Boundary vs Vauban
Boundary
developer.hashicorp.comVauban
vauban.shSide by side
| Figure | Boundary | Vauban |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 1 |
| Spec score · SSH Server Software | 9.0 (#1) | 7.2 (#28) |
| Authentication | Supported authentication methods are password, OpenID Connect, and LDAP, with OIDC examples including Okta, Auth0, and Microsoft Entra ID. | Vauban supports TOTP, HOTP, OIDC and SAML single sign-on, and compatibility with LDAP and Active Directory. |
| Purpose | Boundary provides identity-based, authenticated access to infrastructure without requiring users to access the underlying network directly. | Vauban is a self-hosted privileged access management system and security bastion for SSH, RDP, IACS and MCP access to critical infrastructure. |
| Security architecture | HCP Boundary exposes controllers at randomly generated 32-character cluster-UUID hostnames to reduce endpoint enumeration. | The maker describes ten isolated services, privilege separation and Capsicum sandboxing; the project README says Capsicum sandboxing requires FreeBSD, while builds on macOS and Linux lack sandboxing. |
Plans
Boundary
- Boundary Community EditionFree
- Boundary Community EditionFree
- HCP Boundary PlusFree
- HCP Boundary StandardFree
- Boundary EnterprisePriced on request
In their own words
Boundary
Boundary provides authenticated, identity-based access to infrastructure without requiring users to connect directly to its underlying network. It supports just-in-time and least-privilege access, role-based authorization, and single sign-on through OIDC or LDAP. Users can reach TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets through familiar clients such as SSH tools, PuTTY, Remote Desktop, database clients, and web browsers. Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection. Target discovery can be automated, with dynamic host catalogs for AWS, Azure, and GCP available in HCP Boundary. Deployment options include managed HCP Boundary, optionally with customer-run workers, and self-managed Boundary Enterprise. The Community Edition is listed at free. HCP Boundary Standard and Plus have usage-based billing, with monthly rates per user depending on edition; Standard includes Vault credential injection and audit-log streaming, while Plus adds session recording. Enterprise is self-managed and has full feature parity with HCP Boundary. Boundary supports Terraform, a REST API, CLI, and SDK.