Boundary
7.3#4 in ssh server softwareFree planFree planWebAPILinuxmacOS
VisitBoundary vs Cloudflare Access
Cloudflare Access
7.8#2 in ssh server software$7 usage-basedFree planAndroidiOSWebAPI
VisitWhat both publish
| Fact | Boundary | Cloudflare Access |
|---|---|---|
| Automation | Boundary supports Terraform for automated deployment and configuration and provides a REST API, CLI, and SDK. | Cloudflare says Access policy administration can be centralized and scaled with APIs and Terraform. |
| Founded | 2020 | 2009 |
| Headquarters | San Francisco, California, United States | San Francisco, CA |
| Identity integrations | Boundary supports identity providers including Okta, Microsoft Entra ID, Auth0, and other OIDC-compatible providers, as well as LDAP authentication. | Access supports SAML- or OIDC-compliant identity providers, including enterprise SSO providers, social identity providers, and Cloudflare as an IdP. |
| Purpose | Boundary provides identity-based, authenticated access to infrastructure without requiring users to access the underlying network directly. | Cloudflare Access is a zero trust network access solution for self-hosted apps, SaaS applications, and infrastructure that checks identity, device posture, and context for each request. |
Boundary plans
- Boundary Community EditionFree
- HCP Boundary PlusFree
- HCP Boundary StandardFree
- Boundary EnterprisePriced on request
Cloudflare Access plans
- Free PlanFree
- Pay-as-you-go$7 a month
- Contract Plan—
- Cloudflare One free planFree
Pick Boundary if…
Boundary suits organizations that need controlled access to infrastructure across a hybrid deployment. It is also relevant to teams using Vault, Terraform, or identity providers such as Okta, Microsoft Entra ID, Auth0, and LDAP.
Pick Cloudflare Access if…
It suits organizations that need identity- and device-aware access to applications or infrastructure, including contractors and users on unmanaged devices. Teams publishing self-hosted public applications need an active Cloudflare domain with full or partial CNAME setup.