Self-hosted control
Operate the control plane and access path in your environment.
Pomerium Enterprise
Self-host the Pomerium control plane
Run the Pomerium control plane and Core data plane in your environment. Add centralized configuration, delegated administration, and enterprise policy features.
What this pattern controls
Delegated management
Use namespaces and roles to organize administration.
Governance features
Add enterprise policy, data, history, and API workflows.
Keep management and application traffic in your environment
Self-hosted control plane
The Enterprise Console and Core clusters run in infrastructure that you operate.
Self-hosted application path
Core replicas proxy application traffic to the selected private upstreams.
Self-hosted operations
Keep the control plane in your infrastructure
Enterprise keeps both the control plane and data plane in your environment while providing centralized configuration.
- Run the Enterprise Console and Core clusters in infrastructure that you operate.
- Manage routes, policies, clusters, and service accounts through the Console and Enterprise API.
- Use deployment history to review supported configuration changes.
Enterprise governance
Delegate administration and apply shared policy
Enterprise adds administration, policy, audit, and scale features for organizations that operate the full Pomerium deployment.
- Use namespaces and role-based administration to organize teams and routes.
- Use directory sync and external data in supported policy workflows.
- Use Rego when PPL does not express the required policy logic.
Enterprise operations
Operate the full Pomerium control plane
Manage routes and clusters
Use the self-hosted Console and Enterprise API to manage routes, policies, service accounts, and Core clusters.
Delegate work across teams
Use namespaces and roles for team self-service. View, export, and revoke sessions in the Enterprise Console.
Extend and review enforcement
Write policy with PPL or Rego. Add directory and external data to policy decisions. Review and export Console change logs from deployment history.
Technical sources
Pomerium Enterprise deployment
Install and operate the Enterprise Console.
Enterprise authorization
Namespaces, PPL, Rego, and delegated policy administration.
Pomerium Enterprise API
Programmatic administration through the Enterprise API.
