Skip to content
SPECIFICTION
Get listed

Pomerium

pomerium.com

From $7/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit pomerium.com
Spec score 8.9 #3 of 33 in Reverse Proxy Software

What it is

Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.

Spec sheet

What it does
Pomerium is an identity-aware reverse proxy that provides application and service access without a traditional VPN or client software.Read 21 Oct 2026 · pomerium.com
Product
Pomerium is an open-source identity-aware proxy built around BeyondCorp and zero-trust principles.Read 30 Sep 2026 · pomerium.com
Audience
Businesses from startups to Global Fortune 2000 companies rely on Pomerium for access control.Read 30 Sep 2026 · pomerium.com
Deployment
Pomerium Core provides official binaries for Linux and macOS, Linux deb/rpm packages, Docker images, and source builds.Read 30 Sep 2026 · pomerium.com
Free plan
YesRead 20 Sep 2026 · pomerium.com
Paid from
7Read 20 Sep 2026 · pomerium.com
Integrations
Listed integrations include Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity.Read 30 Sep 2026 · pomerium.com
Support
The pricing page lists community forum, email support, dedicated Slack channel, phone support, and dedicated customer success manager options.Read 30 Sep 2026 · pomerium.com
Founded
Pomerium's company history records its founding in 2019 by Bobby, who wrote the original code.Read 21 Oct 2026 · pomerium.com
Access model
It provides clientless access to internal applications, servers, services, and workloads without requiring VPN client software.Read 30 Sep 2026 · pomerium.com
API licensing
The API documentation identifies Apache License 2.0 as its license.Read 21 Oct 2026 · pomerium.com
Audit logging
The product emits verbose authorization and access logs for auditing, administration and troubleshooting.Read 21 Oct 2026 · pomerium.com
Authentication and SSO
Pomerium authenticates through an existing identity provider and supports any provider implementing OpenID Connect.Read 21 Oct 2026 · pomerium.com
Authorization
Pomerium continually verifies user identity, device state, and request context before granting access.Read 30 Sep 2026 · pomerium.com
Authorization policies
Route policies can use identity and contextual data to make fine-grained access decisions.Read 21 Oct 2026 · pomerium.com
Bug-bounty limitation
The security policy states that Pomerium does not currently operate a paid bug-bounty program.Read 21 Oct 2026 · pomerium.com
Changelog: MCP
A July 6, 2026 update added upstream OAuth, dynamic client registration fallback, route discovery and safer metadata fetching for MCP.Read 21 Oct 2026 · pomerium.com
Changelog: SSH
A January 20, 2026 release added OAuth authorization-code SSH login, reverse tunneling, jump-host mode, routes portal and per-key revocation.Read 21 Oct 2026 · pomerium.com
Clientless web access
Web applications can be reached through a browser without installing endpoint client software.Read 21 Oct 2026 · pomerium.com
Company size and headquarters
LinkedIn lists Pomerium as privately held, headquartered in Los Angeles, with 11–50 employees.Read 21 Oct 2026 · linkedin.com
Compliance mapping
SSH session-recording documentation maps capabilities to SOC 2, PCI DSS, HIPAA and NIST/FedRAMP controls.Read 21 Oct 2026 · pomerium.com
Context integrations
Enterprise context sources include FleetDM, HR systems, endpoint tools, IP geolocation and CMDB platforms for policy inputs.Read 21 Oct 2026 · pomerium.com
Cookie protection
Pomerium strips its authentication cookies before forwarding requests to upstream services to prevent credential stuffing and token leakage.Read 30 Sep 2026 · pomerium.com
Deployment requirements
The Docker quickstart requires a publicly reachable server with ports 80 and 443, DNS-controlled domain, Docker and Docker Compose.Read 21 Oct 2026 · pomerium.com
Desktop clients
Pomerium Desktop is available for Windows, macOS, and Linux, while the CLI can be installed as binaries, packages, Homebrew software, Docker, or source.Read 30 Sep 2026 · pomerium.com
