by Cloudflare, Inc.Zero-trust access and business VPN
Zero-trust access, a secure web gateway and a device client on Cloudflare’s network, free for up to 50 users and $7 per user a month above that.
Zero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that.
The Free plan is a working zero-trust setup rather than a trial: up to 50 users sign in with Okta, Entra ID, Google Workspace or any SAML or OIDC provider, private apps and networks are reached through the cloudflared connector, and Gateway filters DNS, HTTP and network traffic. Posture checks such as disk encryption, firewall and OS version, and integrations with CrowdStrike, SentinelOne and Intune, are on that plan too. Above 50 users, Pay-as-you-go costs $7 per user a month, and the compliance file includes SOC 2 Type II and ISO 27001.
Against 3 other products we reviewed in Zero-trust access and business VPN: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Cloudflare Zero Trust | Twingate | Tailscale | NordLayer |
|---|---|---|---|---|
| What you're paying for | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. | Built-in reachA business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan. |
| Overall score | 8.2Best | 7.3 | 6.8 | 6.2 |
| Free option | Free plan | Free plan | Free plan | Paid only |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $7/user/mo | $5/user/mo | $8/user/mo | $8/user/mo |
| Pricing model | Per seat | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per user who authenticates; no device count published | Per user per month, counting admins, pending and disabled users and service accounts | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium |
| Free option | Free plan for up to 50 users, business use allowed; no trial | Starter: free for 5 users; 14-day trial of paid plans | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains | No free plan; 14-day money-back guarantee on the first purchase |
| Reference scenario (25 users) | $0/mo on Free (25 of 50 users), computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $200/mo on Standard ($8 × 25), $8 per user, computed | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed |
| Annual vs monthly price | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Teams $5 yearly or $6 monthly; Business $10 or $12 | One price per plan with no billing term; annual plans through sales | Core $11 yearly or $14 monthly; server $40 or $50 |
| Devices per user | Not stated | 5 on every plan; custom on Enterprise | Unlimited on every plan | 6 simultaneous connections |
| Okta / Entra ID sign-in | Every plan (any SAML or OIDC provider) | Business and up; Google Workspace on every plan | Every plan (OIDC) | Every plan |
| SCIM | SAML and OIDC providers; no plan restriction stated | Business and up (Okta SCIM) | Standard and up (Okta, Entra ID, Google Workspace) | Premium; unpriced add-on on Lite and Core |
| Device posture | Built-in checks and EDR or MDM integrations on every plan | Native checks on every plan; MDM and EDR integrations from Business | Built-in checks on every plan; MDM and EDR integrations from Standard | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan |
| Network flow logs | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Premium and up, 30 days | Every plan, 60 days |
| SIEM streaming | Logpush on Contract per the plans page; the docs say all customers | Business and up per the docs; the plan table also ticks Home | Premium and up | CrowdStrike Falcon Next-Gen SIEM; plan not stated |
| Self-hosted parts | cloudflared connector (open source) | Connectors (always customer-run) | DERP relays and peer relays | None |
| SOC 2 / ISO 27001 | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type II (on request); ISO 27001 not stated | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 |
| HIPAA BAA | Enterprise-level customers handling PHI | Not stated; the HIPAA page says to ask by email | Not offered | Yearly subscriptions, on request |
| EU data storage | Data Localization Suite, Enterprise add-on | No; data stored in the US | Not guaranteed; coordination server in Frankfurt | Not stated |
| Bottom line | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. | From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider. |
Evidence: Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; NordLayer: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Cloudflare Zero Trust's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read Cloudflare's Zero Trust plans page, the Access product page, the self-serve terms, the DPA and subprocessor list, the trust hub, and the developer docs on seats, account limits, identity providers, SCIM, posture checks, Mesh, logs, Logpush, dedicated egress IPs, data localization and Terraform on Oct 16, 2026. We did not sign up or create a Zero Trust organization.
The Free plan carries almost everything our scenario needs: identity-provider sign-in, access policies, device posture, the cloudflared connector, Gateway filtering and an 18-month admin log. What changes on paid plans is mostly log retention (24 hours on Free, 30 days on Pay-as-you-go), Logpush and add-ons.
