When Pomerium Core is enough and when Zero or Enterprise is needed
Choose Pomerium Core when your team is willing to run its own control plane and accept the operating work that comes with it. Choose Zero when you want Pomerium to host the control plane and management console while the Core cluster and application traffic stay in your environment. Choose Enterprise only when you need a feature Zero does not include, such as directory sync, Rego policies or SSH session recording and playback. The deciding questions are who operates the control plane and which administrative or audit features your team must have.
Core fits teams that can staff the work of hosting, upgrading and monitoring the cluster themselves. Core is listed as open source and self-run, so its recurring costs are the infrastructure and engineering time you carry. Plan a regular upgrade cycle, since Pomerium publishes frequent releases, including v0.33.4 on October 2, 2026. Zero fits teams that want a managed control plane and do not want to run the management console. Its plans have their own limits: Zero Personal allows 1 cluster, 10 routes and 5 policies and is free for personal use, while Zero Business allows 5 clusters, 100 routes, 100 policies and 5 custom domains. Count your routes and policies against those limits before you commit.
Enterprise is worth pricing only when a reserved feature is a hard requirement. Directory sync, FleetDM device posture integration, Rego policies, RBAC for administrators, session management and SSH session recording and playback are all listed for Enterprise. Enterprise uses a self-hosted control plane and custom pricing, so the figure comes from a quote built on written scope. Before you shortlist it, confirm with Pomerium which of your identity and audit requirements Zero already covers, using the plan lists on the Pomerium pricing page. If Zero meets your identity provider and policy needs, Enterprise adds cost without adding coverage you use.
Which capabilities sit in Core, Zero and Enterprise
This table maps the capabilities Pomerium documents for each edition, so you can see which features you get without a hosted control plane, which come with Zero, and which are reserved for Enterprise. Read each row against your access model: if a requirement sits in the Enterprise column, confirm the edition with Pomerium before you design around it.
| Capability | Pomerium Core (open source) | Zero Personal and Zero Business | Enterprise |
|---|---|---|---|
| Clientless web access to internal apps | Included, self-run in your environment | Included, with a managed control plane | Included, with a self-hosted control plane |
| Native SSH, TCP and UDP access | Confirm with Pomerium for your version | Included through the Pomerium CLI or desktop app | Included, plus SSH session recording and playback |
| Kubernetes access and SSO | Confirm with Pomerium for your version | Included | Included |
| mTLS and attribute-based policies | Confirm with Pomerium for your version | Included, with continuous authorization | Included, with Rego policies added |
| Access and audit logs, management API, Terraform | Confirm with Pomerium for your version | Included | Included |
| Directory sync, FleetDM device posture, administrator RBAC, session management | Not listed as included | Not listed as included | Reserved for Enterprise |
| Zero Personal limits | Not applicable | 1 cluster, 10 routes, 5 policies, personal use only | Not applicable |
| Zero Business limits | Not applicable | 5 clusters, 100 routes, 100 policies, 5 custom domains | Not applicable |
How the hosted control plane changes where data and operations sit
With Pomerium Zero, the customer still runs the Pomerium Core cluster in its own environment, and Pomerium hosts the control plane and management console. The pricing page describes this split as keeping application traffic in the customer environment. The practical question for a CISO is therefore which data travels to the hosted control plane and which never leaves the cluster. Ask the vendor, in writing, what configuration, policy definitions, user attributes, session metadata and access logs are sent to the hosted control plane, where they are stored, how long they are kept, and who at Pomerium can read them. The pricing page does not answer those questions, so they belong in the contract or data processing terms rather than in an assumption.
In Pomerium Core, the customer operates everything: the proxy cluster, the identity provider integration, TLS certificates, upgrades to releases such as v0.33.4, configuration management, logging pipelines and the policy files that govern routes. Zero keeps the data plane in the same place but moves the control plane to Pomerium's hosting, so the customer's operating effort shifts toward cluster hosting, network reachability from the hosted control plane, and confirming that its management console access is governed by its own SSO and RBAC settings. Your team should map each of these duties to an owner before choosing a plan, since a hosted control plane reduces some work without removing the need to run the cluster well.
