Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium provides a standardized interface to add access control to applications regardless of whether the application itself has authorization or authentication baked-in. Pomerium gateways both internal and external requests, and can be used in situations where you’d typically reach for a VPN.

Why should I care about whether components are self-hosted or managed?

Every plan uses a self-hosted data plane to handle application traffic in your environment. Pomerium Zero provides a managed control plane for configuration, policies, and cluster management. Pomerium Enterprise adds a self-hosted control plane, so you operate both planes in your environment.

What layer are you securing?

Pomerium provides layer 7 security. See our post to learn more about layer 7 vs layer 3 & 4 security models ( link ).

No. Pomerium is an identity-aware proxy that grants access to specific applications and services. Web applications work in a browser without client software. SSH works with standard SSH clients. TCP and UDP access uses Pomerium CLI or Desktop.

Do you log my traffic?

Pomerium produces access and authorization logs so you can audit requests and access decisions. Your self-hosted data plane handles application traffic in your environment. With Pomerium Zero, the managed control plane receives configuration and operational data for cluster management.

Are you claiming to be Zero Trust?

Pomerium applies identity-based policies before granting access to protected applications and services. It evaluates each HTTP request, including requests within an existing session, using identity and request context. Network location alone does not grant access.

Can I use Pomerium for free?

Yes! Pomerium Zero is free for personal use, and we also offer Pomerium Core, our open source version. We’re confident you’ll love whichever plan you are on.

I have a question you don’t answer here.

No problem. Contact our team at support@pomerium.com , and we’ll gladly help.

Pricing | Pomerium

Everything in open-source Core +

Zero Personal

For individuals and personal projects.

Free

Start free

Managed control plane. Run one Core cluster in your environment.

1 cluster, 10 routes, and 5 policies
1 custom domain
Community support

Zero Business

For teams that need simpler management and more capacity.

9per user / month

Billed monthly

7per user / month

Billed annually

Start free trial

Managed control plane. Simplify configuration and keep application traffic in your environment.

5 clusters, 100 routes, and 100 policies
5 custom domains with automatic TLS certificates
Access logs and configuration change history
Email support

Enterprise

For organizations that need full self-hosting and advanced controls.

Custom

Get a demo

Self-hosted control plane. Run Pomerium in your environment with advanced authorization and dedicated support.

Delegated administration and policy inheritance
Directory sync, external data, and Rego policies
Session management and SSH session recording
Dedicated Slack channel and customer success manager

Compare editions

Compare editions
Capability	Zero Personal Free Personal use	Zero Business 9 dollarsper user / month Billed monthly 7 dollarsper user / month Billed annually	Enterprise Custom
Deployment and management
Control planeManages configuration, access policies, and deployment settings.	Zero PersonalManaged	Zero BusinessManaged	EnterpriseSelf-hosted
Data planeRuns in your environment and handles traffic to protected applications.	Zero PersonalSelf-hosted	Zero BusinessSelf-hosted	EnterpriseSelf-hosted
Management consoleManage routes, policies, and clusters through a web interface.	Zero PersonalManaged	Zero BusinessManaged	EnterpriseSelf-hosted
Management APIAutomate configuration and administration through an API.	Zero PersonalZero Personal includes Management API.	Zero BusinessZero Business includes Management API.	EnterpriseEnterprise includes Management API.
Terraform supportManage Pomerium configuration with Terraform.	Zero PersonalZero Personal includes Terraform support.	Zero BusinessZero Business includes Terraform support.	EnterpriseEnterprise includes Terraform support.
Cluster managementManage multiple separate Pomerium deployments at once.	Zero Personal1 cluster	Zero Business5 clusters	EnterpriseMulti-cluster
Configuration change history	Zero PersonalZero Personal includes Configuration change history.	Zero BusinessZero Business includes Configuration change history.	EnterpriseEnterprise includes Configuration change history.
Protected access
Clientless web accessPomerium enables web-based, secure application access without a VPN or any client-side software.	Zero PersonalZero Personal includes Clientless web access.	Zero BusinessZero Business includes Clientless web access.	EnterpriseEnterprise includes Clientless web access.
Native SSH accessConnect to protected servers with your existing SSH client.	Zero PersonalZero Personal includes Native SSH access.	Zero BusinessZero Business includes Native SSH access.	EnterpriseEnterprise includes Native SSH access.
TCP and UDP accessConnect to databases and other non-HTTP services with Pomerium CLI or Desktop.	Zero PersonalZero Personal includes TCP and UDP access.	Zero BusinessZero Business includes TCP and UDP access.	EnterpriseEnterprise includes TCP and UDP access.
Kubernetes accessApply identity-based access policies to Kubernetes API requests.	Zero PersonalZero Personal includes Kubernetes access.	Zero BusinessZero Business includes Kubernetes access.	EnterpriseEnterprise includes Kubernetes access.
MCP server accessAuthenticate users and control access to MCP servers.	Zero PersonalZero Personal includes MCP server access.	Zero BusinessZero Business includes MCP server access.	EnterpriseEnterprise includes MCP server access.
MCP tool access controlSet which MCP tools each user or group can call.	Zero PersonalZero Personal includes MCP tool access control.	Zero BusinessZero Business includes MCP tool access control.	EnterpriseEnterprise includes MCP tool access control.
OAuth token managementConnect users' accounts to MCP services and automatically refresh their OAuth tokens.	Zero PersonalZero Personal includes OAuth token management.	Zero BusinessZero Business includes OAuth token management.	EnterpriseEnterprise includes OAuth token management.
Single sign-on (SSO)Let users sign in with your existing identity provider.	Zero PersonalZero Personal includes Single sign-on (SSO).	Zero BusinessZero Business includes Single sign-on (SSO).	EnterpriseEnterprise includes Single sign-on (SSO).
Mutual TLS (mTLS)Verify clients and servers with certificates.	Zero PersonalZero Personal includes Mutual TLS (mTLS).	Zero BusinessZero Business includes Mutual TLS (mTLS).	EnterpriseEnterprise includes Mutual TLS (mTLS).
Authorization and governance
Attribute-based access control (ABAC)Use identity and request attributes to define access rules in Pomerium Policy Language.	Zero PersonalZero Personal includes Attribute-based access control (ABAC).	Zero BusinessZero Business includes Attribute-based access control (ABAC).	EnterpriseEnterprise includes Attribute-based access control (ABAC).
Continuous authorizationRecheck access on each HTTP request, including requests in an existing session.	Zero PersonalZero Personal includes Continuous authorization.	Zero BusinessZero Business includes Continuous authorization.	EnterpriseEnterprise includes Continuous authorization.
Visual policy editor	Zero PersonalZero Personal includes Visual policy editor.	Zero BusinessZero Business includes Visual policy editor.	EnterpriseEnterprise includes Visual policy editor.

Zero Personal

Zero Business

Enterprise

Compare editions

Deployment and management

Protected access

Authorization and governance