by Tailscale Inc.Zero-trust access and business VPN
A WireGuard mesh network for teams, with identity-provider sign-in, access rules and subnet routers on every plan, from $8 per user a month with unlimited user devices.
A private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway.
Tailscale connects devices and servers directly over WireGuard, and users sign in with the identity provider the company already uses (Okta, Entra ID, Google Workspace and others) on every plan. Access is default-deny and written in one policy file that can live in Git or Terraform, so there is no VPN gateway to size or patch. User devices are unlimited and 50 servers or subnet routers are included, which suits teams where each person carries a laptop and a phone.
Against 3 other products we reviewed in Zero-trust access and business VPN: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Tailscale | Cloudflare Zero Trust | Twingate | NordLayer |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Built-in reachA business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan. |
| Overall score | 6.8 | 8.2Best | 7.3 | 6.2 |
| Free option | Free plan | Free plan | Free plan | Paid only |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $8/user/mo | $7/user/mo | $5/user/mo | $8/user/mo |
| Pricing model | Per seat | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each | Per user who authenticates; no device count published | Per user per month, counting admins, pending and disabled users and service accounts | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium |
| Free option | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains | Free plan for up to 50 users, business use allowed; no trial | Starter: free for 5 users; 14-day trial of paid plans | No free plan; 14-day money-back guarantee on the first purchase |
| Reference scenario (25 users) | $200/mo on Standard ($8 × 25), $8 per user, computed | $0/mo on Free (25 of 50 users), computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed |
| Annual vs monthly price | One price per plan with no billing term; annual plans through sales | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Teams $5 yearly or $6 monthly; Business $10 or $12 | Core $11 yearly or $14 monthly; server $40 or $50 |
| Devices per user | Unlimited on every plan | Not stated | 5 on every plan; custom on Enterprise | 6 simultaneous connections |
| Okta / Entra ID sign-in | Every plan (OIDC) | Every plan (any SAML or OIDC provider) | Business and up; Google Workspace on every plan | Every plan |
| SCIM | Standard and up (Okta, Entra ID, Google Workspace) | SAML and OIDC providers; no plan restriction stated | Business and up (Okta SCIM) | Premium; unpriced add-on on Lite and Core |
| Device posture | Built-in checks on every plan; MDM and EDR integrations from Standard | Built-in checks and EDR or MDM integrations on every plan | Native checks on every plan; MDM and EDR integrations from Business | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan |
| Network flow logs | Premium and up, 30 days | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Every plan, 60 days |
| SIEM streaming | Premium and up | Logpush on Contract per the plans page; the docs say all customers | Business and up per the docs; the plan table also ticks Home | CrowdStrike Falcon Next-Gen SIEM; plan not stated |
| Self-hosted parts | DERP relays and peer relays | cloudflared connector (open source) | Connectors (always customer-run) | None |
| SOC 2 / ISO 27001 | SOC 2 Type II (on request); ISO 27001 not stated | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 |
| HIPAA BAA | Not offered | Enterprise-level customers handling PHI | Not stated; the HIPAA page says to ask by email | Yearly subscriptions, on request |
| EU data storage | Not guaranteed; coordination server in Frankfurt | Data Localization Suite, Enterprise add-on | No; data stored in the US | Not stated |
| Bottom line | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider. |
Evidence: Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; NordLayer: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Tailscale's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read Tailscale's pricing page and its embedded plan comparison, the pricing FAQ, the terms, DPA, subprocessor and security pages, the free-trial terms, and docs on identity providers, SCIM, device posture, logging, log streaming, exit nodes, DERP servers, the API and Terraform on Oct 16, 2026. We did not sign up, start the trial or call the API; every fact here is from those pages.
The plan table is detailed and the main prices are easy to find: $8 per user a month for Standard and $18 for Premium. The page gives no billing term; the FAQ says monthly plans are changed from the Billing page and annual plans through sales, so we used $8 as the list price. The free Personal plan is for non-commercial use, and a sign-up with a company email domain starts a 14-day Enterprise trial instead; whether the trial needs a card is not stated.
