- Free allowance
- Zero Personal: 'Free'; managed control plane, one Core cluster run by the user, 10 routes, 1 cluster, 1 administrator, 1 custom domain.
- Verdict
- self-hosted, last resortverdict fails-egress: data cannot be read back out at a usable rate or price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented15 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | Zero Personal: 'Free'; managed control plane, one Core cluster run by the user, 10 routes, 1 cluster, 1 administrator, 1 custom domain. No byte, bandwidth or traffic allowance is published. unit mixed; metered on none; The plan is denominated in routes (10), clusters (1) and administrators (1); the vocabulary has no routes unit, so mixed is the nearest term. |
|---|
| Price | none stated |
|---|
| Binding | none no byte, request or bandwidth cap is published, because the data plane runs on the user's own host; the route-count caps are not a volume meter |
|---|
| Identity | email a Pomerium Zero account is required ('Create a (free) Pomerium Zero account'), and the account is associated with an email address; the sign-up form fields are not in the captured page, so whether it asks for more than an email is unverified: behind a sign-up. The open-source Core needs no account. |
|---|
| Egress | No byte cap, bandwidth cap or traffic meter is published on the pricing page, the reverse-tunneling page or the native SSH page. Traffic does not pass through the vendor: the data plane runs on a host the user supplies, and the vendor states 'there are no ingress or egress costs'. The only published tolerance is the 30 s default upstream route timeout for HTTP routes. free allowance: none published |
|---|
| Interface | ssh, cli an OpenSSH client run as ssh -R 0 HOST registers as the upstream of an HTTP or SSH route (runtime flag ssh_upstream_tunnel); pomerium-cli carries TCP routes |
|---|
| Tooling | the user installs and runs the Pomerium Core data plane on a rented or free machine with a public address; the hosted Zero Console configures it; clients use a stock OpenSSH client |
|---|
| Composes with | The hosted Zero control plane and starter domain come first; the byte-carrying data plane is software the user installs and runs on a rented or free machine, so a public reader reaches the tunnel only through a host the user supplies, last in any chain. |
|---|
| Reliability | the reverse-tunneling mode is opt-in behind the ssh_upstream_tunnel runtime flag, and an HTTP route times out an upstream request after 30 s by default |
|---|
| Notes | Fails as a public ingress because no hosted relay exists: every plan runs the data plane on the user's host, and Zero Personal manages only the control plane (configuration, policies, starter domain, certificates). The first paid plan is Zero Business at $9 per user per month billed monthly or $7 billed annually (100 routes, 5 clusters, 20 administrators). The reverse tunnel carries HTTP and SSH routes, not UDP. Pomerium Enterprise has a self-hosted control plane at a custom price. |
|---|
| Evidence note | documented first-party pricing, reverse-tunneling and native SSH pages were captured and quoted; no tunnel was run, and the account sign-up form was not seen, so the identity detail is partly unverified |
|---|
| Parsed numbers | |
|---|