Zero-trust access and business VPN · Comparison
Cloudflare Zero Trust vs NordLayer vs Tailscale vs Twingate
4 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | Cloudflare Zero Trust | NordLayer | Tailscale | Twingate |
|---|---|---|---|---|
| What you're paying for | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Built-in reachA business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan. | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. |
| Overall score | 8.2Best | 6.2 | 6.8 | 7.3 |
| Free option | Free plan | Paid only | Free plan | Free plan |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $7/user/mo | $8/user/mo | $8/user/mo | $5/user/mo |
| Pricing model | Per seat | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per user who authenticates; no device count published | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each | Per user per month, counting admins, pending and disabled users and service accounts |
| Free option | Free plan for up to 50 users, business use allowed; no trial | No free plan; 14-day money-back guarantee on the first purchase | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains | Starter: free for 5 users; 14-day trial of paid plans |
| Reference scenario (25 users) | $0/mo on Free (25 of 50 users), computed | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed | $200/mo on Standard ($8 × 25), $8 per user, computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed |
| Annual vs monthly price | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Core $11 yearly or $14 monthly; server $40 or $50 | One price per plan with no billing term; annual plans through sales | Teams $5 yearly or $6 monthly; Business $10 or $12 |
| Devices per user | Not stated | 6 simultaneous connections | Unlimited on every plan | 5 on every plan; custom on Enterprise |
| Okta / Entra ID sign-in | Every plan (any SAML or OIDC provider) | Every plan | Every plan (OIDC) | Business and up; Google Workspace on every plan |
| SCIM | SAML and OIDC providers; no plan restriction stated | Premium; unpriced add-on on Lite and Core | Standard and up (Okta, Entra ID, Google Workspace) | Business and up (Okta SCIM) |
| Device posture | Built-in checks and EDR or MDM integrations on every plan | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan | Built-in checks on every plan; MDM and EDR integrations from Standard | Native checks on every plan; MDM and EDR integrations from Business |
| Network flow logs | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan, 60 days | Premium and up, 30 days | Every plan; 24 hours Starter, 7 days Teams, 30 days Business |
| SIEM streaming | Logpush on Contract per the plans page; the docs say all customers | CrowdStrike Falcon Next-Gen SIEM; plan not stated | Premium and up | Business and up per the docs; the plan table also ticks Home |
| Self-hosted parts | cloudflared connector (open source) | None | DERP relays and peer relays | Connectors (always customer-run) |
| SOC 2 / ISO 27001 | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 | SOC 2 Type II (on request); ISO 27001 not stated | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated |
| HIPAA BAA | Enterprise-level customers handling PHI | Yearly subscriptions, on request | Not offered | Not stated; the HIPAA page says to ask by email |
| EU data storage | Data Localization Suite, Enterprise add-on | Not stated | Not guaranteed; coordination server in Frankfurt | No; data stored in the US |
| Bottom line | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider. | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. |
Evidence: Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; NordLayer: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
When to pick each
In the words of each review, with the date its facts were checked.
From our Cloudflare Zero Trust review
Checked Oct 16, 2026- Pick Cloudflare Zero Trust when
- You want up to 50 users free for business use, with DNS and web filtering in the same client.
- Pick Tailscale when
- You want direct WireGuard connections between devices, unlimited devices per user and a policy file in Git.
From our Cloudflare Zero Trust review
Checked Oct 16, 2026- Pick Cloudflare Zero Trust when
- You need Okta or Entra ID sign-in, SCIM and MDM posture without paying for a Business plan.
- Pick Twingate when
- You want traffic end-to-end encrypted through relays and a 14-day trial of a paid plan.
From our Cloudflare Zero Trust review
Checked Oct 16, 2026- Pick Cloudflare Zero Trust when
- You want filtering and posture without a dedicated server fee.
- Pick NordLayer when
- You want a dedicated static IP and a HIPAA BAA on a self-serve annual plan.