Enterprise uses a self-hosted control plane instead, which keeps the management layer inside the customer's environment as well. That choice matters for regulated teams whose policy requires that administrative data stay on infrastructure they control, but it also means the customer operates the control plane itself. Confirm with Pomerium whether the Enterprise self-hosted control plane has the same feature set as the hosted one, which upgrade path applies to each, and what support covers when a control plane fault affects access to internal applications.
How licensing, support and updates differ by edition
Pomerium's editions differ in who runs the control plane, what the license permits and which features are reserved. The cards below separate the open-source Core and its Kubernetes ingress controller from the Zero plans and Enterprise, and name what to request in writing for each.
Core under Apache-2.0
Pomerium Core is Apache-2.0 licensed and self-run, so you carry the operating work: upgrades, configuration, certificates and incident response. The repository publishes releases on a visible cadence, with v0.33.4 published on October 2, 2026, after v0.33.3 on September 9, 2026. Before adopting a release line, check the release notes for breaking changes and confirm which versions your team will patch and for how long. Community releases carry no vendor support commitment unless you buy it elsewhere.
Kubernetes ingress controller terms
The ingress controller is a separate Apache-2.0 project in its own repository, so its release timing can differ from Core's. Confirm which Core version each controller release is tested against before you pin both in a cluster. Treat the controller as part of your platform's change control, not a drop-in add-on. Ask any commercial provider whether controller fixes are covered by the same support terms as Core.
Zero Personal and Business terms
Zero plans add a managed control plane while your cluster stays in your environment, and the pricing page lists Zero Personal as free for personal use. Zero Business is priced per user per month, billed monthly or annually, with limits on clusters, routes, policies and custom domains. Request in writing the uptime and support response terms, the data the hosted control plane stores, and what happens to policies if you cancel. Confirm whether the personal-use restriction excludes business work.
Enterprise custom terms
Enterprise pricing is custom and the control plane is self-hosted, so you take on that operation yourself. Directory sync, Rego policies, administrator RBAC, session management and SSH session recording are reserved for this edition. Ask for a written list of which features are included, the support hours and severity levels, the patch window for security fixes and the upgrade path between major versions. Ask who owns the license if you later change plans.
Update and support checklist
Across editions, the update path differs: Core updates are yours to schedule, Zero updates depend on the hosted control plane and the cluster you run, and Enterprise adds a self-hosted control plane to maintain. Request a written statement of which component receives security patches, who applies them and how long each release line is supported. Ask how a version mismatch between the control plane and your cluster is handled during an upgrade.
Exit and continuity risks
Moving between editions or away from a hosted control plane changes what you must rebuild. Policies, routes and identity settings may not export in the same form, and a lapsed subscription can stop management access even when traffic continues. Ask in writing for an export format for policies and logs, the notice period for changes to licensing, and whether Core can run your existing configuration without the paid control plane.
Choosing an edition by team size, environment and compliance needs
A single engineer or a small group protecting a handful of internal dashboards often needs the least. Zero Personal is free for personal use and includes a managed control plane, so there is no control plane for you to run. Its limits are tight, so it fits a small set of routes and policies only.
- Personal use terms: Zero Personal is free for personal use. Confirm with Pomerium whether a shared team deployment falls under that term before you rely on it.
- Tier limits: Zero Personal allows 1 cluster, 10 routes and 5 policies.
- Hosted console: Pomerium hosts the management console, while the Core cluster runs in your environment.
- Upgrade path: Zero Business allows 5 clusters, 100 routes, 100 policies and 5 custom domains, listed at $9 per user per month billed monthly or $7 billed annually. Check the Pomerium pricing page for current terms.
- Self-run option: Pomerium Core is Apache-2.0 and self-run, which suits a team that will manage configuration without the hosted console.
Before you commit, count the routes and policies you expect as the application estate grows, since outgrowing a tier is the usual trigger for a change.
