and the docs say self-hosted instances send no usage telemetry. The subprocessor list was not read (13 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/phase.md (JSON https://www.anchorterminal.com/fixes/phase.json)\n\n### What we couldn't check\n\n- unchecked: trust.phase.dev is drawn by script and returned no text, so the subprocessor list, any DPA and the SOC 2 details were not read.\n- unchecked: GitHub security advisories for phasehq/console were not read.\n- unchecked: whether signing up for the Free plan or a trial takes a card. The pricing page does not say.\n- The Phase Agents Relay credential proxy is listed as included on every plan, but no docs page, CLI command or merged code for it was found on 8 October 2026.\n- The lead gave the vendor as Phase. The terms and the licence name Phi Security Inc.\n- No SLA document was found behind the 99.99 per cent figure on the Enterprise plan.\n- Issue responsiveness was judged from two recent issues only.\n\n### Sources\n\n- pricing page: \u003chttps://phase.dev/pricing/\u003e (seen 2026-10-08)\n- API overview, authentication and rate limits: \u003chttps://docs.phase.dev/public-api\u003e (seen 2026-10-08)\n- secrets API reference: \u003chttps://docs.phase.dev/public-api/secrets\u003e (seen 2026-10-08)\n- service accounts API reference: \u003chttps://docs.phase.dev/public-api/service-accounts\u003e (seen 2026-10-08)\n- API errors: \u003chttps://docs.phase.dev/public-api/errors\u003e (seen 2026-10-08)\n- llms.txt: \u003chttps://docs.phase.dev/llms.txt\u003e (seen 2026-10-08)\n- docs source, read from a clone: \u003chttps://github.com/phasehq/docs\u003e (seen 2026-10-08)\n- Claude Code integration: \u003chttps://docs.phase.dev/integrations/agents/claude-code\u003e (seen 2026-10-08)\n- external identities: \u003chttps://docs.phase.dev/access-control/external-identities\u003e (seen 2026-10-08)\n- rotating secrets: \u003chttps://docs.phase.dev/console/rotating-secrets\u003e (seen 2026-10-08)\n- security overview: \u003chttps://docs.phase.dev/security\u003e (seen 2026-10-08)\n- token architecture: \u003chttps://docs.phase.dev/security/architecture\u003e (seen 2026-10-08)\n- status incident history: \u003chttps://phase.statuspage.io/api/v2/incidents.json\u003e (seen 2026-10-08)\n- terms of service: \u003chttps://phase.dev/legal/terms/\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://phase.dev/legal/privacy/\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://phase.dev/.well-known/security.txt\u003e (seen 2026-10-08)\n- changelog: \u003chttps://phase.dev/changelog/\u003e (seen 2026-10-08)\n- console repository, licence, releases and CI: \u003chttps://github.com/phasehq/console\u003e (seen 2026-10-08)\n- CLI repository and tags: \u003chttps://github.com/phasehq/cli\u003e (seen 2026-10-08)\n- npm registry: \u003chttps://registry.npmjs.org/@phase.dev%2Fphase-node\u003e (seen 2026-10-08)\n- PyPI: \u003chttps://pypi.org/pypi/phase-dev/json\u003e (seen 2026-10-08)\n- home page: \u003chttps://phase.dev/\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 87/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Phi Security Inc. | 20/20 |\n| Domain age | phase.dev, registered 2023-02-03 (3 years) | 7/15 |\n| Endpoint on the vendor's domain | api.phase.dev | 15/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points | 6/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | phase.statuspage.io | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe terms of service (last updated 6 October 2025) name Phi Security Inc. and cover the website, the Phase Console and the self-hosted version. The site footer gives 8 The Green, Ste A, Dover, DE 19901, United States.\n\nThe privacy policy (last updated 11 March 2026) covers phase.dev and the services, gives no retention period in days and refers to the trust centre for the subprocessor list.\n\nsecurity.txt at phase.dev expires on 10 December 2030, lists three contact addresses and points to `SECURITY.md` in the console repository.\n\ntrust.phase.dev is drawn by script and gave our reader no text, so the subprocessor list and any DPA were not read.\n\nRDAP for phase.dev gives a registration date of 2023-02-03.\n\nThe status page is an Atlassian Statuspage at phase.statuspage.io with components for the console, the API, Cloudflare and AWS eu-central-1.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://phase.dev/legal/terms/), read 2026-10-08, dated 2025-10-06, states 7 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"using \"bots\" or other automated systems to send requests to our servers at a rate beyond what could be sent by a human user during the same period of time).\"\n- To know. Restricts benchmarking or competitive use (costs points). \"The use of the Services for competitive analysis or to build competitive products.\"\n- To know. Says access can be ended without notice or for any reason. \"Phase may revoke this license at any time, in its sole discretion.\"\n- Gives the date it was last updated. Last updated 2025-10-06.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Also in the text (2026-10-08). Phase may name the customer and use its logo on its website and in marketing, and the customer may revoke this by email. \"You agree that Phase may use your company name, logo, and other public information to identify you as a customer on our website and in other marketing materials.