Zero Personal
For individuals and personal projects.
Free
Start freeManaged control plane. Run one Core cluster in your environment.
- 1 cluster, 10 routes, and 5 policies
- 1 custom domain
- Community support
Pricing and editions
Choose how you run Pomerium
Use Pomerium Zero for a managed control plane and a data plane in your environment. Use Pomerium Enterprise to self-host both planes.
Zero Business
For teams that need simpler management and more capacity.
9 dollarsper user / month
Billed monthly7 dollarsper user / month
Billed annuallyManaged control plane. Simplify configuration and keep application traffic in your environment.
- 5 clusters, 100 routes, and 100 policies
- 5 custom domains with automatic TLS certificates
- Access logs and configuration change history
- Email support
Enterprise
For organizations that need full self-hosting and advanced controls.
Custom
Get a demoSelf-hosted control plane. Run Pomerium in your environment with advanced authorization and dedicated support.
- Delegated administration and policy inheritance
- Directory sync, external data, and Rego policies
- Session management and SSH session recording
- Dedicated Slack channel and customer success manager
Compare editions
Compare edition
| Capability | Free Personal use | 9 dollarsper user / month Billed monthly7 dollarsper user / month Billed annually | Custom |
|---|---|---|---|
Deployment and management | |||
| Control planeManages configuration, access policies, and deployment settings. | Zero PersonalManaged | Zero BusinessManaged | EnterpriseSelf-hosted |
| Data planeRuns in your environment and handles traffic to protected applications. | Zero PersonalSelf-hosted | Zero BusinessSelf-hosted | EnterpriseSelf-hosted |
| Management consoleManage routes, policies, and clusters through a web interface. | Zero PersonalManaged | Zero BusinessManaged | EnterpriseSelf-hosted |
| Management APIAutomate configuration and administration through an API. | Zero PersonalZero Personal includes Management API. | Zero BusinessZero Business includes Management API. | EnterpriseEnterprise includes Management API. |
| Terraform supportManage Pomerium configuration with Terraform. | Zero PersonalZero Personal includes Terraform support. | Zero BusinessZero Business includes Terraform support. | EnterpriseEnterprise includes Terraform support. |
| Cluster managementManage multiple separate Pomerium deployments at once. | Zero Personal1 cluster | Zero Business5 clusters | EnterpriseMulti-cluster |
| Configuration change history | Zero PersonalZero Personal includes Configuration change history. | Zero BusinessZero Business includes Configuration change history. | EnterpriseEnterprise includes Configuration change history. |
Protected access | |||
| Clientless web accessPomerium enables web-based, secure application access without a VPN or any client-side software. | Zero PersonalZero Personal includes Clientless web access. | Zero BusinessZero Business includes Clientless web access. | EnterpriseEnterprise includes Clientless web access. |
| Native SSH accessConnect to protected servers with your existing SSH client. | Zero PersonalZero Personal includes Native SSH access. | Zero BusinessZero Business includes Native SSH access. | EnterpriseEnterprise includes Native SSH access. |
| TCP and UDP accessConnect to databases and other non-HTTP services with Pomerium CLI or Desktop. | Zero PersonalZero Personal includes TCP and UDP access. | Zero BusinessZero Business includes TCP and UDP access. | EnterpriseEnterprise includes TCP and UDP access. |
| Kubernetes accessApply identity-based access policies to Kubernetes API requests. | Zero PersonalZero Personal includes Kubernetes access. | Zero BusinessZero Business includes Kubernetes access. | EnterpriseEnterprise includes Kubernetes access. |
| MCP server accessAuthenticate users and control access to MCP servers. | Zero PersonalZero Personal includes MCP server access. | Zero BusinessZero Business includes MCP server access. | EnterpriseEnterprise includes MCP server access. |
| MCP tool access controlSet which MCP tools each user or group can call. | Zero PersonalZero Personal includes MCP tool access control. | Zero BusinessZero Business includes MCP tool access control. | EnterpriseEnterprise includes MCP tool access control. |
| OAuth token managementConnect users' accounts to MCP services and automatically refresh their OAuth tokens. | Zero PersonalZero Personal includes OAuth token management. | Zero BusinessZero Business includes OAuth token management. | EnterpriseEnterprise includes OAuth token management. |
| Single sign-on (SSO)Let users sign in with your existing identity provider. | Zero PersonalZero Personal includes Single sign-on (SSO). | Zero BusinessZero Business includes Single sign-on (SSO). | EnterpriseEnterprise includes Single sign-on (SSO). |