Direct token authentication
Configured deployments can accept an IdP access or identity token in a bearer header for CLI and service workflows.Read 21 Oct 2026 · pomerium.com
Documentation depth
Documentation includes fundamentals courses, deployment guides, configuration reference, API reference, integrations and troubleshooting material.Read 21 Oct 2026 · pomerium.com
Encryption
Sensitive databroker data, including session, user, directory, and service-secret data, is encrypted at rest.Read 30 Sep 2026 · pomerium.com
Extensibility
Official integrations include a Terraform provider, Kubernetes Ingress Controller, CLI/Desktop clients and Go and JavaScript SDKs.Read 21 Oct 2026 · pomerium.com
Funding
Axios reported that Pomerium raised a $13.75 million Series A led by Benchmark with Bain Capital, Haystack, SNR and Oleg Rogynskyy participating.Read 21 Oct 2026 · axios.com
Identity integrations
The integrations catalog lists 96 integrations, including Auth0, Microsoft Entra ID, GitHub, GitLab, Google Workspace, Okta, OneLogin, PingOne and generic OIDC.Read 21 Oct 2026 · pomerium.com
Kubernetes support
The Ingress Controller provisions routes from Kubernetes Ingress resources and sets policy through annotations.Read 21 Oct 2026 · pomerium.com
Limit: dashboard depth
A G2 reviewer wanted more dashboard features and expected Pomerium Zero to address that gap.Read 21 Oct 2026 · g2.com
Limit: installation complexity
G2 reviewers report that installation and troubleshooting can be painful because deployment options are numerous and documentation may require piecing together details.Read 21 Oct 2026 · g2.com
Limit: learning curve
G2 reviewers mention a steep learning curve and complexity for newcomers configuring the many available options.Read 21 Oct 2026 · g2.com
Limit: local users
A G2 reviewer requested support for authenticating users from a local directory instead of requiring an external identity provider.Read 21 Oct 2026 · g2.com
Limit: missing plugins
One G2 reviewer noted that Pomerium did not support plugins for pre-processing or post-processing.Read 21 Oct 2026 · g2.com
Limit: self-management burden
A G2 reviewer said self-hosting increases operational lift and requested better deployment playbooks and Terraform support.Read 21 Oct 2026 · g2.com
Open-source license
The public Pomerium repository is marked Apache-2.0 licensed.Read 21 Oct 2026 · github.com
Praise: ease and integration
G2's review summary says users repeatedly praise ease of use and integration with existing applications.Read 21 Oct 2026 · g2.com
Praise: support
G2 reviewers describe the documentation, community and maintainers as helpful and responsive.Read 21 Oct 2026 · g2.com
Protected-service integrations
Documented protected services include code-server, Cockpit, GitLab, Argo Workflows, Grafana, Cloud Run, Airflow, Superset and Backstage.Read 21 Oct 2026 · pomerium.com
Protocols
The product site lists HTTP, MCP, SSH, gRPC, TCP and UDP access patterns.Read 21 Oct 2026 · pomerium.com
Public API
The Pomerium API manages configuration resources including keys, policies, routes, service accounts and settings.Read 21 Oct 2026 · pomerium.com
Rating on G2
4.8 out of 5 from 12 reviews.Read 21 Oct 2026 · g2.com
Security response
Pomerium describes a coordinated vulnerability process and says security reports are acknowledged within 48 hours and answered in detail within 72 hours.Read 21 Oct 2026 · pomerium.com
Self-hosting
Pomerium Core is the self-managed server and data plane, installable from binaries, OS packages, Docker images or source.Read 21 Oct 2026 · pomerium.com
SSO
Pomerium authenticates against identity providers and supports any provider using OpenID Connect.Read 30 Sep 2026 · pomerium.com
TLS
Downstream TLS accepts TLS 1.2 as the minimum version.Read 30 Sep 2026 · pomerium.com
Zero-trust enforcement
It evaluates identity, device state and request context continuously before allowing requests to protected resources.Read 21 Oct 2026 · pomerium.com

