Zero-trust access and business VPN · Comparison
Tailscale vs Cloudflare Zero Trust vs Twingate: Cloudflare 8.2, Twingate 7.3, Tailscale 6.8; 25 users cost $0 to $200
We read the pricing, trust, legal, help center and developer pages of three zero-trust access services on the same day and scored them on the same six indicators. What 25 users cost, where SSO, SCIM, posture and logs sit, and who should pick which.
On this page9 sections
On six indicators read from each vendor's public pages, Cloudflare Zero Trust scores 8.2 out of 10, Twingate 7.3 and Tailscale 6.8. For our reference scenario, 25 users with a laptop and a phone each reaching 10 servers, signing in with the company identity provider, with group-based access rules and an admin audit log, Cloudflare's Free plan costs $0, Twingate Teams $125 a month billed yearly and Tailscale Standard $200 a month. Cloudflare stands out for putting access, DNS and web filtering and posture integrations on a free plan for up to 50 users; Twingate for per-resource access through connectors you run, from $5 per user; Tailscale for a direct WireGuard mesh with unlimited user devices and Okta or Entra ID sign-in, SCIM and MDM posture on its first paid plan.
Cloudflare is in the Excellent band and the other two in the Good band. The scores measure what the public pages commit to, not connection speed or how well each product works day to day, and we did not sign up for any of them.
At a glance
| Tailscale | Cloudflare Zero Trust | Twingate | |
|---|---|---|---|
| What you pay for | A WireGuard mesh with one policy file | Access, web filtering and posture on Cloudflare's network | Per-resource access through connectors you run |
| How traffic flows | Directly between devices, relays when needed | Through Cloudflare data centers | Through your Connectors, relayed end to end encrypted |
| Free option | Personal: 6 users, non-commercial only | Free: 50 users, business use allowed | Starter: 5 users |
| Reference scenario (25 users) | $200 on Standard, $8 per user | $0 on Free | $125 on Teams (yearly), $5 per user |
| Okta or Entra ID sign-in | Every plan | Every plan | Business ($10 yearly) |
| SCIM | Standard and up | No plan restriction stated | Business and up |
| Device posture with MDM or EDR | Standard and up | Every plan | Business and up |
| Network flow logs | Premium, 30 days | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 7 days on Teams |
| SIEM streaming | Premium ($18) | Contract, per the plans page | Business, per the docs |
| Score (public pages) | 6.8 Good | 8.2 Excellent | 7.3 Good |
What the public pages show
Tailscale sells per user and does not count user devices. Personal is free for up to 6 users for non-commercial use; Standard ($8 per user a month) adds unlimited users, SCIM and posture integrations with MDM and EDR tools; Premium ($18) adds network flow logs and log streaming. Identity-provider sign-in, default-deny ACLs, subnet routers and exit nodes are on every plan. The pricing page shows one price per plan with no billing term, and annual plans go through sales.
Cloudflare Zero Trust combines Access, the Gateway filter and a device client. The Free plan covers up to 50 users with sign-in through any SAML or OIDC provider, access policies, posture integrations, the cloudflared connector and DNS and web filtering. Pay-as-you-go is $7 per user a month; the Contract plan, priced by sales, lists Logpush to a SIEM, longer retention and add-ons such as dedicated egress IPs.
Twingate replaces the VPN server with Connectors deployed in each network and grants access per Resource. Teams is $5 per user a month billed yearly ($6 monthly) for up to 100 users, with Google Workspace sign-in, native posture checks and the admin audit log. Okta, Entra ID, SCIM and MDM or EDR integrations start on Business at $10 yearly ($12 monthly).
Strengths and things to know
Tailscale. Strengths: identity-provider sign-in and access rules on every plan; unlimited user devices; the policy file as code through the API, GitOps or Terraform; relays you can host yourself. Things to know: flow logs and SIEM streaming start on Premium; there is no published annual price and fees are non-refundable; there is no HIPAA BAA or EU residency guarantee; and a few pages disagree, for example on basic SSH hosts on Standard.
Cloudflare Zero Trust. Strengths: nearly every feature our scenario needs on the Free plan; DNS, HTTP and network filtering built in; any SAML or OIDC provider; SOC 2 Type II and ISO 27001 with all plans in scope. Things to know: activity logs are kept 24 hours on Free; once seats run out, more users are blocked at login; egress IPs, EU storage and a BAA are Enterprise items; and the pages disagree on whether Pay-as-you-go is billed monthly or annually and whether Logpush needs a contract.
Twingate. Strengths: the lowest paid price here for the scenario; connectors you control, with traffic end-to-end encrypted through relays; a free plan for 5 users with no non-commercial restriction stated; the Admin API, Terraform and Pulumi on every plan. Things to know: Okta and Entra ID sign-in, SCIM and MDM posture need Business; Teams keeps logs 7 days; every admin, pending user and service account is billed; data is stored in the US; and the plan table and docs disagree on a few Home features.
