What is Pomerium?

Pomerium is an identity-aware reverse proxy, built on top of Envoy. It's a better IAM solution than your existing VPN and PAM.

Get Started Read the Docs

Benefits

Clientless, continuous, and conditional access control that
works with on-prem, cloud and hybrid workloads

Multi-Protocol Support

Support all workloads from human, machine, AI with native, clientless support for HTTP, MCP, SSH, gRPC, TCP, UDP and more.

Clientless

Replace your VPN, reduce IT overhead, and eliminate client-side bloat. Pomerium improves your security posture without the need for client side software so users can access resources from anywhere.

Extensible

Works out of the box with your existing OIDC-compliant IdP. Pre-built integrations and flexible APls allow for additional context to be utilized for access decisions.

Centralized Management

Pomerium is a single pane of glass to manage access via the Ul or via laC capabilities. Works out of the box with your existing OIDC-compliant IdP to create a centralized AuthN and AuthZ plane across all your workloads. Regardless of if those workloads are run entirely in one or many clouds, on-prem or in a hybrid environment.

Continuous Authorization

With traditional access control systems, once access is granted to the network or even the application, the user has complete access for the session length. With Pomerium, every single request is re-evaluated and re-authorized, enabling instant revocation.

Full Audit Trail

Capture access logs for every request. Know who accessed what, when, and under what policies – across human, machine and AI identities. Generate fully compliant and traceable reporting.

Fully Self Hosted,
Fully Zero Trust

Pomerium's architecture follows the guidelines established by the NIST 800-207 Zero Trust Architecture standard and the Google BeyondCorp white papers. True zero trust architecture that ensures data sovereignty.

Access control that stays out of your users' way

Authenticate

Integrates with ility your existing OIDC-compliant identity provider (IdP).

Authorize

Policy enforcement powered by YAML-style policy as code.

Access

Connect to upstream applications via cryptographically-signed JWTs.

Frequently Asked Questions

VPNs grant broad network access with no user-level controls. Pomerium provides identity-aware, per-app access with real-time policy enforcement and full audit logs — no client installs, no flat tunnels. You get zero trust security at the app layer, not the network layer.

Pomerium is a zero trust access platform that goes beyond traditional ZTNA. It enforces context-aware policies per request using identity, device, and session data across services, APIs, and AI agents, not just user-to-app connections.

Yes. Pomerium integrates with any OIDC-compliant IdPs such as Okta, Azure AD, Google, Auth0, OneLogin, Ping, and any other generic OIDC provider. You can use your existing IdP, no need to migrate users or manage a separate identity system.

Yes that is one of Pomerium's key benefits. You can run Pomerium in any environment, including Kubernetes, AWS, GCP, Azure, VMs, or bare metal. It requires no special infrastructure and works across hybrid and multi-cloud setups delivering consistent, centralized policy enforcement everywhere you deploy.

Pomerium's open-source Core is free and fully self-hosted. Pomerium Zero provides a hosted control plane for smaller teams in addition to the self-hosted data plane. Pomerium Zero starts at $7/user/mo. Pomerium Enterprise is fully self-hosted and adds centralized management, governance, and audit capabilities for larger organizations. Contact us for Enterprise pricing.