Some pages disagree. Pay-as-you-go is "$7/user/month, billed monthly" in the plans data but "$7 per user/month (paid annually)" on the Access page; the plans page lists Logpush on Contract only while the Logpush docs say it is available to all customers; and the plans page gives 3, 50 and 250 DNS locations by plan while the account-limits docs list one default of 250.
IdP sign-in, access policies, device posture integrations, connectors, DNS and HTTP filtering, SSH command logging and Terraform are all on Free, for up to 50 users.
vs Tailscale: Tailscale’s free plan is non-commercial and Twingate’s Starter allows 5 users.
Gateway filters DNS, HTTP(S) with TLS inspection and L4 traffic by port and protocol on every plan.
vs Tailscale: Tailscale sells DNS filtering through sales, Twingate as an unpriced add-on on Business, and ZeroTier does not offer it.
Okta, Entra ID, Google Workspace and generic SAML and OIDC connectors are supported on Free, and SCIM works with SAML and OIDC providers with no plan restriction stated.
SOC 2 Type II with all plans in scope, ISO 27001, 27017, 27018 and 27701, and dashboard SSO free on every plan.
Access policies can require a purpose justification and an approver who grants access for up to 24 hours, listed on every plan.
Access, DNS, network and HTTP logs are kept 24 hours on Free and 30 days on Pay-as-you-go; admin logs are kept 18 months on every plan.
Workaround: Log Explorer stores logs for $1 per GB a month after 10 GB free.
Once purchased seats (or Free’s 50) are used, more users are blocked at login; seats stay taken until users are removed, and inactive-seat expiry is off by default.
Workaround: Turn on seat expiration, or buy more seats before adding users.
Dedicated egress IPs, EU data localization and a HIPAA BAA are Enterprise items with no published price; with the EU metadata boundary, Access user logs are not available outside the US region and the docs point EU customers to Logpush.
With TLS inspection on, Gateway decrypts traffic in memory in Cloudflare data centers and re-encrypts it. Mesh, the device-to-device option, is in beta and routes through the nearest Cloudflare data center.
Cloudflare bills per user who authenticates, with no device count published. For our scenario, 25 users fit the Free plan: $0 a month (computed). Pay-as-you-go is $7 per user a month ($175 for 25 users, computed), mainly for teams over 50 users or that want 30-day logs; the pages disagree on whether that price is billed monthly or annually. Contract plans are priced by sales and hold Logpush to a SIEM (per the plans page), longer retention, dedicated egress IPs, DLP and email security. Logpush is usage-priced in the docs (25 GB a month included, then $0.03 to $0.10 per GB) and Log Explorer is $1 per GB after 10 GB. Fees are non-refundable.
Policies, applications and settings can be managed through the API and the official Terraform provider on every plan, so they can be kept as code; no export button is described. Logs leave through Logpush or Log Explorer. After cancelling, access continues to the end of the term, and the DPA lets you choose deletion or return of personal data; user records themselves cannot be deleted.
From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales.
| Limit | As recorded |
|---|---|
| Billing unit | Per user who authenticates; no device count published |
| Free option | Free plan for up to 50 users, business use allowed; no trial |
| Reference scenario (25 users) | $0/mo on Free (25 of 50 users), computed |
| Annual vs monthly price | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing |
| Devices per user | Not stated |
| Okta / Entra ID sign-in | Every plan (any SAML or OIDC provider) |
| SCIM | SAML and OIDC providers; no plan restriction stated |
| Device posture | Built-in checks and EDR or MDM integrations on every plan |
| Network flow logs | Every plan; 24 hours on Free, 30 days on Pay-as-you-go |
| SIEM streaming | Logpush on Contract per the plans page; the docs say all customers |
| Self-hosted parts | cloudflared connector (open source) |
| SOC 2 / ISO 27001 | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 |
| HIPAA BAA | Enterprise-level customers handling PHI |
| EU data storage | Data Localization Suite, Enterprise add-on |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Cloudflare Zero Trust yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Cloudflare Zero Trust yet.
Cloudflare Zero Trust lists 3 plans. The cheapest paid plan, Pay-as-you-go, costs $7/user/mo.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: cloudflare.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal, help center and developer pages of three zero-trust access services on the same day and scored them on the same six indicators. What 25 users cost, where SSO, SCIM, posture and logs sit, and who should pick which.