From our NordLayer review
Checked Oct 16, 2026- Pick NordLayer when
- You want a dedicated static IP and a HIPAA BAA on a self-serve yearly plan.
- Pick Cloudflare Zero Trust when
- You want a free plan for up to 50 users and an admin API with a Terraform provider.
From our NordLayer review
Checked Oct 16, 2026- Pick NordLayer when
- You want Okta or Entra ID SSO on the entry plan and internet egress through managed gateways.
- Pick Twingate when
- You want per-resource access through your own connectors at $5 per user without a server fee.
From our NordLayer review
Checked Oct 16, 2026- Pick NordLayer when
- You want vendor-run gateways and a fixed IP rather than exit nodes you run.
- Pick Tailscale when
- You want unlimited devices per user, policy as code and an admin API.
From our Tailscale review
Checked Oct 16, 2026- Pick Tailscale when
- You want direct device-to-device WireGuard connections, unlimited devices per user and a policy file kept in Git.
- Pick Cloudflare Zero Trust when
- You want up to 50 users free for business use, with DNS and web filtering in the same client.
From our Tailscale review
Checked Oct 16, 2026- Pick Tailscale when
- You sign in with Okta or Entra ID and want SCIM and MDM posture at $8 per user rather than on a $10 Business plan.
- Pick Twingate when
- You sign in with Google Workspace and want a lower yearly price ($5 per user on Teams) with connectors you run in each network.
From our Twingate review
Checked Oct 16, 2026- Pick Twingate when
- You sign in with Google Workspace and want the lowest yearly per-user price, with connectors you run in each network.
- Pick Tailscale when
- You sign in with Okta or Entra ID and want SCIM and MDM posture at $8 per user, with unlimited devices per user.
From our Twingate review
Checked Oct 16, 2026- Pick Twingate when
- You want traffic end-to-end encrypted through relays and a 14-day trial of a paid plan.
- Pick Cloudflare Zero Trust when
- You have 50 users or fewer and want a free plan with Okta or Entra ID sign-in, posture integrations and DNS filtering.
From our Twingate review
Checked Oct 16, 2026- Pick Twingate when
- You want per-resource access through your own connectors without a dedicated server fee.
- Pick NordLayer when
- You also want internet egress through shared or dedicated gateways in 40+ countries.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- Cloudflare Zero TrustPay-as-you-go$7/user/moNo user limit; the plans page says billed monthly, the Access page says paid annually
- Activity logs kept 30 days
- Up to 50 DNS locations
- Remote Browser Isolation as an add-on
- Log Explorer: 10 GB free, then $1 per GB a month
- NordLayerLite$8/user/moBilled yearly; $10 month to month; 5 users minimum
- Shared gateways in 40+ countries
- SSO with Okta, Entra ID, OneLogin, Google and JumpCloud
- Activity reports kept 60 days
- No Virtual Private Gateway
- TailscaleStandard$8/user/moOne price published, no billing term; annual plans through sales
- Unlimited users, up to 10 ACL groups
- SCIM user and group provisioning
- Posture integrations: CrowdStrike, SentinelOne, Intune, Jamf and more
- 50 tagged resources, then $1 a month each
- TwingateHome$15/moFlat price for the account, billed monthly; up to 7 users; non-commercial use only
- Exit Networks (self-hosted)
- Just-in-time access requests
- Logs kept 30 days
- 100 Resources, 20 Remote Networks
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: Cloudflare Zero Trust 2026-10-16, NordLayer 2026-10-16, Tailscale 2026-10-16, Twingate 2026-10-16.
Which one fits
- If you need to start today without a sales call
- Cloudflare Zero TrustSelf-serve sign-up; the highest score of the 4 self-serve products here (8.2/10).
- Lowest starter price
- Twingate$5/user/mo for the Teams (billed yearly) plan.
- Highest overall score
- Cloudflare Zero Trust8.2/10 (Excellent). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score