Pricing reality
Reference scenario: 25 users with 2 devices each (a laptop and a phone) reaching 10 servers or cloud resources, signing in with the company identity provider (Okta, Entra ID or Google Workspace), with group-based access policies and an admin audit log, on the cheapest plan that covers all of this, billed annually where an annual price is published, at US list prices before tax, plus any required add-on.
| Service | Plan | Monthly cost | Per user | Where the number comes from |
|---|---|---|---|---|
| Cloudflare Zero Trust | Free | $0 | $0 | 25 users fit the Free plan's 50-user limit |
| Twingate | Teams | $125 | $5 | Computed: 25 × $5, billed yearly, with Google Workspace sign-in |
| Tailscale | Standard | $200 | $8 | Computed: 25 × $8; the page gives no billing term, and the 10 servers fit the 50 included resources |
The identity provider moves the numbers. With Okta or Entra ID instead of Google Workspace, Twingate needs Business: 25 × $10 = $250 a month billed yearly (computed), while Tailscale and Cloudflare stay the same. Month to month, Twingate Teams is $150 (computed). Past 50 users, Cloudflare's Pay-as-you-go costs $7 per user, so the same 25 users would be $175 a month there (computed) if a team wanted its 30-day logs.
Logging is where the plans differ most. Flow logs kept 30 days cost $18 per user on Tailscale Premium ($450 a month for 25 users), $7 on Cloudflare Pay-as-you-go ($175) and $10 on Twingate Business ($250), all computed. SIEM streaming is on Tailscale Premium, on Twingate Business per its docs, and on Cloudflare's Contract plan per its plans page, although Cloudflare's Logpush docs say all customers can use it with usage pricing.
How we scored them
Every product in this category is scored on the same six indicators, read from the vendor's own pricing, trust, legal, help center and developer pages, with fixed formulas. The overall score is the plain mean. Our methodology page explains how these scores work.
| Indicator | Tailscale | Cloudflare Zero Trust | Twingate |
|---|---|---|---|
| Pricing clarity | 4 | 6 | 4 |
| Price for 25 users | 8.5 | 10 | 10 |
| Free plan and trial | 6 | 7 | 9 |
| Access controls | 8.8 | 10 | 6.8 |
| Visibility and exit | 7.6 | 8 | 8.4 |
| Compliance and data | 6 | 8.3 | 5.6 |
| Overall | 6.8 | 8.2 | 7.3 |
Pricing clarity loses a point for each price a page leaves out or each pair of pages that disagree: five for Tailscale, four for Cloudflare and six for Twingate, plus one for Tailscale because only one price with no billing term is published. Twingate leads on the free plan and trial because Starter is open to business use and paid plans have a 14-day trial; Tailscale's free plan is non-commercial. Cloudflare's lead comes from access controls and compliance: every control we check is on its Free plan, and it lists ISO 27001 alongside SOC 2 Type II. Twingate's compliance score is lower partly because its HIPAA page asks buyers to email about BAAs without saying whether one is signed.
Also in this category
NordLayer scores 6.2: a managed business VPN with SSO on every plan, logs kept 60 days and a BAA for yearly subscribers; the scenario costs $315 a month on Core ($11 × 25 plus a required $40 dedicated server, billed yearly, computed), and there is no free plan. ZeroTier scores 5.2: a per-device virtual network with an open-source client; 60 nodes cost $179 a month on Scale (computed), but it offers no device posture, SCIM or DNS filtering.
Who should choose which
- Choose Cloudflare Zero Trust if your team has up to 50 users and wants private access, DNS and web filtering and posture integrations on a free plan, with any SAML or OIDC provider. Look elsewhere if you need SIEM streaming, egress IPs or EU storage without a sales contract.
- Choose Twingate if you sign in with Google Workspace and want per-resource access through connectors you run, from $5 per user. Look elsewhere if you need Okta or Entra ID sign-in at the entry price, or EU data storage.
- Choose Tailscale if your users carry several devices each and you want direct WireGuard connections, Okta or Entra ID sign-in, SCIM and MDM posture on the first paid plan, and policies as code. Look elsewhere if you need flow logs below $18 per user or a HIPAA BAA.
Bottom line
From public pages alone, Cloudflare Zero Trust leads at 8.2 because almost everything a 25-person team needs is on its Free plan, though activity logs are short and data options go through sales. Twingate (7.3) is the cheapest paid option at $5 per user for Google Workspace teams, and Tailscale (6.8) gives Okta and Entra ID teams SCIM and posture integrations at $8 per user. Compare the plan that has the identity provider, logs and compliance you need, not only the entry price.
How we checked
We read the vendors' pricing pages and plan tables, trust and security pages, legal terms, help center articles and developer docs on Oct 16, 2026. We did not sign up, start a trial or call an API. Facts the pages did not state, such as whether Tailscale's or Twingate's trial needs a card, are left out rather than guessed. Every figure is on the vendors' pages as of that date or, where marked, computed from them.
