What is Pomerium?

Pomerium is an identity-aware proxy for private applications, services, and AI tools. It verifies identity, checks your access policy, and forwards approved requests.

Get a demo Review the architecture

UserSigned in

Quarterly reports

Quarterly reports

403 Forbidden

If you should have access, contact your administrator with your request id…

200 OK

Pomerium

IdentityACME, Corp employeeOktauser@example.com
Passed
DeviceApproved devicePomerium device identity
Passed
LocationUnited StatesGeoIP data203.0.113.42
Passed
EmploymentActiveBambooHRstatus: active
Passed

All this happens in tens of milliseconds.

GrafanaHTTP(S)

Dashboards

Quarterly reportsGET

Allowed · Request received

Identity and context match the policy. The request reaches Grafana.

Human request: allowed

Identity and context match the policy. The request reaches Grafana.

Caller: User
Request: GET /d/quarterly-reports/overview
Upstream service: grafana.example.com

Context and rule matches

Select a check to see its policy rule.

Requires: Domain is example.com Okta
Domain is example.com. This request matches the condition.
```
allow:
  and:
    - domain: example.com
```
Requires: Device approval is true Pomerium device identity
Device approval is true. This request matches the condition.
```
allow:
  and:
    - device:
        approved: true
```
Requires: Between 09:00 and 17:00 UTC HTTP request
Between 09:00 and 17:00 UTC. This request matches the condition.
```
allow:
  and:
    - time_of_day:
        timezone: UTC
        after: '09:00'
        before: '17:00'
```
Requires: Within 203.0.113.0/24 HTTP request
Within 203.0.113.0/24. This request matches the condition.
```
allow:
  and:
    - source_ip: 203.0.113.0/24
```
Requires: United States GeoIP data
United States. This request matches the condition.
```
allow:
  and:
    - record:
        type: geoip
        field: country
        is: US
```
Requires: Employment is active BambooHR
Employment is active. This request matches the condition.
```
allow:
  and:
    - record:
        type: hr_user
        field: status
        is: active
```

View full policy

Employee access

Allow ACME, Corp employees with an example.com identity and an approved device when their employment is active and the time, network, and location meet the policy.

Device approval requires Enterprise. HR and location values use Enterprise external data sources.

Identity

Domain is example.com. This request matches the condition.

allow:  and:    - domain: example.com    - device:        approved: true    - time_of_day:        timezone: UTC        after: '09:00'        before: '17:00'    - source_ip: 203.0.113.0/24    - record:        type: geoip        field: country        is: US    - record:        type: hr_user        field: status        is: active

Read the documentation

How Pomerium works

Authenticate
Verify the identity behind a request with your existing identity provider.
Authorize
Evaluate the route's access policy using identity and request context.
Access
Forward approved requests to the application. Reject requests that do not meet the policy.

Access decisions with context

Apply policy at each protected route, with identity, context, and logs in one request path.

Protocol-Aware Access

Pomerium operates at Layer 7, which makes it protocol-aware. Your users get to use the tools they already know and love, without a janky wrapper command. You get security controls on each request or action.

Use your browser for private web applications and your standard SSH client for native SSH. TCP and UDP tunnels use a Pomerium client.

See protocol-aware policies

Pomerium connects HTTP, MCP, SSH, gRPC, TCP, and UDP workloads.

Continuous Authorization

Pomerium checks policy on each HTTP request. Access decisions use the identity and context available when the request arrives.

How authorization works

Continuous authorization checks identity, time, location, IP address, and employment status.

Extensible

Use identity claims, device information, and external data in your access policies. Connect your identity provider and the systems you already use.

Use context in access policies

Pomerium integrates external data sources for access decisions.

Full Audit Trail

See who requested access, which route they requested, and why the policy allowed or denied it. Send access and authorization logs to your logging system.

Read the authorization logs

Pomerium records user activity in an audit trail.

Why it matters

Give each identity access to the resources it needs. Pomerium enforces the access policy at the protected route, before forwarding traffic.

Use the same access layer for employees, service accounts, and AI agents, with policies specific to each resource.

Why identity-aware access matters

For security teams

Define who can use each route and use authorization logs to inspect the decision.

For developers and ops

Add authentication and authorization in front of applications without building a separate login and policy system into each one.

Common use cases

Secure Kubernetes access

Control access to Kubernetes APIs and applications with identity-based policies.

Enable distributed access

Give employees and contractors browser access to the web applications they need.

Govern AI agents

Authenticate access to MCP servers and apply policy to the tools an AI agent can call.

Read customer stories

Pick the edition that's right for you

Both editions are built on open-source Pomerium.

Pomerium Zero

Pomerium hosts the control plane. Pomerium Core runs in your environment.

Typically best for: Teams that want simpler management without running a control plane.

Start free

Pomerium Enterprise

You host the control plane and Pomerium Core in your environment.

Typically best for: Large organizations and teams with self-hosting requirements.

Get a demo

Access control that stays out of your users' way