Clientless application access
Provides web-based access to protected applications without a VPN or client-side software, reducing the need to distribute and maintain an access client.
Pomerium
Freemium
Pomerium is a zero-trust, identity-aware proxy that provides clientless access to web applications and critical workloads without a VPN. It helps security, development, and operations teams authenticate, authorize, and audit requests across human, machine, and agentic identities.
What is Pomerium?
Pomerium is a Layer 7, identity-aware reverse proxy for clientless access to web applications and critical workloads. It provides secure connections without a VPN or client-side software by authenticating requests, applying authorization policies, and proxying approved traffic to upstream applications.
Pomerium integrates with OIDC-compliant identity providers and can incorporate device context into access decisions. Its zero-trust model authenticates and authorizes every request rather than granting implicit trust after a user signs in. Policies can be managed through a builder UI or expressed as YAML-style policy as code.
The platform centralizes routes, policies, users, sessions, service accounts, and operational data. It logs requests and sessions for auditing, supports continuous policy enforcement, and can pass cryptographically signed JWTs to upstream applications.
What can Pomerium do?
Identity-aware authorization
Authenticates through an OIDC-compliant identity provider and enforces fine-grained, policy-based authorization for requests to upstream applications.
Policy as code and policy builder
Supports YAML-style authorization policies as well as a policy builder UI for defining access rules, including conditions based on identity and available device context.
Centralized audit and administration
Brings users, routes, policies, sessions, service accounts, events, and runtime data into a common administrative interface, with request and session logging for review.
Signed JWT access to upstreams
Connects approved requests to upstream applications through cryptographically signed JWTs, supporting application-level authentication and additional request context.
Continuous verification
Re-evaluates policy during an established session and logs requests, rather than treating the initial sign-in as the only access decision.
Use Cases
“Secure Kubernetes access”
Protect Kubernetes ingress, kubectl, Gateway API, and upstream applications without requiring a client, using identity-aware access policies at the gateway.
“Distributed workforce access”
Give remote employees and distributed teams access to internal applications through browser-based connections instead of relying on a VPN workflow.
“Contractor and time-bound access”
Apply scoped or just-in-time permissions for contractors and other non-permanent users, with centralized policy changes, revocation, and audit records.
“Internal services and APIs”
Place internal APIs, secure service access, and other application-to-application connections behind a common authorization layer with service-account support.
“Agentic workflows”
Use Pomerium as a gateway for AI agents, prompts, autonomous workflows, and model endpoints so agent actions can be authorized and logged per request.
Frequently Asked Questions
Does Pomerium require a VPN or client software?
No. The product is described as providing web-based, clientless access to applications without a VPN or client-side software.
How does Pomerium authenticate users?
Pomerium integrates with an existing OIDC-compliant identity provider. The site specifically names Okta, Entra ID, and Google as examples, and also references a hosted authentication service or bringing your own provider.
How are access rules defined?
Access rules can be written as YAML-style policy as code or managed through Pomerium’s policy builder UI. The site describes fine-grained, identity-aware policies and support for device context where available.
Can Pomerium be self-hosted?
Yes. The business offering uses a self-hosted data plane with a hosted control plane, while Enterprise is described as a fully self-hosted, on-premise solution. The free personal offering also includes a self-hosted reverse proxy.
What deployment and pricing options are shown?
The pricing page lists a free personal plan, a business plan priced per user, and an Enterprise plan with custom pricing. The business plan offers a free trial, while Enterprise uses a contact-sales flow; exact limits vary by plan.
Quick Facts
- Category
- Zero-trust access and identity-aware reverse proxy
- Access model
- Clientless, web-based application access without a VPN
- Policy model
- YAML-style policy as code and policy builder UI
- Identity support
- OIDC-compliant identity providers, including Okta, Entra ID, and Google
- Deployment options
- Managed control plane with self-hosted data plane, or fully self-hosted Enterprise
- Interfaces
- Web UI, CLI, and API
Pomerium Alternatives
ManageEngine
manageengine.com
Enterprise IT management software for IT operations, security, identity, endpoints, and service delivery teams.
Immuta
immuta.com
Immuta is a data provisioning and governance platform for controlling access, fulfilling requests, and auditing data across connected systems for people and AI agents.
Wald
wald.ai
Context-aware AI data security for enterprises governing employee use of LLMs and AI applications.
Checkr
checkr.com
Background checks and identity verification for hiring, lending, housing, and platform trust workflows.
Abnormal AI
abnormal.ai
Behavioral security for organizational email, identities, and AI governance.
Nightfall
nightfall.ai
Data loss prevention for security teams governing data across AI, endpoints, SaaS, and email.