NetFoundry vs Pomerium
NetFoundry
netfoundry.io
Pomerium
pomerium.comSide by side
| Figure | NetFoundry | Pomerium |
|---|---|---|
| Price from | Free | $7/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 9 |
| Spec score · Business VPN Software | 8.8 (#16) | 9.0 (#11) |
| Spec score · Zero Trust Network Access Software | 8.5 (#14) | 8.8 (#7) |
| Documentation depth | The documentation includes API guides and references, integration instructions, identity and policy guides, deployment planning, upgrades and troubleshooting. | Documentation includes fundamentals courses, deployment guides, configuration reference, API reference, integrations and troubleshooting material. |
| Encryption | The platform authenticates both endpoints with mutual X.509 identity before a connection is established. | Sensitive databroker data, including session, user, directory, and service-secret data, is encrypted at rest. |
| Founded | G2 lists NetFoundry's founding year as 2019. | Pomerium's company history records its founding in 2019 by Bobby, who wrote the original code. |
| Identity integrations | The console supports SCIM provisioning integrations with Okta, Microsoft Entra ID and Google Workspace. | The integrations catalog lists 96 integrations, including Auth0, Microsoft Entra ID, GitHub, GitLab, Google Workspace, Okta, OneLogin, PingOne and generic OIDC. |
| Integrations | The platform supports connections to external identity providers and documents SCIM for automated identity management. | Listed integrations include Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. |
| Rating on G2 | 4.0 out of 5 from 8 reviews | 4.8 out of 5 from 12 reviews. |
| Self-hosting | NetFoundry Self-Hosted can run on infrastructure the customer owns, including on-premises and air-gapped environments. | Pomerium Core is the self-managed server and data plane, installable from binaries, OS packages, Docker images or source. |
| Support | The commercial self-hosted offer includes 24×7 enterprise support, while OpenZiti lists community support through Discourse, GitHub and documentation. | The pricing page lists community forum, email support, dedicated Slack channel, phone support, and dedicated customer success manager options. |
| What it does | NetFoundry provides identity-based zero-trust connectivity for workloads, APIs, applications, devices and sites, designed to work without VPNs or open inbound ports. | Pomerium is an identity-aware reverse proxy that provides application and service access without a traditional VPN or client software. |
Plans
NetFoundry
- OpenZitiFree
- NetFoundry CloudPriced on request
- NetFoundry-HostedPriced on request
- NetFoundry Self-HostedPriced on request
- NetFoundry Self-HostedPriced on request
Pomerium
- Personal FreeFree
- Business$7 a month
- Zero PersonalFree
- Zero PersonalFree
- Zero Business$7 a month
- Zero Business (annual)$7 a month
- Zero Business (monthly)$9 a month
- EnterprisePriced on request
- EnterprisePriced on request
In their own words
NetFoundry
NetFoundry provides identity-first zero-trust connectivity for AI, API, and machine-to-machine workloads. Workloads connect outbound without open or listening ports, with access governed by identity and least-privilege policy. Before a connection is established, both endpoints authenticate using mutual X.509 identity. The platform records authentication, authorization, and policy changes, can stream audit events, and exports connection, throughput, and health metrics. It supports external identity providers and documents SCIM for automated identity management; listed SDKs cover Go, C, .NET, Java, Node, and Swift. NetFoundry Cloud offers dedicated controllers and routers deployable on AWS, Azure, Google Cloud, and Oracle Cloud. Self-Hosted can run on customer-owned infrastructure, including on-premises and air-gapped environments. The company describes use cases including governing AI agent, model, and tool access, microsegmenting workloads, and connecting IT, OT, IoT, and APIs. Both listed deployment plans include 24×7 support. Select and Premium support list platform availability SLAs of 99.5% and 99.95%, respectively. Pricing is on request. The documentation lists SOC 2 Type II reports and describes HIPAA eligibility, GDPR and CCPA data processing agreements, and framework guidance.
Pomerium
Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.