With Zero, the Core cluster runs in your environment and application traffic stays there, while Pomerium hosts the control plane and management console. That split suits teams whose data rules cover application traffic but accept a hosted administrative layer. If your rules forbid any externally hosted control plane, the self-run Core edition or Enterprise with a self-hosted control plane is the candidate to evaluate.
- Zero Business: Fits organizations that accept a hosted control plane and need more clusters and policies than the Personal tier allows.
- Core: Apache-2.0 and fully self-run, with no external control plane to approve.
- Enterprise: Pricing is custom and the control plane is self-hosted, so it fits when hosting the control plane is a hard requirement.
- Identity providers: Pomerium documents support for providers including Microsoft Entra ID, Okta, Keycloak and Google, so confirm your provider appears on the supported list.
- Data flow review: Ask Pomerium exactly what metadata the hosted control plane receives, and record the answer for your data protection reviewers.
Place the control plane location on your data flow diagram before choosing a tier, since that answer decides between Zero and the self-hosted options.
Platform teams running services on Kubernetes often want Pomerium as the ingress layer. Pomerium publishes a Kubernetes Ingress Controller under Apache-2.0 in its ingress controller repository, so the ingress path does not depend on a commercial license. Zero also lists Kubernetes access among its features, so check which parts of cluster access need the hosted control plane and which can run entirely in your cluster.
- Core plus controller: Both components are open source, so you can run the ingress path with Core and the controller alone.
- Operational ownership: You own upgrades, certificates and route configuration inside the cluster. Track the Pomerium release line you deploy, since the most recent release listed in the sources is v0.33.4, published on October 2, 2026.
- Zero cluster limits: Zero Business allows 5 clusters, so count clusters across development, staging and production before choosing it.
- Enterprise-only controls: If you need Rego policies or directory sync at the ingress layer, Enterprise is the only tier that includes them.
- Pre-production testing: Run route and policy tests in a non-production cluster to confirm behavior before a cutover.
Confirm with Pomerium that the controller features you need are available in the Core release you plan to run, because the feature split follows the edition.
Regulated organizations often need controls that Pomerium reserves for Enterprise: directory sync, Rego policies, RBAC for administrators, session management, and SSH session recording and playback. If an assessor expects those controls to be enforced and evidenced, Core and Zero do not include them, so Enterprise becomes the edition to scope. Enterprise pricing is custom and its control plane is self-hosted.
- Directory sync: Keeps group membership aligned with your directory, which matters when access reviews depend on that data.
- Rego policies: Express authorization logic in Rego when the attribute-based policies available in lower tiers do not cover your rules.
- Administrator RBAC: Limits who can change routes and policies, a common question in access control reviews.
- SSH session recording: Playback supports investigations, but confirm retention and storage against your records policy.
- Compliance evidence: DeployOpen can prepare configurations, controls and evidence for an assessment, but independent auditors issue any attestation. Request a written quote tied to your defined scope.
Map each control your assessor expects to a specific edition feature before you request a quote, so the scope matches the evidence you will need to show.
What each edition costs and what drives the total
This table separates what each Pomerium edition charges for from what you pay to run it. Read it as a checklist: the subscription line is published for Zero, the Enterprise price is quoted, and Core costs are mostly your own engineering and operating time.
