Skip to content
SPECIFICTION
Get listed

Boundary

developer.hashicorp.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit developer.hashicorp.com
Spec score 9.0 #1 of 34 in SSH Server Software

What it is

Boundary provides authenticated, identity-based access to infrastructure without requiring users to connect directly to its underlying network. It supports just-in-time and least-privilege access, role-based authorization, and single sign-on through OIDC or LDAP. Users can reach TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets through familiar clients such as SSH tools, PuTTY, Remote Desktop, database clients, and web browsers. Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection. Target discovery can be automated, with dynamic host catalogs for AWS, Azure, and GCP available in HCP Boundary. Deployment options include managed HCP Boundary, optionally with customer-run workers, and self-managed Boundary Enterprise. The Community Edition is listed at free. HCP Boundary Standard and Plus have usage-based billing, with monthly rates per user depending on edition; Standard includes Vault credential injection and audit-log streaming, while Plus adds session recording. Enterprise is self-managed and has full feature parity with HCP Boundary. Boundary supports Terraform, a REST API, CLI, and SDK.

Spec sheet

What it does
Boundary provides identity-based, authenticated access to servers, databases, applications, and cloud or on-premises infrastructure without direct network access.Read 15 Oct 2026 · developer.hashicorp.com
Purpose
Boundary provides identity-based, authenticated access to infrastructure without requiring users to access the underlying network directly.Read 7 Oct 2026 · developer.hashicorp.com
API
Boundary exposes a REST API with correlation IDs, rate limiting, filtering, pagination, and standard resource methods.Read 15 Oct 2026 · developer.hashicorp.com
Security
Boundary uses TLS or mutual TLS for communications and supports role-based access control, granular scopes, and envelope encryption for sensitive stored data.Read 7 Oct 2026 · developer.hashicorp.com
Headquarters
San Francisco, California, United StatesRead 28 Sep 2026 · developer.hashicorp.com
Founded
2020Read 28 Sep 2026 · developer.hashicorp.com
Access controls
Boundary supports just-in-time and least-privilege network access, role-based authorization, and single sign-on through OIDC and LDAP.Read 7 Oct 2026 · developer.hashicorp.com
Access model
It centralizes access control, applies role-based permissions, and creates auditable sessions while protecting credentials and network details.Read 15 Oct 2026 · developer.hashicorp.com
Authentication
Supported authentication methods are password, OpenID Connect, and LDAP, with OIDC examples including Okta, Auth0, and Microsoft Entra ID.Read 15 Oct 2026 · developer.hashicorp.com
Automation
Boundary supports Terraform for automated deployment and configuration and provides a REST API, CLI, and SDK.Read 7 Oct 2026 · developer.hashicorp.com
Cloud integrations
Documented dynamic host catalogs cover AWS, Azure, and Google Cloud, and AWS catalogs can authenticate with IAM AssumeRole.Read 15 Oct 2026 · developer.hashicorp.com
Community-edition status
HashiCorp announced October 2026 that Community Edition is deprecated, archived, read-only, and will receive no new releases, fixes, or security patches.Read 15 Oct 2026 · discuss.hashicorp.com
Company funding and ownership record
Crunchbase lists HashiCorp as acquired by IBM and records 16 investors, including Geodesic Capital and an employee stock-option fund.Read 15 Oct 2026 · crunchbase.com
Company profile
LinkedIn lists HashiCorp as a public software-development company founded in 2012, headquartered in San Francisco, with 1,001–5,000 employees.Read 15 Oct 2026 · linkedin.com
Compatible clients
Users can connect through existing tools such as SSH clients, PuTTY, Remote Desktop, database clients, and web browsers.Read 7 Oct 2026 · developer.hashicorp.com
Credential brokering
Boundary can retrieve centrally stored credentials and return them to users during target connections.Read 15 Oct 2026 · developer.hashicorp.com
Credential injection
Boundary can inject credentials into sessions so users receive a passwordless connection and never see the secret.Read 15 Oct 2026 · developer.hashicorp.com
Credential management
Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection.Read 7 Oct 2026 · developer.hashicorp.com
Deployment options
HCP Boundary is managed by HashiCorp with optional customer-run workers, while Boundary Enterprise is self-managed.Read 7 Oct 2026 · developer.hashicorp.com
Discovery
Boundary automates target discovery and supports dynamic host catalogs for AWS, Azure, and GCP in HCP Boundary.Read 7 Oct 2026 · developer.hashicorp.com
Documentation depth
The documentation set covers CLI, API, domain model, HCP deployment, target connections, HCL configuration, permissions, data security, TLS connections, and filtering.Read 15 Oct 2026 · developer.hashicorp.com
Dynamic discovery
Terraform discovery and dynamic host catalogs can automatically onboard targets and track changing IP addresses without an agent.Read 15 Oct 2026 · developer.hashicorp.com
Free access
HashiCorp's Boundary product page says users can get started for free, and the developer site offers HCP Boundary for free.Read 7 Oct 2026 · hashicorp.com
Identity integrations
Boundary supports identity providers including Okta, Microsoft Entra ID, Auth0, and other OIDC-compatible providers, as well as LDAP authentication.Read 7 Oct 2026 · developer.hashicorp.com
Install support
Official installers and packages cover Linux distributions, macOS, Windows, FreeBSD, NetBSD, OpenBSD, Solaris, and Boundary Desktop packages for macOS, Windows, and Debian Linux.Read 15 Oct 2026 · docs.hashicorp.com
Latest release
Boundary 1.0.2 was released September 10, 2026 for HCP and Enterprise editions.Read 15 Oct 2026 · developer.hashicorp.com
Licence
The repository uses Business Source License 1.1 with IBM as licensor; each version changes to MPL 2.0 four years after publication.Read 15 Oct 2026 · github.com
Limit: operator experience
An independent 2026 comparison says Boundary's turnkey polish trails Teleport and StrongDM unless customers use HCP Boundary.Read 15 Oct 2026 · top-5-solutions.com
Limit: protocol coverage
MakerStack describes Boundary as having narrower protocol support than Teleport.Read 15 Oct 2026 · makerstack.co
Limit: roadmap concern
The same comparison reports skepticism about IBM steering Boundary's roadmap after the acquisition.Read 15 Oct 2026 · top-5-solutions.com
MFA
Multi-factor authentication is provided through an OIDC identity provider that enforces MFA.Read 15 Oct 2026 · developer.hashicorp.com
Owner
IBM completed its acquisition of HashiCorp on February 27, 2025.Read 15 Oct 2026 · newsroom.ibm.com
PAM capabilities
Its PAM feature set includes identity-aware access, just-in-time authorization, credential brokering and injection, auditing, administrative termination, and recording.Read 15 Oct 2026 · developer.hashicorp.com
Praise: Vault ecosystem
MakerStack says Boundary's session brokering and Vault integration are especially strong for teams already using HashiCorp products.Read 15 Oct 2026 · makerstack.co
Rating on Capterra
0 out of 5 from 0 reviewsRead 15 Oct 2026 · capterra.ca
Rating on G2
0 out of 5 from 0 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
No rating shown from 0 reviewsRead 15 Oct 2026 · gartner.com
Rating on MakerStack
7.3 out of 10 from 1 editorial reviewRead 15 Oct 2026 · makerstack.co
Rating on TrustRadius
0 out of 10 from 0 reviewsRead 15 Oct 2026 · trustradius.com
Recent feature
Boundary 1.0.0 added RDP session recording, SSH recording recovery, and a Kubernetes Helm chart on June 30, 2026.Read 15 Oct 2026 · developer.hashicorp.com
SDKs and extensibility
HashiCorp documents programmatic management through the API, CLI, SDK, and Terraform provider.Read 15 Oct 2026 · developer.hashicorp.com
Security architecture
HCP Boundary exposes controllers at randomly generated 32-character cluster-UUID hostnames to reduce endpoint enumeration.Read 15 Oct 2026 · developer.hashicorp.com
Self-hosting
Boundary Enterprise is self-managed, while HCP Boundary hosts the control plane and lets customers run private worker proxies.Read 15 Oct 2026 · developer.hashicorp.com
Session auditing
Boundary provides audit logs and streaming, and its Plus edition supports session recording and playback.Read 7 Oct 2026 · developer.hashicorp.com
Session controls
Boundary supports session logs, audit logs, HCP audit-log streaming, and administrator termination of active sessions.Read 15 Oct 2026 · developer.hashicorp.com
Support and community
HashiCorp directs Boundary users to HashiCorp Discuss for questions and GitHub to submit bugs and feature requests.Read 7 Oct 2026 · developer.hashicorp.com
Supported downloads
The installer page provides Boundary downloads for macOS, Windows, and Linux, plus desktop client downloads.Read 7 Oct 2026 · developer.hashicorp.com
System requirements
Production deployments require PostgreSQL with pgcrypto and citext modules, controller and worker network connectivity, and listener-specific load-balancing configuration.Read 15 Oct 2026 · developer.hashicorp.com
Targets
Boundary provides access to TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets.Read 7 Oct 2026 · developer.hashicorp.com
Transparent sessions
The Client Agent can intercept eligible DNS requests and route authorized connections through Boundary without users entering resource IDs or proxy ports.Read 15 Oct 2026 · developer.hashicorp.com
Vault integration
Vault can supply Boundary secrets, act as an OIDC provider, or serve as Boundary's external key-management root of trust.Read 15 Oct 2026 · developer.hashicorp.com

