We are changing how we license Pomerium builds
Table of contents
What
Starting today with the release of v0.34, Pomerium’s official builds, binaries, and images are moving to the Pomerium Community Edition License while the source code remains Apache 2.0.
TL;DR*, what this means for you:
- Source code: No changes. Code is licensed under Apache 2.0 as before.
- Existing customers and Zero users: No changes.
- Hobbyists & small teams (< 100 employees && < $10M revenue): No changes. Future versions will add access to previously Enterprise-only features.
- Large companies (>100+ employees || >$10M+ revenue) running our builds. A commercial relationship is required to run v0.34 onwards, reach out to hello@pomerium.com.
Are you a hobbyist, homelab user or representing a company under 100 employees and $10M USD in annual revenue?
YesNo changes. You can continue using Pomerium under Apache 2.0.
NoDo you have a commercial agreement with Pomerium?
YesYour agreement supersedes these changes.
NoAre you representing a company with over 100 employees or $10M USD in annual revenue?
YesReach out to hello@pomerium.com to discuss commercial options.
Why?
In the years since Pomerium started we’ve had billions of downloads, with both hobbyists and the world’s largest companies trusting Pomerium to protect sensitive data and critical workloads. All for free under an extremely liberal license, and I’m deeply proud of that.
But AI has changed how companies use and build on products like Pomerium. Companies are shifting spend from software licenses to tokens, and attempting to vibe code features that traditionally led them to purchasing our Enterprise license – which in turn supported the open source ecosystem.
Moreover, we’ve seen an order of magnitude increase in inbound vulnerability reports and upstream CVEs needing triage. Of course, because Pomerium is critical infrastructure and we take security seriously, every single report has to be triaged, verified, and patched.
Ultimately, what we cannot do anymore is build, test, patch, and distribute production-ready binaries for billion-dollar companies for free.
So what
We feel that the line we’ve drawn (>$10M in revenue or >100 users) is fair, and sets us up to maintain a sustainable future that supports hobbyists and small teams. Another thing this unlocks that I’m excited about is the ability to bring functionality that is currently only in Enterprise distributions of Pomerium — including the Enterprise Console, session recording, and more — to hobbyists and small teams for free.
To our community, thank you for supporting us since 2019. I know software license changes can feel off-putting, and – just to be direct – even feel like a rug pull in some cases. That is not our intention at all. I would ask you to give us a chance to prove that's not the case here. We think these changes will make Pomerium open source better and more capable for all users. And just to reiterate, pomerium’s code will remain licensed under Apache.
To the engineering & security leaders at large companies relying on Pomerium every day, we are grateful for the trust you’ve put in Pomerium to secure some of your most important workloads. If you value the work we do to keep your infrastructure secure, please reach out to us at hello@pomerium.com and let’s get you on a commercial license.
– Bobby
*Please read the actual license so my lawyers don’t yell at me.