| Cost component | Pomerium Core | Zero Personal and Business | Enterprise |
|---|---|---|---|
| Software licence | Free under Apache-2.0 (Pomerium pricing page lists Core as open source and self-run) | Zero Personal is free for personal use. Zero Business is $9 per user per month billed monthly or $7 billed annually (Pomerium pricing page). | Custom pricing with a self-hosted control plane. Ask for the figure in writing and the term it covers. |
| What is paid for | Nothing to Pomerium. You provide the hosts, load balancers, identity provider and staff time. | The hosted control plane and management console. Application traffic still runs in your environment. | Reserved features such as directory sync, Rego policies, administrator RBAC and SSH session recording and playback, plus the self-hosted control plane. |
| Recurring or one-time | Recurring infrastructure and operating time. No vendor subscription. | Recurring, per user for Business. Personal is free for personal use only. | Recurring subscription, with the scope and renewal terms set by the quote. |
| Implementation and operating effort | One-time build of the cluster, identity provider wiring and policies, then ongoing upgrades and monitoring. Effort is yours or a services partner's, and no vendor figure was published. | Lower build effort for the control plane, but you still run the Core cluster, routes and policies in your environment. | Vendor-side onboarding and self-hosted control plane operations. Confirm which parts Pomerium delivers and which fall to your team. |
| What raises the total | Number of hosts, routes and environments, plus the staff hours to patch and troubleshoot them. | User count for Business, plus clusters, routes, policies and custom domains. Zero Business allows 5 clusters, 100 routes, 100 policies and 5 custom domains, while Zero Personal allows 1 cluster, 10 routes and 5 policies. | Feature needs (directory sync, Rego, SSH recording) and the size of the self-hosted control plane. |
| What keeps it down | Standardize on fewer clusters, reuse policy templates and automate deployment with Terraform-style configuration. | Confirm the route and policy counts you need now and in twelve months before choosing a plan. Check whether a Personal plan fits your use. | Only buy Enterprise features you need, and ask which features are required for compliance versus convenience. |
| What to ask for in a quote | Not applicable. Budget your own hosting, support and staff time. | Confirm the billing cycle, how user counts are counted, overage rules and which limits apply to each plan. | Written scope, feature list, control plane hosting model, support terms, renewal and price-change clauses, and exit or data export terms. |
Moving from Core to Zero or Enterprise, and back
This sequence moves a self-run Pomerium Core deployment onto a Zero plan while the cluster keeps running in your environment, then reverses the move if you return to self-run Core. Each step closes with a check you can verify before the next one starts. Enterprise is a separate decision that depends on a written quote.
Check Core against Zero plan limits
Your platform owner counts clusters, routes, policies and custom domains in the current Core configuration and compares them with the Zero Business limits of 5 clusters, 100 routes, 100 policies and 5 custom domains, or the Zero Personal limits of 1 cluster, 10 routes and 5 policies. Use the Pomerium pricing page to confirm current plan terms. The step closes with a signed inventory that shows either which plan fits or that the deployment exceeds Zero limits and needs an Enterprise quote instead.
Export identity and policy configuration
Record every identity provider connection, such as Keycloak, Okta or Microsoft Entra ID, with its client settings and redirect URIs, plus each route and policy definition in your Core deployment. Ask Pomerium whether an import or export path exists for Zero and whether it carries policy definitions over unchanged. The step is done when you hold a versioned copy of the configuration and the identity provider settings outside the running cluster.
Connect the existing cluster to Zero
Create the Zero workspace and register your existing Core cluster with its managed control plane. Under the Zero model you run the Core cluster in your own environment, while Pomerium hosts the control plane and management console, so application traffic stays in your environment. Your platform team completes registration with Pomerium's current setup instructions. The step is done when the cluster shows as connected in the management console and a test route still serves traffic through your own ingress.
Map routes and policies to Zero
Recreate each route and policy in the Zero console or through the management API, starting in a staging cluster. Count the results against the plan limits from step one and group routes by application owner so each batch can be tested separately. Flag any rule that depends on features Pomerium reserves for Enterprise, including Rego policies, directory sync and RBAC for administrators. The step is done when every route has a test record and every flagged rule has a documented decision to redesign it with Zero's attribute-based policies or move to Enterprise.
Test each access path before cutover
Verify clientless web access, native SSH, TCP and UDP access through the Pomerium CLI or desktop app, Kubernetes access, mTLS and attribute-based policy decisions against staging. Use test accounts from each identity group and confirm that access and audit logs record each test. Agree the cutover window, the rollback trigger and the approver in writing before production work starts. The step is done when each test result is recorded and the approver has signed off on the rollback plan.
Cut over with rollback ready
Move production routes to the Zero-managed configuration in batches, keeping the Core configuration files and the previous ingress definitions intact until each batch is stable. Watch access logs and error rates after every batch, and restore the saved Core files if a batch fails. The step is done when all production routes serve through the cluster under Zero management and the saved Core files are archived with a dated change record.
