- Home
- Reverse Proxy Software
- Pomerium
Pomerium
What it is
Pomerium is an open-source identity-aware proxy built around BeyondCorp and zero-trust principles. It provides browser-based access to internal applications, servers, services and workloads without requiring VPN client software. Before granting access, it continually checks identity, device state and request context. Supported access scenarios include HTTP, MCP, SSH, gRPC, TCP and UDP, and authentication works with identity providers that support OpenID Connect. Pomerium strips authentication cookies before forwarding requests to upstream services. Sensitive databroker data, including session, user, directory and service-secret information, is encrypted at rest; downstream TLS accepts TLS 1.2 as its minimum. Core deployment options include Linux and macOS binaries, packages, Docker images and source builds, while desktop clients are available for Windows, macOS and Linux. The Personal Free plan is free and lists 10 users, 10 routes, five policies and two service accounts. Business costs $7 a month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies and 20 service accounts. A free trial is listed.
For and against
For
- Access without VPN client software
- Checks identity, device state and request context
- Supports OpenID Connect identity providers
- Free plan lists 10 users and 10 routes
- Desktop clients for Windows, macOS and Linux
Against
- Business price is billed annually
- Free plan limits routes, policies and service accounts
- TLS 1.2 is the stated downstream minimum
The verdict
Pomerium offers a clientless access model with continuous checks and several supported protocols. Compare the Free plan limits with the annual Business plan’s listed capacity before choosing.
Who it suits
Pomerium may suit organizations seeking browser-based access controls for internal applications and services. Its audience includes businesses from startups to Global Fortune 2000 companies.
Plans and prices
Personal Free
10 users · 10 routes · 5 policies · 2 service accounts
Read 20 Sep 2026 · pomerium.com
Business
1,000 users · 100 routes · 100 policies · 20 service accounts
Read 20 Sep 2026 · pomerium.com
Zero Personal
1 cluster · 10 routes · 5 policies · 1 custom domain
Read 21 Oct 2026 · pomerium.com
Zero Business (annual)
5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS
Read 21 Oct 2026 · pomerium.com
Zero Business (monthly)
5 clusters · 100 routes · 100 policies · 5 custom domains with automatic TLS
Read 21 Oct 2026 · pomerium.com
Zero Business
5 admins · 20 service accounts · 20 policies · 100 routes
Read 30 Sep 2026 · pomerium.com
Enterprise
Self-hosted control plane · delegated administration · policy inheritance · directory sync
Read 21 Oct 2026 · pomerium.com
On the record
- Access model
- It provides clientless access to internal applications, servers, services, and workloads without requiring VPN client software.pomerium.com · read 30 Sep 2026
- API licensing
- The API documentation identifies Apache License 2.0 as its license.pomerium.com · read 21 Oct 2026
- Audience
- Businesses from startups to Global Fortune 2000 companies rely on Pomerium for access control.pomerium.com · read 30 Sep 2026
- Audit logging
- The product emits verbose authorization and access logs for auditing, administration and troubleshooting.pomerium.com · read 21 Oct 2026
- Authentication and SSO
- Pomerium authenticates through an existing identity provider and supports any provider implementing OpenID Connect.pomerium.com · read 21 Oct 2026
- Authorization
- Pomerium continually verifies user identity, device state, and request context before granting access.pomerium.com · read 30 Sep 2026
- Authorization policies
- Route policies can use identity and contextual data to make fine-grained access decisions.pomerium.com · read 21 Oct 2026
- Bug-bounty limitation
- The security policy states that Pomerium does not currently operate a paid bug-bounty program.pomerium.com · read 21 Oct 2026
- Changelog: MCP
- A July 6, 2026 update added upstream OAuth, dynamic client registration fallback, route discovery and safer metadata fetching for MCP.pomerium.com · read 21 Oct 2026
- Changelog: SSH
- A January 20, 2026 release added OAuth authorization-code SSH login, reverse tunneling, jump-host mode, routes portal and per-key revocation.pomerium.com · read 21 Oct 2026
- Clientless web access
- Web applications can be reached through a browser without installing endpoint client software.pomerium.com · read 21 Oct 2026
- Company size and headquarters
- LinkedIn lists Pomerium as privately held, headquartered in Los Angeles, with 11–50 employees.linkedin.com · read 21 Oct 2026
- Compliance mapping
- SSH session-recording documentation maps capabilities to SOC 2, PCI DSS, HIPAA and NIST/FedRAMP controls.pomerium.com · read 21 Oct 2026
- Context integrations
- Enterprise context sources include FleetDM, HR systems, endpoint tools, IP geolocation and CMDB platforms for policy inputs.pomerium.com · read 21 Oct 2026
- Cookie protection
- Pomerium strips its authentication cookies before forwarding requests to upstream services to prevent credential stuffing and token leakage.pomerium.com · read 30 Sep 2026
- Deployment
- Pomerium Core provides official binaries for Linux and macOS, Linux deb/rpm packages, Docker images, and source builds.pomerium.com · read 30 Sep 2026
- Deployment requirements
- The Docker quickstart requires a publicly reachable server with ports 80 and 443, DNS-controlled domain, Docker and Docker Compose.pomerium.com · read 21 Oct 2026
- Desktop clients
- Pomerium Desktop is available for Windows, macOS, and Linux, while the CLI can be installed as binaries, packages, Homebrew software, Docker, or source.pomerium.com · read 30 Sep 2026
