# Pomerium Pomerium is a zero-trust, identity-aware proxy that provides clientless access to web applications and critical workloads without a VPN. It helps security, development, and operations teams authenticate, authorize, and audit requests across human, machine, and agentic identities. - Findings24: - Website: - Pricing: Freemium - Categories: Business Software ## What is Pomerium? Pomerium is a Layer 7, identity-aware reverse proxy for clientless access to web applications and critical workloads. It provides secure connections without a VPN or client-side software by authenticating requests, applying authorization policies, and proxying approved traffic to upstream applications. Pomerium integrates with OIDC-compliant identity providers and can incorporate device context into access decisions. Its zero-trust model authenticates and authorizes every request rather than granting implicit trust after a user signs in. Policies can be managed through a builder UI or expressed as YAML-style policy as code. The platform centralizes routes, policies, users, sessions, service accounts, and operational data. It logs requests and sessions for auditing, supports continuous policy enforcement, and can pass cryptographically signed JWTs to upstream applications. ## What can Pomerium do? ### Clientless application access Provides web-based access to protected applications without a VPN or client-side software, reducing the need to distribute and maintain an access client. ### Identity-aware authorization Authenticates through an OIDC-compliant identity provider and enforces fine-grained, policy-based authorization for requests to upstream applications. ### Policy as code and policy builder Supports YAML-style authorization policies as well as a policy builder UI for defining access rules, including conditions based on identity and available device context. ### Centralized audit and administration Brings users, routes, policies, sessions, service accounts, events, and runtime data into a common administrative interface, with request and session logging for review. ### Signed JWT access to upstreams Connects approved requests to upstream applications through cryptographically signed JWTs, supporting application-level authentication and additional request context. ### Continuous verification Re-evaluates policy during an established session and logs requests, rather than treating the initial sign-in as the only access decision. ## Use Cases ### Secure Kubernetes access Protect Kubernetes ingress, kubectl, Gateway API, and upstream applications without requiring a client, using identity-aware access policies at the gateway. ### Distributed workforce access Give remote employees and distributed teams access to internal applications through browser-based connections instead of relying on a VPN workflow. ### Contractor and time-bound access Apply scoped or just-in-time permissions for contractors and other non-permanent users, with centralized policy changes, revocation, and audit records. ### Internal services and APIs Place internal APIs, secure service access, and other application-to-application connections behind a common authorization layer with service-account support. ### Agentic workflows Use Pomerium as a gateway for AI agents, prompts, autonomous workflows, and model endpoints so agent actions can be authorized and logged per request. ## Frequently Asked Questions ### Does Pomerium require a VPN or client software? No. The product is described as providing web-based, clientless access to applications without a VPN or client-side software. ### How does Pomerium authenticate users? Pomerium integrates with an existing OIDC-compliant identity provider. The site specifically names Okta, Entra ID, and Google as examples, and also references a hosted authentication service or bringing your own provider. ### How are access rules defined? Access rules can be written as YAML-style policy as code or managed through Pomerium’s policy builder UI. The site describes fine-grained, identity-aware policies and support for device context where available. ### Can Pomerium be self-hosted? Yes. The business offering uses a self-hosted data plane with a hosted control plane, while Enterprise is described as a fully self-hosted, on-premise solution. The free personal offering also includes a self-hosted reverse proxy. ### What deployment and pricing options are shown? The pricing page lists a free personal plan, a business plan priced per user, and an Enterprise plan with custom pricing. The business plan offers a free trial, while Enterprise uses a contact-sales flow; exact limits vary by plan. ## Quick Facts - **Category**: Zero-trust access and identity-aware reverse proxy - **Access model**: Clientless, web-based application access without a VPN - **Policy model**: YAML-style policy as code and policy builder UI - **Identity support**: OIDC-compliant identity providers, including Okta, Entra ID, and Google - **Deployment options**: Managed control plane with self-hosted data plane, or fully self-hosted Enterprise - **Interfaces**: Web UI, CLI, and API