Citrix Secure Private Access vs Pomerium

Citrix Secure Private Access provides zero-trust network access to private applications, including web and SaaS applications. Its Standard plan includes Citrix Workspace Browser, end-to-end traffic monitoring, and single sign-on. Advanced adds agent-based access for client-server applications, remote browser isolation, adaptive authentication and access policies, and app protection for web and SaaS apps. The product supports SSO and SCIM, device posture checks, audit logs, application and policy management, automated enrollment, and remote wipe. Its deployment model is hybrid, with custom workspace configuration and advanced admin controls. Client platforms include Windows, macOS, Linux, iOS, Android, and web browsers; listed operating systems also include iPadOS and Windows 10/11. Citrix lists XenServer OS on 64-bit x86 bare-metal servers as a host platform and x86_64 as the guest architecture. The product is paid, has no free plan, and pricing is available on request. Its maker is headquartered in Fort Lauderdale, Florida, and was founded in 1989.

Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.