Boundary

B tier on Zero Trust Network Access SoftwareScore 7.2 · #5 of 37

Android app: Not listed
Free plan: Yes
Runs on: api, Linux, Mac, self-hosted, Web, Windows

developer.hashicorp.com

Summary

Boundary gives people authenticated, identity-based access to infrastructure without requiring direct access to its underlying network. It supports just-in-time and least-privilege access, role-based authorization, and single sign-on with OIDC or LDAP. Users can reach TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets through familiar clients such as SSH tools, PuTTY, Remote Desktop, database clients, and web browsers. Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection. Target discovery can be automated, with dynamic AWS, Azure, and GCP host catalogs available in HCP Boundary. Organizations can choose managed HCP Boundary, optionally with customer-run workers, or self-managed Boundary Enterprise. Community Edition is 0.00 USD per free; HCP Boundary Standard and Plus have usage-based billing with no price listed. Standard includes Vault credential injection and audit log streaming, while Plus adds session recording and playback. Boundary also supports Terraform, a REST API, CLI, and SDK, and uses TLS or mutual TLS, granular scopes, and envelope encryption for stored sensitive data.

Who it is for

Boundary suits organizations that need controlled access to infrastructure across a hybrid deployment. It is also relevant to teams using Vault, Terraform, or identity providers such as Okta, Microsoft Entra ID, Auth0, and LDAP.

What is good

Supports just-in-time and least-privilege access.
Connects to infrastructure targets including SSH, RDP, and Kubernetes.
Vault integration can provide short-lived dynamic credentials.
Audit logs and streaming are available.
Community Edition is 0.00 USD per free.

What to know first

HCP Boundary pricing is usage-based and not listed.
Session recording and playback are listed for Plus.
Enterprise is self-managed.

Verdict

Boundary combines identity-based access controls with credential brokering, target discovery, and audit capabilities. The choice between managed HCP Boundary and self-managed Enterprise may guide deployment decisions.

Boundary plans and pricing

All plans

Boundary Community Edition Free Community Edition features developer.hashicorp.com · 7 Oct 2026

HCP Boundary Standard Not published Usage-based; monthly rate per HCP Boundary user depends on edition Dynamic credential injection through Vault · Audit log streaming developer.hashicorp.com · 7 Oct 2026

HCP Boundary Plus Not published Usage-based; monthly rate per HCP Boundary user depends on edition Standard features · Session recording hashicorp.com · 7 Oct 2026

Boundary Enterprise Not published Self-managed · Full feature parity to HCP Boundary developer.hashicorp.com · 7 Oct 2026

Compared on zero trust network access software

Free plan: Yesdeveloper.hashicorp.com

Facts

Purpose: Boundary provides identity-based, authenticated access to infrastructure without requiring users to access the underlying network directly.developer.hashicorp.com · 7 Oct 2026
Access controls: Boundary supports just-in-time and least-privilege network access, role-based authorization, and single sign-on through OIDC and LDAP.developer.hashicorp.com · 7 Oct 2026
Targets: Boundary provides access to TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets.developer.hashicorp.com · 7 Oct 2026
Credential management: Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection.developer.hashicorp.com · 7 Oct 2026
Discovery: Boundary automates target discovery and supports dynamic host catalogs for AWS, Azure, and GCP in HCP Boundary.developer.hashicorp.com · 7 Oct 2026
Session auditing: Boundary provides audit logs and streaming, and its Plus edition supports session recording and playback.developer.hashicorp.com · 7 Oct 2026
Security: Boundary uses TLS or mutual TLS for communications and supports role-based access control, granular scopes, and envelope encryption for sensitive stored data.developer.hashicorp.com · 7 Oct 2026
Deployment options: HCP Boundary is managed by HashiCorp with optional customer-run workers, while Boundary Enterprise is self-managed.developer.hashicorp.com · 7 Oct 2026
Automation: Boundary supports Terraform for automated deployment and configuration and provides a REST API, CLI, and SDK.developer.hashicorp.com · 7 Oct 2026
Identity integrations: Boundary supports identity providers including Okta, Microsoft Entra ID, Auth0, and other OIDC-compatible providers, as well as LDAP authentication.developer.hashicorp.com · 7 Oct 2026
Compatible clients: Users can connect through existing tools such as SSH clients, PuTTY, Remote Desktop, database clients, and web browsers.developer.hashicorp.com · 7 Oct 2026
Supported downloads: The installer page provides Boundary downloads for macOS, Windows, and Linux, plus desktop client downloads.developer.hashicorp.com · 7 Oct 2026
Support and community: HashiCorp directs Boundary users to HashiCorp Discuss for questions and GitHub to submit bugs and feature requests.developer.hashicorp.com · 7 Oct 2026
Free access: HashiCorp's Boundary product page says users can get started for free, and the developer site offers HCP Boundary for free.hashicorp.com · 7 Oct 2026