\"\n- Also in the text (2026-10-08). No cash refunds are given, and any compensation is issued as service credits against future fees. \"Phase does not provide cash refunds for any subscriptions, services, or licenses purchased.\"\n- Also in the text (2026-10-08). Claims must be filed within one year of arising, except privacy claims and claims by New Jersey residents. \"any claim or cause of action arising out of or related to the use of the Services and/or these Terms must be filed within the period of one (1) year after such claim or cause of action arose or be forever barred.\"\n\n**Privacy policy** (https://phase.dev/legal/privacy/), read 2026-10-08, dated 2026-03-11, states 7 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-03-11.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Not found in the text. Says where data is transferred or stored.\n- Also in the text (2026-10-08). Recorded calls may be used to identify a person by voice for support and security investigations. \"Call recording data may also be used to authenticate or identify you based on your voice to enable Phase to provide support services and investigate security incidents.\"\n\n## Live (updated 2026-10-08 21:41 UTC)\n\n- Right now: up, HTTP 200, 136 ms, checked 2026-10-08 21:41 UTC (get on `https://api.phase.dev`)\n- Uptime 24h 100.0% (26 probes) · 30 days 100.0% (26 probes) · p50 126 ms · p95 199 ms\n- Vendor status page: none, All Systems Operational\n- Always current: https://www.anchorterminal.com/api/v1/live/phase.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Pro plan | $10 | per seat per month | $120 a user billed yearly. Service accounts free |\n| Enterprise plan | $25 | per seat per month | $300 a user billed yearly |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Service account tokens take an expiry and can be created and deleted through `/v1/service-accounts/:id/tokens`, and service accounts are free on every plan\n- The CLI's AI mode redacts `secret` and `sealed` values and blocks `printenv`, `env` and `phase shell` when it detects an agent\n- Every reveal and every REST fetch of a secret is recorded as a `READ` event with actor and IP address\n- MIT outside the `ee/` directories, self-hosted with Docker Compose or Kubernetes, with no outbound usage telemetry per the docs\n- Eleven console versions between 24 July and 8 October 2026, and no incident on the status page since 30 June 2026\n\n## Weaknesses\n\n- No OpenAPI document was found. The REST reference is prose with examples, covering 47 operations\n- No pagination, field selection or idempotency keys were found in the API reference, and errors are a single free-text `error` string\n- The Free plan keeps audit logs for 24 hours. Rotation, custom roles and network access policies need Pro, and dynamic secrets need Enterprise\n- The REST API works only on apps with server-side encryption enabled, which gives up end-to-end encryption for that app\n- The pricing page lists a Phase Agents Relay credential proxy on every plan, but no documentation or CLI command for it was found\n\n## Before you call it (notes for agents)\n\n1. Enable server-side encryption on the app before calling `/v1/secrets`. Without it the REST API cannot read or write that app's secrets\n2. Send `Authorization: Bearer ServiceAccount \u003ctoken\u003e` for a service account and `Bearer User \u003ctoken\u003e` for a personal access token. The token type is part of the header\n3. Stay under 120 requests a minute per account on Free and 240 on Pro, and wait the seconds in the `retry-after` header on a 429\n4. Treat a 409 on `POST /v1/secrets` as the key already existing at that path, and use `PUT` to change it. Rotating secrets reject `PUT` and `DELETE`\n5. Have a person run `phase ai enable` and choose masked values. The CLI blocks an agent from running `phase ai enable` or `phase ai disable` itself\n\n## Connect\n\nInstall:\n\n```bash\ncurl -fsSL https://pkg.phase.dev/install.sh | sh # or: brew tap phasehq/cli \u0026\u0026 brew install phase\n```\n\nFirst request:\n\n```bash\ncurl -G https://api.phase.dev/v1/secrets/ -H \"Authorization: Bearer ServiceAccount $PHASE_TOKEN\" \\\n -d app_id=$PHASE_APP_ID -d env=development\n```\n\nClaude Code:\n\n```bash\nphase ai enable\n```\n\nThrough letme (picks today, calling later): https://letme.dev/phase. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Infisical | A | 83.7 | 2 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit, secrets.self-host | no | https://www.anchorterminal.com/tools/infisical.md |\n| HashiCorp Vault + Vault MCP Server | B | 64.2 | 283 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit, secrets.self-host | no | https://www.anchorterminal.com/tools/hashicorp-vault.md |\n| AWS Secrets Manager | BB | 77.7 | 18 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/aws-secrets-manager.md |\n| Google Cloud Secret Manager | BB | 76.5 | 28 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/google-secret-manager.md |\n| Azure Key Vault | BB | 74.7 | 60 | secrets.store, secrets.machine-identity, secrets.audit, secrets.rotate | no | https://www.anchorterminal.com/tools/azure-key-vault.md |\n| Akeyless (SecretlessAI and MCP server) | BB | 73.6 | 74 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/akeyless.