Pomerium
Pomerium is an open-source identity-aware proxy built around BeyondCorp and zero-trust principles.
What Pomerium is
Pomerium is an open-source identity-aware proxy built around BeyondCorp and zero-trust principles. It provides browser-based, clientless access to internal applications, servers, services, and workloads without requiring VPN client software. Before granting access, it continually checks user identity, device state, and request context. It supports HTTP, MCP, SSH, gRPC, TCP, and UDP access scenarios, and authenticates through identity providers that support OpenID Connect.
Pomerium strips its authentication cookies before forwarding requests to upstream services. Sensitive databroker information, including session, user, directory, and service-secret data, is encrypted at rest; downstream TLS accepts TLS 1.2 as its minimum. Core deployment options include Linux and macOS binaries, packages, Docker images, and source builds. Desktop clients are available for Windows, macOS, and Linux. The Personal Free plan lists 10 users, 10 routes, five policies, and two service accounts. Business is $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is listed. Support options include a community forum, email, dedicated Slack, phone support, and a dedicated customer success manager.
Good
- Provides access without VPN client software.
- Supports any identity provider using OpenID Connect.
- Checks identity, device state, and request context.
- Strips authentication cookies before forwarding requests.
- Free Personal plan includes up to 10 users.
Watch out
- Business costs $7.00 per month, billed annually.
- Personal Free is limited to 10 users.
- Personal Free includes 10 routes and five policies.
- Downstream TLS minimum is TLS 1.2.
Who it suits
Pomerium suits businesses that need to control browser access to internal applications and services based on identity, device state, and request context. It offers a free plan for up to 10 users and a Business plan for larger listed limits.
Verdict
Pomerium offers clientless access control for internal resources across several protocols, with identity and device checks before access is granted. The free plan has defined user and configuration limits; Business is listed at $7.00 per month, billed annually.
Plans and prices
From Pomerium's own pricing page, checked 20 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Personal Free | Free | 10 users · 10 routes · 5 policies · 2 service accounts |
| Business | $7 a month | 1,000 users · 100 routes · 100 policies · 20 service accounts · billed annually |
| Zero Personal | Free | 1 cluster · 10 routes · 5 policies · 1 custom domain · community support |
| Zero Business | $7 a month | 5 admins · 20 service accounts · 20 policies · 100 routes · 100 automatic TLS certificates · 1000 users · annually |
| Zero Business (annual) | $7 a month | 5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS · access logs · configuration history · email support · Billed annually |
| Zero Business (monthly) | $9 a month | 5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS · access logs · configuration history · email support · Billed monthly |
| Enterprise | Priced on request | Self-hosted control plane · delegated administration · policy inheritance · directory sync · external data · Rego policies · session management · SSH session recording · dedicated Slack · customer success manager |
The facts
Each one read from Pomerium's own pages, with the date it was checked.
What it does
- Access model
- It provides clientless access to internal applications, servers, services, and workloads without requiring VPN client software.checked 30 Sep 2026
- API licensing
- The API documentation identifies Apache License 2.0 as its license.checked 21 Oct 2026
- Audience
- Businesses from startups to Global Fortune 2000 companies rely on Pomerium for access control.checked 30 Sep 2026
- Audit logging
- The product emits verbose authorization and access logs for auditing, administration and troubleshooting.checked 21 Oct 2026
- Authentication and SSO
- Pomerium authenticates through an existing identity provider and supports any provider implementing OpenID Connect.checked 21 Oct 2026
- Authorization
- Pomerium continually verifies user identity, device state, and request context before granting access.checked 30 Sep 2026
- Authorization policies
- Route policies can use identity and contextual data to make fine-grained access decisions.checked 21 Oct 2026
- Bug-bounty limitation
- The security policy states that Pomerium does not currently operate a paid bug-bounty program.checked 21 Oct 2026
- Changelog: MCP
- A July 6, 2026 update added upstream OAuth, dynamic client registration fallback, route discovery and safer metadata fetching for MCP.checked 21 Oct 2026
- Changelog: SSH
- A January 20, 2026 release added OAuth authorization-code SSH login, reverse tunneling, jump-host mode, routes portal and per-key revocation.checked 21 Oct 2026
- Clientless web access
- Web applications can be reached through a browser without installing endpoint client software.checked 21 Oct 2026
- Context integrations
- Enterprise context sources include FleetDM, HR systems, endpoint tools, IP geolocation and CMDB platforms for policy inputs.checked 21 Oct 2026
- Cookie protection
- Pomerium strips its authentication cookies before forwarding requests to upstream services to prevent credential stuffing and token leakage.checked 30 Sep 2026
- Deployment
- Pomerium Core provides official binaries for Linux and macOS, Linux deb/rpm packages, Docker images, and source builds.checked 30 Sep 2026
- Deployment requirements
- The Docker quickstart requires a publicly reachable server with ports 80 and 443, DNS-controlled domain, Docker and Docker Compose.checked 21 Oct 2026
- Desktop clients
- Pomerium Desktop is available for Windows, macOS, and Linux, while the CLI can be installed as binaries, packages, Homebrew software, Docker, or source.checked 30 Sep 2026
- Direct token authentication
- Configured deployments can accept an IdP access or identity token in a bearer header for CLI and service workflows.checked 21 Oct 2026
- Documentation depth
- Documentation includes fundamentals courses, deployment guides, configuration reference, API reference, integrations and troubleshooting material.checked 21 Oct 2026
- Encryption
- Sensitive databroker data, including session, user, directory, and service-secret data, is encrypted at rest.checked 30 Sep 2026
- Extensibility
- Official integrations include a Terraform provider, Kubernetes Ingress Controller, CLI/Desktop clients and Go and JavaScript SDKs.checked 21 Oct 2026
The company
- Company size and headquarters
- LinkedIn lists Pomerium as privately held, headquartered in Los Angeles, with 11–50 employees.checked 21 Oct 2026
- Founded
- Pomerium's company history records its founding in 2019 by Bobby, who wrote the original code.checked 21 Oct 2026
Where it runs
- Compliance mapping
- SSH session-recording documentation maps capabilities to SOC 2, PCI DSS, HIPAA and NIST/FedRAMP controls.checked 21 Oct 2026
Money
- Free plan
- Yeschecked 20 Sep 2026
Alternatives to Pomerium
- 1
ngrok
Free planWebAPILinuxmacOS7.8From $10 a month - 2
Traefik Proxy
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
HAProxy Community Edition
Free planOpen sourceAPILinuxmacOSSelf-hosted7.4Free plan - 4
Apache Traffic Server
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
Openport
Free planWebAPILinuxmacOS7.1From $1 a month - 6
PageKite
AndroidWebAPILinux7.0From $3 a month