Plans and prices

Personal Free Free 10 users · 10 routes · 5 policies · 2 service accounts Read 20 Sep 2026 · pomerium.com
Business $7 a month billed annually 1,000 users · 100 routes · 100 policies · 20 service accounts Read 20 Sep 2026 · pomerium.com
Zero Personal Free 1 cluster · 10 routes · 5 policies · 1 custom domain · community support Read 21 Oct 2026 · pomerium.com
Zero Personal Free 1 admin · 1 service account · 2 policies · 5 routes · 10 automatic TLS certificates · 10 users Read 30 Sep 2026 · pomerium.com
Zero Business $7 a month annually 5 admins · 20 service accounts · 20 policies · 100 routes · 100 automatic TLS certificates · 1000 users Read 30 Sep 2026 · pomerium.com
Zero Business (annual) $7 a month Billed annually 5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS · access logs · configuration history · email support Read 21 Oct 2026 · pomerium.com
Zero Business (monthly) $9 a month Billed monthly 5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS · access logs · configuration history · email support Read 21 Oct 2026 · pomerium.com
Enterprise Priced on request Fully self-hosted · no usage limits · full Pomerium API · additional support Read 30 Sep 2026 · pomerium.com
Enterprise Priced on request Self-hosted control plane · delegated administration · policy inheritance · directory sync · external data · Rego policies · session management · SSH session recording · dedicated Slack · customer success manager Read 21 Oct 2026 · pomerium.com

Every Pomerium plan and price →

Strong points and limits

Strong points

  • Clientless access avoids VPN client software
  • Checks identity, device state, and request context
  • Supports a broad set of app protocols
  • Desktop clients cover Windows, macOS, and Linux
  • Free plan includes 10 users

Limits

  • Business price is billed annually
  • Free plan is limited to 10 users
  • Downstream TLS minimum is TLS 1.2

Who it suits

Pomerium suits organizations that need browser-based access control for internal resources and want to avoid requiring VPN client software. Its audience ranges from startups to Global Fortune 2000 companies.

Pomerium in depth

Read the full write-up

Pomerium is an identity-aware proxy for organizations controlling access to internal applications and infrastructure. It is best suited to teams that need identity- and device-based rules across varied protocols, rather than a basic tunnel. Its broad access model is compelling, though small teams may outgrow the free caps and Business requires annual billing.

Overview

Instead of putting users on a VPN, Pomerium grants clientless access and continually evaluates identity, device state, and request context. That makes it useful when access should depend on who is connecting and from what device, not simply network location. Device posture checks and session recording add meaningful controls; the breadth also means it is a more substantial access-management choice than a simple remote-access tool.

Deployment is hybrid, with browser access and Core builds for Linux and macOS, Linux deb/rpm packages, Docker images, and source. Pomerium Desktop supports Windows, macOS, and Linux. This range suits mixed environments, but operating a proxy and its policies calls for technical ownership.

Key features

Identity and policy

Pomerium authenticates with identity providers and supports any provider using OpenID Connect. It checks identity, device state, and request context continuously before granting access, giving teams a basis for context-sensitive authorization. The value depends on maintaining policies that reflect the organization’s access needs.

Protocol coverage and protection

Access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported application protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. That range covers web applications as well as services and network workloads. Pomerium strips authentication cookies before forwarding requests upstream, helping prevent credential stuffing and token leakage. Sensitive databroker data—including sessions, users, directories, and service secrets—is encrypted at rest, and downstream TLS requires at least TLS 1.2.

Integrations

Integrations include Grafana, Kubernetes, Docker, Cloud Run, Google Kubernetes Engine, FleetDM, BambooHR, Okta, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. This gives teams several common identity and infrastructure systems to connect, alongside broader service coverage.