| Mutual TLS (mTLS)Verify clients and servers with certificates. | Zero PersonalZero Personal includes Mutual TLS (mTLS). | Zero BusinessZero Business includes Mutual TLS (mTLS). | EnterpriseEnterprise includes Mutual TLS (mTLS). |
Authorization and governance | |||
| Attribute-based access control (ABAC)Use identity and request attributes to define access rules in Pomerium Policy Language. | Zero PersonalZero Personal includes Attribute-based access control (ABAC). | Zero BusinessZero Business includes Attribute-based access control (ABAC). | EnterpriseEnterprise includes Attribute-based access control (ABAC). |
| Continuous authorizationRecheck access on each HTTP request, including requests in an existing session. | Zero PersonalZero Personal includes Continuous authorization. | Zero BusinessZero Business includes Continuous authorization. | EnterpriseEnterprise includes Continuous authorization. |
| Visual policy editor | Zero PersonalZero Personal includes Visual policy editor. | Zero BusinessZero Business includes Visual policy editor. | EnterpriseEnterprise includes Visual policy editor. |
| Just-in-time accessGrant access that expires automatically. Approve requests manually or through an API-based workflow. | Zero PersonalZero Personal includes Just-in-time access. | Zero BusinessZero Business includes Just-in-time access. | EnterpriseEnterprise includes Just-in-time access. |
| Directory syncSync users, groups, and other directory data for access policies. | Zero PersonalZero Personal does not include Directory sync. | Zero BusinessZero Business does not include Directory sync. | EnterpriseEnterprise includes Directory sync. |
| External data integrationsUse data from external systems in access policies, including device posture from FleetDM. | Zero PersonalZero Personal does not include External data integrations. | Zero BusinessZero Business does not include External data integrations. | EnterpriseEnterprise includes External data integrations. |
| Advanced Authorization CapabilitiesUse Rego policies to express advanced authorization rules. | Zero PersonalZero Personal does not include Advanced Authorization Capabilities. | Zero BusinessZero Business does not include Advanced Authorization Capabilities. | EnterpriseEnterprise includes Advanced Authorization Capabilities. |
| Delegated administration (RBAC)Organize routes and policies into namespaces. Assign roles so teams can manage their own resources. | Zero PersonalZero Personal does not include Delegated administration (RBAC). | Zero BusinessZero Business does not include Delegated administration (RBAC). | EnterpriseEnterprise includes Delegated administration (RBAC). |
| Policy inheritanceApply parent policies across child namespaces and routes. | Zero PersonalZero Personal does not include Policy inheritance. | Zero BusinessZero Business does not include Policy inheritance. | EnterpriseEnterprise includes Policy inheritance. |
| Whitelabeling and Custom BrandingCustomize Pomerium's UI with your organization's logo and color scheme. | Zero PersonalZero Personal does not include Whitelabeling and Custom Branding. | Zero BusinessZero Business does not include Whitelabeling and Custom Branding. | EnterpriseEnterprise includes Whitelabeling and Custom Branding. |
Audit and operations | |||
| Access and authorization logs | Zero PersonalZero Personal includes Access and authorization logs. | Zero BusinessZero Business includes Access and authorization logs. | EnterpriseEnterprise includes Access and authorization logs. |
| Distributed tracing (OpenTelemetry)Trace requests across Pomerium services to diagnose latency and errors. | Zero PersonalZero Personal includes Distributed tracing (OpenTelemetry). | Zero BusinessZero Business includes Distributed tracing (OpenTelemetry). | EnterpriseEnterprise includes Distributed tracing (OpenTelemetry). |
| Monitoring and reportingMonitor cluster status and request activity from the management console. | Zero PersonalZero Personal includes Monitoring and reporting. | Zero BusinessZero Business includes Monitoring and reporting. | EnterpriseEnterprise includes Monitoring and reporting. |
| Administrative audit logsReview administrative changes and deployment records. | Zero PersonalZero Personal includes Administrative audit logs. | Zero BusinessZero Business includes Administrative audit logs. | EnterpriseEnterprise includes Administrative audit logs. |
| Session managementInspect sessions and revoke or block access from one place. | Zero PersonalZero Personal does not include Session management. | Zero BusinessZero Business does not include Session management. | EnterpriseEnterprise includes Session management. |
| SSH session recording and playbackRecord and replay SSH sessions through the Enterprise Console. | Zero PersonalZero Personal does not include SSH session recording and playback. | Zero BusinessZero Business does not include SSH session recording and playback. | EnterpriseEnterprise includes SSH session recording and playback. |