Return to self-run Core when needed
To move back, export the route and policy definitions from Zero and write them into your Core configuration, reusing the identity provider settings you recorded in step two. Apache-2.0 Core runs in your environment without the hosted control plane, so your team then owns configuration changes and upgrades. Run Core alongside Zero for a test period, cut over, and disconnect the cluster from the managed control plane. The step is done when Core serves all routes, login works through each identity provider, and the Zero registration is removed. For Enterprise, confirm the self-hosted control plane terms and the custom quote before any move up.
Questions buyers ask before choosing a Pomerium edition
Is Pomerium Core alone enough for single sign-on?
For many internal web apps, yes. Core is Apache-2.0 licensed, and Pomerium uses OAuth 2.0 and OpenID Connect for user identity, with documented support for providers such as Keycloak, Microsoft Entra ID and Okta. Core handles the proxy, the login flow and the access rules you write for each route. The features that sit in the paid tiers include the hosted control plane, directory sync, Rego policies and administrator RBAC. If your estate is web-first, your identity provider already holds users and groups, and your team is comfortable managing routes and policies in configuration, Core may be enough. Confirm against the current Core documentation which policy features you need, then test your exact provider configuration before you decide.
What do the paid Pomerium editions add that matters to security teams?
It depends on the controls your reviewers ask for. The Zero plans include a managed control plane and console while your cluster still runs in your environment, along with a management API, Terraform support, access and audit logs, mTLS, attribute-based policies, continuous authorization, and native SSH, TCP and UDP access through the Pomerium CLI or desktop app. Enterprise reserves directory sync, Rego policies, RBAC for administrators, session management, and SSH session recording and playback. These matter most if you must review recorded SSH sessions, express policy in Rego, or separate administrator duties. If the logs you already collect from Core satisfy your reviewers, you may not need them. Ask Pomerium to confirm in writing which logs and controls each tier provides.
What does running Pomerium need from our platform and security staff?
Plan for skills in three areas: reverse proxy configuration and TLS, your identity provider's client and group setup, and the network path to each internal service. If you run Pomerium as a Kubernetes ingress, the team that operates your clusters also needs to own the Apache-2.0 ingress controller. Work that stays with your staff includes route and policy maintenance, upgrades, certificate renewal, log review and incident response. Zero moves the control plane and console to Pomerium's hosting, which reduces what your team operates, but the proxy path still runs in your network. Map an owner to each item before you choose an edition, because that map shows whether you need outside help.
Can our team run Pomerium Core ourselves?
Yes. Core is open source under Apache-2.0 and is listed as open source and self-run, so the software itself carries no license fee. Your team installs the release, writes route and policy configuration, and carries the operating load. The supplied release history lists v0.33.4, published on October 2, 2026, so check the release notes on the Pomerium GitHub releases page before you pin a version. Self-run also means you own security patches, configuration backups and regression testing after each upgrade. Start with a pilot on one or two lower-risk apps, and confirm the upgrade path and support options with Pomerium before you expand.
How long does moving between Pomerium editions take, and what drives the effort?
The supplied facts do not include a migration duration, so ask for one in writing once the scope is fixed. Effort is driven by the number of clusters, routes, policies and custom domains you move, and by whether you change identity providers at the same time. Zero Personal allows 1 cluster, 10 routes and 5 policies, while Zero Business allows 5 clusters, 100 routes, 100 policies and 5 custom domains, so growth past those limits forces a tier change. Other drivers include rewriting policies into Rego if you adopt Enterprise, rolling out SSH session recording, and training administrators on RBAC. A move of a small estate differs greatly from a phased move of a large one, so ask the vendor or any implementation partner to estimate from your route and policy inventory.
What does Pomerium Zero cost, and which charges recur?