Pricing

Personal Free and Zero Personal

Personal Free costs nothing and permits 10 users, 10 routes, 5 policies, and 2 service accounts. Zero Personal is also free, with 1 admin, 1 service account, 2 policies, 5 routes, 10 automatic TLS certificates, and 10 users. These are useful starting points for small deployments, but their route, policy, and account ceilings limit how far they can serve a growing team.

Business plans

Business costs $7 a month, billed billed annually, and includes 1,000 users, 100 routes, 100 policies, and 20 service accounts. Zero Business costs $7 a month, billed annually, with 5 admins, 20 service accounts, 20 policies, 100 routes, 100 automatic TLS certificates, and 1000 users. The larger user allowances and route capacity suit organizations beyond the free-plan limits; the annual billing term is the key trade-off. The two Business offerings have different policy and service-account allowances, so the right fit depends on which caps matter to the deployment.

Enterprise

Enterprise has custom pricing and offers fully self-hosted and on-premise deployment, full Pomerium API access, and no usage limits. It is the plan to consider when those deployment requirements or uncapped use justify a custom arrangement.

A free trial is available. Support options include a community forum, email, a dedicated Slack channel, phone support, and a dedicated customer success manager.

Platforms

Pomerium supports API, Linux, macOS, self-hosted, web, and Windows platforms. Core has Linux and macOS binaries, Linux deb/rpm packages, Docker images, and source builds; Desktop is available on Windows, macOS, and Linux. The CLI can be installed through binaries, packages, Homebrew, Docker, or source. This gives technical teams several deployment and installation paths, while browser access provides a clientless route for users.

Who it's for

Pomerium fits organizations that need fine-grained access to internal apps, services, servers, or workloads across multiple protocols, and that can manage identity integrations and access policies. Its audience ranges from startups to Global Fortune 2000 companies. It is less compelling for a small team that needs only a straightforward tunnel or cannot use annual billing for a paid tier.

Pros and cons

Broad protocol support: HTTP, MCP, SSH, gRPC, TCP, and UDP make it applicable beyond browser-only access.

Context-sensitive controls: Identity, device state, and request context inform authorization, with device posture checks and session recording among the controls.

Credential safeguards: Upstream cookie stripping and at-rest encryption protect sensitive authentication and databroker data.

Restrictive free ceilings: Personal Free allows only 5 policies and 2 service accounts; Zero Personal allows 2 policies and 1 service account.

Annual commitment: Both Business options are priced at $7 a month but billed annually.

Operational responsibility: Multiple deployment options are useful for technical teams, but require ownership of the proxy and its policies.

Alternatives

ngrok is another freemium option with a free plan and cross-platform support; its Free plan includes up to 3 online endpoints and up to 1GB data transfer, so it may suit a modest endpoint-focused use case.

Openport offers a freemium option and an enterprise plan priced at $1 a month per device, with a 30-device minimum; consider it when that per-device plan structure fits better.

F5 BIG-IP APM is a paid alternative with no free plan and a perpetual-license option; consider it if that licensing model better matches your needs.

PageKite has a free tier and a Pay What You Want plan at $3 a month for individuals; it may suit an individual seeking that pricing approach.

LocalXpose offers a free Starter plan with two active HTTP/HTTPS tunnels, SSL/TLS encryption, and unique subdomains, making it an option for a limited tunnel use case.

BunkerWeb is a free option with an open-source AGPLv3 plan.

Caddy is a free alternative with paid Indie and Indie Pro plans.

freenginx is a free option distributed under a 2-clause BSD-like license.

Browse Reverse Proxy Software, Zero Trust Network Access Software, and Business VPN Software for more options by category.

Verdict

Choose Pomerium if your organization needs identity- and device-aware access across web and network protocols, with deployment flexibility and clear capacity tiers. Its strongest case is the combination of context-based authorization and broad protocol coverage; look elsewhere if you need a simple tunnel or cannot accept annual billing for Business.

Verdict

Pomerium offers identity- and device-aware access control across multiple protocols and deployment options. The free and annual Business plans list specific user and policy limits.

Where Specifiction places it

Alternatives to PomeriumAll alternatives →