If you’re evaluating PAM tools or infrastructure access products, you’ll likely compare Formal with something you already know. These pages are our side of that comparison, written so you can check every vendor fact yourself.

Who writes these comparisons?

Formal writes and publishes every page in this section. We’re one of the two products on each page, so read it as a vendor’s view, not an independent review. Facts about the other product come only from that vendor’s own docs and pricing pages, listed as numbered sources with the date we read them. Where a vendor’s docs don’t cover a point, we say so instead of guessing.

Which products do we compare Formal with?

We write a comparison when a product overlaps with Formal PAM or Formal Endpoint (access for engineers and AI agents to databases, SSH hosts, Kubernetes and APIs) and people search for an alternative to it. Today that’s Teleport and StrongDM. Each page is Formal vs one product, not a ranked list of competitors.

What does each comparison cover?

Every page compares Formal and the other product on the same core points:

  • Architecture: where the proxy or agent runs and which traffic it sees
  • Resources: which databases, servers, clusters and apps it protects
  • Query-level controls: what it can allow, block or mask inside a session
  • AI agents: how agent access is identified and controlled
  • Deployment: what you run, and where

Some pages add points that matter for that product, such as just-in-time access, approvals and session recording.

What is Formal?

Formal is two proxies managed through one control plane. Formal PAM runs the Connector, a reverse proxy in your VPC in front of databases, Kubernetes, SSH hosts and APIs: it identifies the user, evaluates policies against requests and responses, and records sessions. Formal Endpoint runs on laptops, VMs and pods as a forward proxy that controls outbound traffic from workstations and agent sandboxes.

The Control Plane manages both, but it can’t interact with your data: only the Connector and Endpoint can (architecture docs). New to the category? Start with what privileged access management is.