The pricing page lists Zero Business at $9 per user per month billed monthly, or $7 per user per month billed annually. Zero Personal is free for personal use, and Enterprise is custom priced with a self-hosted control plane. Zero charges recur per user, so headcount and billing period drive the total. Confirm whether the seat count covers service accounts or only people. Core has no license fee, but it carries your own infrastructure, staff time and any outside support, all of which recur. Ask Pomerium in writing whether the annual rate is a commitment, how cluster, route or policy overages are priced, and what Enterprise includes at its custom rate. Review the Pomerium pricing page for the current terms.
Can DeployOpen scope a Pomerium deployment as a fixed-scope engagement?
Yes. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope. For Pomerium, the scope could cover choosing the edition, deploying Core or the Zero data plane in your environment, connecting your identity provider, writing route and access policies, hardening, backup, upgrades and documentation. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen does not publish a price list, and it does not issue audit reports or certifications, so any compliance evidence comes from your independent assessor. Bring your route inventory, identity provider details and target edition to the first scoping conversation.
What the paid edition is worth to a regulated team
The paid edition is worth its cost only when a specific control gap exists that Core cannot close. Pomerium reserves directory sync, Rego policies, RBAC for administrators, session management and SSH session recording and playback for Enterprise, so the first step is to write down which of these your auditors, risk owners or internal policy actually require. Directory sync matters when group membership must flow from a directory into Pomerium policy automatically and be removed when a person leaves. Rego policies matter when your authorization logic is too complex for attribute-based policies in Zero or when you already maintain Open Policy Agent rules. Administrator RBAC matters when more than a handful of people change routes and policies and you need to separate those duties. SSH session recording matters when a regulation or contract requires a replayable record of privileged shell sessions, not only access logs.
If your identity provider already handles authentication and group membership, you may only need the proxy layer. Many regulated teams run Keycloak, Microsoft Entra ID or another OIDC provider that already holds users, groups and MFA policy. In that case Pomerium Core or Zero can sit in front of internal web apps and use the existing sign-in, and directory sync adds less value because the groups already exist upstream. Confirm with your identity team whether the provider's groups can be passed as claims that your policies can read, and whether MFA and session lifetimes are enforced there. Also confirm which Pomerium features your current route policies need, and whether the Zero plan limits on clusters, routes, policies and custom domains cover your estate before you assume a paid upgrade is needed.
Ask the vendor for the Enterprise scope in writing before budgeting. Pomerium publishes Enterprise pricing as custom, and the self-hosted control plane is part of that tier, so the quote will depend on your deployment size and the features you need. Ask which components are included, who supports the self-hosted control plane, how upgrades are handled, and what happens to recorded SSH sessions and audit data during a renewal or exit. Keep Zero as the comparison point for the same controls, because a regulated team that needs only attribute-based policy, audit logs and SSO may not need to pay for Enterprise at all. The decision should follow the control requirement, not the feature list.
How DeployOpen scopes and supports Pomerium deployments
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the Pomerium edition you pick is installed, tested and handed over in your environment. We start from the edition and control plane decision, then agree the written scope before any work begins.
How we scope
- Written scope covers which Pomerium edition applies, and whether a Zero control plane or a self-hosted Enterprise control plane fits your policy.
- We list the identity providers, routes, clusters and admin roles in scope, so licensing limits are checked before deployment starts.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts. Ask for the quote to follow from that document.
How we build
- We deploy the Pomerium Core cluster in your cloud account, data center or air-gapped network, so application traffic stays in your environment.
- We integrate your identity provider, configure policies and test access paths for web apps, SSH and Kubernetes services where they apply.
- We run security testing against the deployed routes and policies, and record the results alongside the configuration.
How we hand over
- Documentation covers the architecture, policy configuration, edition limits and the steps to add routes, clusters and identity providers.
- We provide operating runbooks for upgrades, backups and access log review, written for the team that will run Pomerium after handover.
- Compliance readiness material maps the access controls and evidence to your framework. Independent auditors issue any attestation or certification.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, sized to the edition and the number of clusters you run.
- Ask us to confirm current Pomerium release lines, edition features and pricing directly with the vendor before each upgrade decision.
- Retainer scope, response expectations and upgrade windows are written into the agreement, so your team knows what is covered.
