Side by side
Boundary vs Pomerium
Both stand on zero trust network access software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan APILinuxMac+3
Boundary combines identity-based infrastructure access with credential brokering, target discovery, and audit capabilities. Compare the Community, HCP, and Enterprise deployment options against the access and session controls you need.
Visit Boundary
Free plan Open source APILinuxMac+3
Pomerium provides clientless, identity-aware access with checks on user, device, and request context. Its free plan has defined user and route limits; Business adds higher listed capacities for an annual-billed monthly price.
Visit PomeriumThe facts
| Boundary | Pomerium | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | No | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Zero Business (annual): $7 a month |
| Plans published | 4 | 7 |
| Maker | Not published | Not published |
| Website | developer.hashicorp.com | pomerium.com |
| On zero trust network access software | #2 of 42 | #1 of 42 |
Boundary: what it does well
- Free Community Edition costs nothing.
- Supports just-in-time and least-privilege access.
- Targets include SSH, RDP, Kubernetes, and databases.
- Vault integration can inject short-lived dynamic credentials.
- Terraform, REST API, CLI, and SDK support automation.
What to know first
- HCP Boundary pricing is usage-based and not listed.
- Enterprise is self-managed.
- Session recording and playback are listed for Plus.
Pomerium: what it does well
- Access checks include identity, device state, and request context.
- Supports HTTP, SSH, gRPC, TCP, and UDP scenarios.
- Authenticates with OpenID Connect identity providers.
- Sensitive databroker data is encrypted at rest.
- Free Personal plan lists 10 users.
What to know first
- Business is $7 a month, billed annually.
- Personal Free is limited to 10 routes.
- Downstream TLS minimum is TLS 1.2.
Alternatives to Boundary Alternatives to Pomerium The whole list