Pomerium vs Zscaler Private Access
Pomerium
pomerium.com
Zscaler Private Access
zscaler.comSide by side
| Figure | Pomerium | Zscaler Private Access |
|---|---|---|
| Price from | $7/mo | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 9 | 2 |
| Spec score · Business VPN Software | 9.0 (#11) | 7.8 (#56) |
| Spec score · Zero Trust Network Access Software | 8.8 (#7) | 7.1 (#29) |
| Founded | Pomerium's company history records its founding in 2019 by Bobby, who wrote the original code. | 2007 |
| Integrations | Listed integrations include Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. | ZPA's Sandbox integration can inspect files transferred through privileged consoles when configured with Zscaler Internet & SaaS Sandbox. |
| Support | The pricing page lists community forum, email support, dedicated Slack channel, phone support, and dedicated customer success manager options. | Zscaler says its technical support team is reachable 24/7 by ticket or phone. |
| What it does | Pomerium is an identity-aware reverse proxy that provides application and service access without a traditional VPN or client software. | ZPA provides zero trust access to private apps, workloads, and OT for users from any device or location. |
Plans
Pomerium
- Personal FreeFree
- Business$7 a month
- Zero PersonalFree
- Zero PersonalFree
- Zero Business$7 a month
- Zero Business (annual)$7 a month
- Zero Business (monthly)$9 a month
- EnterprisePriced on request
- EnterprisePriced on request
Zscaler Private Access
- ZPA PlatformPriced on request
- ZPA Standard (Essentials Platform)Priced on request
In their own words
Pomerium
Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.
Zscaler Private Access
Zscaler Private Access (ZPA) controls access to private applications, workloads, and operational technology for users connecting from different devices and locations. It brokers a one-to-one connection between an authorized user and a specific app, without granting access to the corporate network or exposing the app publicly. ZPA can discover applications and recommend app segments and policies. Workload-to-workload segmentation covers communications across hybrid and multicloud environments, including AWS and Azure. Privileged Remote Access offers clientless access to RDP, SSH, and VNC production systems for remote workers and third parties. Other described capabilities include inline threat inspection, Web Data Loss Prevention for data in motion, and policy-enforced access to mission-critical apps during connectivity outages. The cloud deployment is listed for Windows, macOS, Android, Android on ChromeOS, and iOS, alongside Linux and web platforms. Pricing is on request, and there is no free plan.