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The REST API covers 47 documented operations under `/v1` for secrets, dynamic secret leases, apps, environments, roles, service accounts, members, invites, teams and external identity login (source: \u003chttps://docs.phase.dev/public-api\u003e)\n- REST access to secrets needs server-side encryption enabled per app. The CLI, SDKs and Kubernetes operator decrypt on the client with key material carried in the token (source: \u003chttps://docs.phase.dev/public-api, https://docs.phase.dev/security/architecture\u003e)\n- `phase ai enable` installs a skill document for Claude Code, Cursor, VS Code Copilot, Codex or OpenCode. Secrets have three types, `config` always visible to the agent, `secret` masked by choice and `sealed` never shown (source: \u003chttps://docs.phase.dev/integrations/agents/claude-code\u003e)\n- External identities let a workload log in with a signed AWS STS GetCallerIdentity request or an Azure managed identity token and receive an access token with a TTL (source: \u003chttps://docs.phase.dev/access-control/external-identities\u003e)\n- Rotating secrets mint a new credential on a schedule and revoke the old one after a set delay. The supported providers are LiteLLM and OpenAI, and the feature is on Pro and Enterprise (source: \u003chttps://docs.phase.dev/console/rotating-secrets, https://phase.dev/pricing/\u003e)\n- Dynamic secrets lease short-lived credentials on demand. AWS IAM is the one provider listed, and the feature needs the Enterprise tier (source: \u003chttps://docs.phase.dev/console/dynamic-secrets\u003e)\n- Phase Cloud runs on AWS in eu-central-1 (Frankfurt), per the pricing page's FAQ, and the status page lists the AWS components for that region (source: \u003chttps://phase.dev/pricing/, https://phase.statuspage.io\u003e)\n- The terms of service (last updated 6 October 2025) forbid use of the services for competitive analysis or to build competitive products. Recorded as a fact (source: \u003chttps://phase.dev/legal/terms/\u003e)\n- The home page and pricing page describe an AI egress proxy that swaps decoy credentials for real ones (Phase Agents Relay). No docs page, CLI command or merged code for it was found on 8 October 2026, and pull request #1025 \"feat: AI Agents\" was open (source: \u003chttps://phase.dev/, https://github.com/phasehq/console\u003e)\n\n## Compare\n\n- [1Password service accounts, SDKs and Environments MCP vs Phase](https://www.anchorterminal.com/compare/1password-vs-phase.md): B 69.7 vs B 68\n- [Akeyless (SecretlessAI and MCP server) vs Phase](https://www.anchorterminal.com/compare/akeyless-vs-phase.md): BB 73.6 vs B 68\n- [AWS Secrets Manager vs Phase](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-phase.md): BB 77.7 vs B 68\n- [Azure Key Vault vs Phase](https://www.anchorterminal.com/compare/azure-key-vault-vs-phase.md): BB 74.7 vs B 68\n- [Bitwarden Secrets Manager vs Phase](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-phase.md): C 56.8 vs B 68\n- [Doppler vs Phase](https://www.anchorterminal.com/compare/doppler-vs-phase.md): BB 71.4 vs B 68\n- [Google Cloud Secret Manager vs Phase](https://www.anchorterminal.com/compare/google-secret-manager-vs-phase.md): BB 76.5 vs B 68\n- [HashiCorp Vault + Vault MCP Server vs Phase](https://www.anchorterminal.com/compare/hashicorp-vault-vs-phase.md): B 64.2 vs B 68\n- [Infisical vs Phase](https://www.anchorterminal.com/compare/infisical-vs-phase.md): A 83.7 vs B 68\n- [Keeper Secrets Manager vs Phase](https://www.anchorterminal.com/compare/keeper-secrets-manager-vs-phase.md): B 69.4 vs B 68\n- [Phase vs Pulumi ESC](https://www.anchorterminal.com/compare/phase-vs-pulumi-esc.md): B 68 vs BB 71.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on phase.dev or one of its subdomains, or the README of github.com/phasehq/console. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"phase\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/phase\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/phase.svg\" alt=\"Phase on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Phase on Anchor Terminal](https://www.anchorterminal.com/badges/phase.svg)](https://www.anchorterminal.com/tools/phase)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/phase\"\u003ePhase on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Phase is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/phase-dark.png\n- Light: https://www.anchorterminal.com/assets/share/phase-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Secrets \u0026 credential vaults", "url": "https://www.anchorterminal.com/categories/secrets" }, { "name": "Phase", "url": "" } ], "description": "Phase is an open-source secrets manager from Phi Security Inc. with end-to-end encryption, service accounts, secret rotation and audit logs. Agents reach it through a REST API, a CLI and SDKs, on Phase Cloud or self-hosted.", "facts": [ "rank #194 of 722", "OAuth or key auth", "0 desk reviews" ], "h1": "Phase", "image": "https://www.anchorterminal.com/assets/og/tools-phase.png", "path": "/tools/phase", "published": "2026-10-01", "section": "tools", "title": "Phase review for AI agents, grade B (68/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/phase" }, "tokens": { "markdown": 7150, "slim": 1630 }, "version": 1 }