Pomerium

Pomerium is an open-source proxy for controlling access to internal systems without requiring a VPN client. It is best suited to organizations that need identity, device, and request context in access decisions across several protocols. Its strongest case is policy-driven, clientless access; smaller teams should weigh the firm free-tier caps and annual billing on the paid plan.

Overview

Pomerium applies BeyondCorp and zero-trust principles to applications, servers, services, and workloads. Users reach protected resources through a browser, while Pomerium continually verifies identity, device state, and request context before allowing access. Device posture checks and session recording add controls beyond a basic tunnel, making it a better fit for differentiated access policies than for teams that only need private-network connectivity.

The deployment model is hybrid. Pomerium Core has Linux and macOS binaries, Linux deb/rpm packages, Docker images, and source builds. Pomerium Desktop runs on Windows, macOS, and Linux, and the CLI is distributed as binaries, packages, Homebrew software, Docker, or source. That breadth accommodates mixed estates, but operating the platform still requires technical ownership.

Key features

Identity-aware authorization

Pomerium authenticates against identity providers and supports any provider using OpenID Connect. It then evaluates identity, device condition, and request context continuously. This supports policies that can vary by user and device rather than by network location, although administrators must design and maintain those policies.

Broad protocol coverage

Access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP. Supported application protocols also include HTTPS, HTTP/2, HTTP/3, WebSocket, and SSH. That makes Pomerium relevant to browser applications, infrastructure services, and networked workloads instead of only conventional web routes.

Security controls

Authentication cookies are removed before requests are forwarded to upstream services, limiting exposure of credentials and tokens. Sensitive databroker data—such as session, user, directory, and service-secret data—is encrypted at rest, and downstream TLS requires at least TLS 1.2. These safeguards strengthen an access gateway, but they do not remove the need for sound identity and policy administration.

Integrations and support

Listed integrations cover Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. Support options range from a community forum and email to a dedicated Slack channel, phone support, and a dedicated customer success manager.

Pricing

Pomerium uses a freemium model, with a free trial and paid plans from $7/user/mo when billed annually.

Personal Free and Zero Personal

Personal Free costs nothing and allows 10 users, 10 routes, 5 policies, and 2 service accounts. Zero Personal is also free, with 1 admin, 1 service account, 2 policies, 5 routes, 10 automatic TLS certificates, and 10 users. These tiers suit personal projects or very small deployments; the low route, policy, and account ceilings make them poor choices for a growing access program.

Business plans

Business costs $7 a month, billed annually, and raises capacity to 1,000 users, 100 routes, 100 policies, and 20 service accounts. Zero Business costs $7 a month, billed annually, and includes 5 admins, 20 service accounts, 20 policies, 100 routes, 100 automatic TLS certificates, and 1,000 users. The larger quotas fit operational teams, but annual billing is a commitment even when usage varies.

Enterprise

Enterprise has custom pricing and is fully self-hosted, with an on-premise option, full Pomerium API access, and no usage limits. It is the relevant tier for organizations that need unlimited capacity or control over an on-premise deployment.

Platforms

Pomerium supports API, Linux, macOS, self-hosted, web, and Windows environments. Browser access is the primary access method, while Desktop and CLI options extend administration and client coverage across the major desktop operating systems.

Who it's for

Pomerium fits startups through Global Fortune 2000 organizations that need centralized, context-sensitive access to varied internal resources. It is particularly suitable for teams combining web applications with SSH, gRPC, TCP, UDP, or Kubernetes workloads. It is less suitable when a small, fixed set of users and routes can be served by a simpler free proxy, or when annual billing is unacceptable.

Pros and cons

• Pro: Clientless access avoids distributing VPN client software.
• Pro: Identity, device, and request checks support fine-grained authorization.
• Pro: HTTP, MCP, SSH, gRPC, TCP, and UDP coverage spans web and infrastructure use cases.
• Pro: Hybrid deployment, self-hosting, and broad integrations accommodate mixed environments.
• Con: Free plans cap users, routes, policies, and service accounts tightly.
• Con: Business pricing is billed annually, reducing month-to-month flexibility.
• Con: Policy design and the range of deployment choices demand capable administration.

Alternatives

Choose Fabio if you want free, MIT-licensed reverse-proxy software and already use Consul for service discovery. Choose freenginx for a free proxy distributed under a 2-clause BSD-like license. Choose frp for free, self-hosted client and server reverse-proxy binaries, including Android support.

LocalXpose is a better fit for simple free tunneling, with two active HTTP/HTTPS tunnels, SSL/TLS encryption, unique subdomains, time limits, and an interstitial warning page. Choose ngrok for a freemium tunneling service with a free trial, up to three online endpoints, and included usage. Openport suits device-oriented deployments where enterprise pricing is charged per device and includes 20 connections per device. Choose Zoraxy for a free AGPL open-source option. Envoy Proxy is the alternative when you want a free open-source proxy installable with Docker, macOS Homebrew, or a static binary.

For broader category comparisons, see Reverse Proxy Software, Zero Trust Network Access Software, and Business VPN Software.

Verdict

Choose Pomerium if your organization needs clientless, identity- and device-aware access across web and infrastructure protocols, with deployment flexibility and strong integration coverage. Look elsewhere if your requirements are limited to basic tunneling, your deployment is too small for its policy model, or annual Business billing and free-tier caps do not fit.