Zero-trust access and business VPN · Comparison
Cloudflare Zero Trust vs Twingate vs ZeroTier
3 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | Cloudflare Zero Trust | Twingate | ZeroTier |
|---|---|---|---|
| What you're paying for | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Saves engineering timeA peer-to-peer virtual network at Layer 2 and Layer 3 for laptops, servers and embedded devices, priced per device rather than per user. |
| Overall score | 8.2Best | 7.3 | 5.2 |
| Free option | Free plan | Free plan | Free plan |
| Card to start | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $7/user/mo | $5/user/mo | $18/mo |
| Pricing model | Per seat | Per seat | Seat + usage |
| Pricing page | Public prices | Public prices | Public prices |
| Billing unit | Per user who authenticates; no device count published | Per user per month, counting admins, pending and disabled users and service accounts | Flat monthly base with included devices, then per device; no per-user fee |
| Free option | Free plan for up to 50 users, business use allowed; no trial | Starter: free for 5 users; 14-day trial of paid plans | Personal: free, 10 devices, 1 network, non-commercial only |
| Reference scenario (25 users) | $0/mo on Free (25 of 50 users), computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $179/mo on Scale (100 devices included, 60 used), $7.16 per user, computed |
| Annual vs monthly price | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Teams $5 yearly or $6 monthly; Business $10 or $12 | Monthly prices only |
| Devices per user | Not stated | 5 on every plan; custom on Enterprise | No per-user limit; devices counted once per organization |
| Okta / Entra ID sign-in | Every plan (any SAML or OIDC provider) | Business and up; Google Workspace on every plan | Essential and up (OIDC, desktop only) |
| SCIM | SAML and OIDC providers; no plan restriction stated | Business and up (Okta SCIM) | Not offered |
| Device posture | Built-in checks and EDR or MDM integrations on every plan | Native checks on every plan; MDM and EDR integrations from Business | Not offered |
| Network flow logs | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Not offered by the vendor |
| SIEM streaming | Logpush on Contract per the plans page; the docs say all customers | Business and up per the docs; the plan table also ticks Home | Not offered; webhooks from Essential |
| Self-hosted parts | cloudflared connector (open source) | Connectors (always customer-run) | TCP relay; controller under licence or Enterprise |
| SOC 2 / ISO 27001 | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type II; ISO 27001 "coming soon" |
| HIPAA BAA | Enterprise-level customers handling PHI | Not stated; the HIPAA page says to ask by email | Not stated |
| EU data storage | Data Localization Suite, Enterprise add-on | No; data stored in the US | Not stated |
| Bottom line | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, ZeroTier is a flexible per-device virtual network with an open-source client and a strong rules engine. It does not offer device posture, SCIM or vendor-hosted flow logs, which many zero-trust buyers check for. |
Evidence: Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; ZeroTier: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
When to pick each
In the words of each review, with the date its facts were checked.
From our Cloudflare Zero Trust review
Checked Oct 16, 2026- Pick Cloudflare Zero Trust when
- You need Okta or Entra ID sign-in, SCIM and MDM posture without paying for a Business plan.
- Pick Twingate when
- You want traffic end-to-end encrypted through relays and a 14-day trial of a paid plan.
From our Twingate review
Checked Oct 16, 2026- Pick Twingate when
- You want traffic end-to-end encrypted through relays and a 14-day trial of a paid plan.
- Pick Cloudflare Zero Trust when
- You have 50 users or fewer and want a free plan with Okta or Entra ID sign-in, posture integrations and DNS filtering.
From our ZeroTier review
Checked Oct 16, 2026- Pick ZeroTier when
- You want a flat network across many devices rather than per-resource access through connectors.
- Pick Twingate when
- You want posture checks, Google Workspace sign-in and a free plan you can use for business.
From our ZeroTier review
Checked Oct 16, 2026- Pick ZeroTier when
- You want direct peer-to-peer traffic that the vendor’s infrastructure cannot observe.
- Pick Cloudflare Zero Trust when
- You want posture checks, DNS filtering and SAML or OIDC sign-in, free for up to 50 users.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- Cloudflare Zero TrustPay-as-you-go$7/user/moNo user limit; the plans page says billed monthly, the Access page says paid annually
- Activity logs kept 30 days
- Up to 50 DNS locations
- Remote Browser Isolation as an add-on
- Log Explorer: 10 GB free, then $1 per GB a month
- TwingateHome$15/moFlat price for the account, billed monthly; up to 7 users; non-commercial use only
- Exit Networks (self-hosted)
- Just-in-time access requests
- Logs kept 30 days
- 100 Resources, 20 Remote Networks
- ZeroTierEssential$18/mo10 devices included, then $2 per device a month; billed monthly
- 10 networks, 5 admins
- API, service accounts and webhooks
- OIDC single sign-on and templated flow rules
- 30-day audit log
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: Cloudflare Zero Trust 2026-10-16, Twingate 2026-10-16, ZeroTier 2026-10-16.
Which one fits
- If you need to start today without a sales call
- Cloudflare Zero TrustSelf-serve sign-up; the highest score of the 3 self-serve products here (8.2/10).
- Lowest starter price
- Twingate$5/user/mo for the Teams (billed yearly) plan.
- Highest overall score
- Cloudflare Zero Trust8.2/10 (Excellent). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score
Full reviews
Add a product
Search by product name or by what it does, such as “email” or “feature flags”. 1 more fits in this comparison.