A few points need a question to Tailscale. The table shows basic Tailscale SSH on Personal but "Up to 5 hosts" on Standard; a subnet router doc mentions a plan device limit while the pricing page lists unlimited user devices; and the FAQ says limits on ACL groups, tagged resources and ephemeral resources are not enforced yet but will be introduced.
SSO with Okta, Entra ID, Google, GitHub, OneLogin or custom OIDC, default-deny ACLs, subnet routers and exit nodes are on every plan, Personal included.
vs Twingate: Twingate keeps Okta and Entra ID sign-in for Business; ZeroTier offers OIDC sign-in from Essential, on desktops only.
Each user can sign in on as many laptops and phones as needed; only servers and other tagged resources are counted, with 50 included.
vs Twingate: Twingate allows 5 devices per user and NordLayer 6 connections.
The tailnet policy file is HuJSON and can be managed through the API, GitOps or the official Terraform provider on every plan.
Built-in checks (OS, client version, auto-update, encrypted state) are on every plan; CrowdStrike, SentinelOne, Intune, Jamf, Iru (Kandji) and other integrations start on Standard.
DERP relays are open source and can be self-hosted, customer-run peer relays are on every plan, and traffic stays end-to-end encrypted through relays.
Network flow logs (30 days, through the API and streaming only) and log streaming to Splunk, Datadog, S3 and others are on Premium at $18 per user.
Workaround: The configuration audit log (90 days) and webhooks are on every plan.
The pricing page shows one price per plan and annual plans go through sales. Fees are non-refundable, and a seat added when a new user logs in stays billed even if the user is removed right away.
Workaround: Self-serve plans can be cancelled from the Billing page and drop to Personal at the end of the period.
The security page says Tailscale does not execute BAAs; its EU page says EU data residency is not guaranteed today, although there is a coordination server in Frankfurt.
DNS filtering by Control D is bought from the sales team with no published price, and there is no secure web gateway.
Workaround: NextDNS or Control D can be set as the network’s nameservers.
Tailscale bills per user a month; user devices are unlimited and 50 tagged resources (servers, subnet routers, exit nodes, app connectors) are included, then $1 a month each. For our scenario, 25 users on Standard cost 25 × $8 = $200 a month, or $8 per user (computed); the 10 servers fit in the included resources. The page gives no billing term, and annual plans go through sales. Seats grow automatically when a new user logs in and are prorated on the next bill. Premium ($18, so $450 a month for 25 users, computed) adds flow logs, log streaming, 300 ACL groups and custom posture attributes. Mullvad exit nodes are $5 a month per 5 devices; DNS filtering (Control D), PAM and multiple tailnets go through sales, and SLA support packages (Silver is self-serve) have no published price. Non-profits and educational institutions get 50% off.
The policy file is plain HuJSON, readable through the API and Terraform; device and user lists export as CSV, and audit logs come through the API on every plan. Cancelling drops the network to Personal at the end of the period, but a network with more than six users must delete or suspend users first. Deleting it removes node and user data, with backups rotating out within 60 days.
From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee.
| Limit | As recorded |
|---|---|
| Billing unit | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each |
| Free option | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains |
| Reference scenario (25 users) | $200/mo on Standard ($8 × 25), $8 per user, computed |
| Annual vs monthly price | One price per plan with no billing term; annual plans through sales |
| Devices per user | Unlimited on every plan |
| Okta / Entra ID sign-in | Every plan (OIDC) |
| SCIM | Standard and up (Okta, Entra ID, Google Workspace) |
| Device posture | Built-in checks on every plan; MDM and EDR integrations from Standard |
| Network flow logs | Premium and up, 30 days |
| SIEM streaming | Premium and up |
| Self-hosted parts | DERP relays and peer relays |
| SOC 2 / ISO 27001 | SOC 2 Type II (on request); ISO 27001 not stated |
| HIPAA BAA | Not offered |
| EU data storage | Not guaranteed; coordination server in Frankfurt |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Tailscale yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Tailscale yet.
Tailscale lists 4 plans. The cheapest paid plan, Standard, costs $8/user/mo.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: tailscale.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal, help center and developer pages of three zero-trust access services on the same day and scored them on the same six indicators. What 25 users cost, where SSO, SCIM, posture and logs sit, and who should pick which.