Limits and price | |||
| PriceBusiness billing is based on monthly active users. | Zero PersonalFree for personal use | Zero Business$7 annual or $9 monthly per user | EnterpriseCustom |
| AdministratorsPeople who can manage your Pomerium configuration. | Zero Personal1 | Zero Business20 | EnterpriseCustom |
| Management API usersIdentities that use the management API, separate from people accessing protected applications. | Zero Personal2 | Zero Business1,000 | EnterpriseCustom |
| Service accountsUsed to authenticate machine-to-machine communication between services protected by Pomerium. | Zero Personal2 | Zero Business20 | EnterpriseCustom |
| RoutesConnections to protected applications and services, each with its own access policy. | Zero Personal10 | Zero Business100 | EnterpriseCustom |
| PoliciesAccess rules that determine who can use protected applications and services. | Zero Personal5 | Zero Business100 | EnterpriseCustom |
| Custom domainsUse your own domain names for protected applications. | Zero Personal1 | Zero Business5 | EnterpriseCustom |
| Uploaded TLS certificatesCertificates you upload and manage. This limit does not count automatically issued certificates. | Zero Personal10 | Zero Business100 | EnterpriseCustom |
Support | |||
| Community forum | Zero PersonalZero Personal includes Community forum. | Zero BusinessZero Business includes Community forum. | EnterpriseEnterprise includes Community forum. |
| Email support | Zero PersonalZero Personal does not include Email support. | Zero BusinessZero Business includes Email support. | EnterpriseEnterprise includes Email support. |
| Dedicated Slack channel | Zero PersonalZero Personal does not include Dedicated Slack channel. | Zero BusinessZero Business does not include Dedicated Slack channel. | EnterpriseEnterprise includes Dedicated Slack channel. |
| Phone support | Zero PersonalZero Personal does not include Phone support. | Zero BusinessZero Business does not include Phone support. | EnterpriseEnterprise includes Phone support. |
| Customer success manager | Zero PersonalZero Personal does not include Customer success manager. | Zero BusinessZero Business does not include Customer success manager. | EnterpriseEnterprise includes Customer success manager. |
| Zero Personal: Start free | Zero Business: Start free trial | Enterprise: Get a demo | |
“When you don’t have to worry about provisioning users and user-databases, it makes spinning up internal tools that much easier.”
Nitin Perumbeti
CTO, Crusoe
“We can confidently tell clients and auditors: ‘we only give people access to the things they need.’ How we prove that is we can pull up the Pomerium configuration and say… ‘this team has access to these resources.’”
Zach Dunn
CISO, Optoro
Need answers?
We are here to help.
What is Pomerium?
Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium provides a standardized interface to add access control to applications regardless of whether the application itself has authorization or authentication baked-in. Pomerium gateways both internal and external requests, and can be used in situations where you’d typically reach for a VPN.
Why should I care about whether components are self-hosted or managed?
Every plan uses a self-hosted data plane to handle application traffic in your environment. Pomerium Zero provides a managed control plane for configuration, policies, and cluster management. Pomerium Enterprise adds a self-hosted control plane, so you operate both planes in your environment.
What layer are you securing?
Pomerium provides layer 7 security. See our post to learn more about layer 7 vs layer 3 & 4 security models (link).
Is Pomerium a VPN?
No. Pomerium is an identity-aware proxy that grants access to specific applications and services. Web applications work in a browser without client software. SSH works with standard SSH clients. TCP and UDP access uses Pomerium CLI or Desktop.
Do you log my traffic?
Pomerium produces access and authorization logs so you can audit requests and access decisions. Your self-hosted data plane handles application traffic in your environment. With Pomerium Zero, the managed control plane receives configuration and operational data for cluster management.
Are you claiming to be Zero Trust?
Pomerium applies identity-based policies before granting access to protected applications and services. It evaluates each HTTP request, including requests within an existing session, using identity and request context. Network location alone does not grant access.
Can I use Pomerium for free?
Yes! Pomerium Zero is free for personal use, and we also offer Pomerium Core, our open source version. We’re confident you’ll love whichever plan you are on.
I have a question you don’t answer here.
No problem. Contact our team at support@pomerium.com, and we’ll gladly help.