Plans and prices

Boundary Community Edition Free Community Edition features Read 7 Oct 2026 · developer.hashicorp.com
Boundary Community Edition Free Source-available CE; repository archived October 8, 2026 · no further releases, fixes, or security patches planned Read 15 Oct 2026 · github.com
HCP Boundary Plus Free first 1–5 users monthly; then $47.91667/user/month with Silver Support or $50.00000/user/month with Gold Support (6–20 users) Standard features · session recording · standard HashiCorp Cloud SLA Read 15 Oct 2026 · hashicorp.com
HCP Boundary Standard Free first 1–5 users monthly; then $23.95833/user/month with Silver Support or $25.00000/user/month with Gold Support (6–20 users) Boundary Community features · Vault dynamic credential injection · audit-log streaming · standard HashiCorp Cloud SLA Read 15 Oct 2026 · hashicorp.com
Boundary Enterprise Priced on request Self-managed deployment · full feature parity with HCP Boundary · commercial support Read 15 Oct 2026 · developer.hashicorp.com

Every Boundary plan and price →

Strong points and limits

Strong points

  • Community Edition is listed at free.
  • Supports just-in-time and least-privilege access.
  • Works with familiar SSH and Remote Desktop clients.
  • Terraform, REST API, CLI, and SDK are supported.
  • Plus includes session recording.

Limits

  • HCP Boundary rates are usage-based and not listed.
  • Enterprise is self-managed.
  • Session recording is listed for Plus.

Who it suits

Boundary suits organizations that need controlled access to infrastructure targets without giving users direct network access. Its deployment options serve teams seeking managed HCP Boundary or a self-managed Enterprise edition.

Verdict

Boundary combines identity-based access controls with broad target and deployment support. Compare edition details and usage-based charges, especially if session recording or managed deployment is needed.

Where Specifiction places it

Alternatives to BoundaryAll alternatives →