by Twingate Inc.Zero-trust access and business VPN
Resource-level remote access through connectors you run in your own networks, free for 5 users and $5 per user a month on Teams billed yearly.
Resource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user.
Twingate replaces a VPN gateway with lightweight Connectors deployed inside each network (Docker, Kubernetes, systemd or cloud images), so users reach individual Resources by group policy rather than a whole subnet. Google Workspace sign-in, resource-level policies, native posture checks (disk encryption, firewall, antivirus, minimum OS) and real-time network logs are on every plan. Teams costs $5 per user a month billed yearly, and traffic is end-to-end encrypted through Twingate’s relays.
Against 3 other products we reviewed in Zero-trust access and business VPN: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Twingate | Cloudflare Zero Trust | Tailscale | NordLayer |
|---|---|---|---|---|
| What you're paying for | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. | Built-in reachA business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan. |
| Overall score | 7.3 | 8.2Best | 6.8 | 6.2 |
| Free option | Free plan | Free plan | Free plan | Paid only |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $5/user/mo | $7/user/mo | $8/user/mo | $8/user/mo |
| Pricing model | Per seat | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per user per month, counting admins, pending and disabled users and service accounts | Per user who authenticates; no device count published | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium |
| Free option | Starter: free for 5 users; 14-day trial of paid plans | Free plan for up to 50 users, business use allowed; no trial | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains | No free plan; 14-day money-back guarantee on the first purchase |
| Reference scenario (25 users) | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $0/mo on Free (25 of 50 users), computed | $200/mo on Standard ($8 × 25), $8 per user, computed | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed |
| Annual vs monthly price | Teams $5 yearly or $6 monthly; Business $10 or $12 | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | One price per plan with no billing term; annual plans through sales | Core $11 yearly or $14 monthly; server $40 or $50 |
| Devices per user | 5 on every plan; custom on Enterprise | Not stated | Unlimited on every plan | 6 simultaneous connections |
| Okta / Entra ID sign-in | Business and up; Google Workspace on every plan | Every plan (any SAML or OIDC provider) | Every plan (OIDC) | Every plan |
| SCIM | Business and up (Okta SCIM) | SAML and OIDC providers; no plan restriction stated | Standard and up (Okta, Entra ID, Google Workspace) | Premium; unpriced add-on on Lite and Core |
| Device posture | Native checks on every plan; MDM and EDR integrations from Business | Built-in checks and EDR or MDM integrations on every plan | Built-in checks on every plan; MDM and EDR integrations from Standard | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan |
| Network flow logs | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Premium and up, 30 days | Every plan, 60 days |
| SIEM streaming | Business and up per the docs; the plan table also ticks Home | Logpush on Contract per the plans page; the docs say all customers | Premium and up | CrowdStrike Falcon Next-Gen SIEM; plan not stated |
| Self-hosted parts | Connectors (always customer-run) | cloudflared connector (open source) | DERP relays and peer relays | None |
| SOC 2 / ISO 27001 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type II (on request); ISO 27001 not stated | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 |
| HIPAA BAA | Not stated; the HIPAA page says to ask by email | Enterprise-level customers handling PHI | Not offered | Yearly subscriptions, on request |
| EU data storage | No; data stored in the US | Data Localization Suite, Enterprise add-on | Not guaranteed; coordination server in Frankfurt | Not stated |
| Bottom line | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. | From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider. |
Evidence: Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; NordLayer: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Twingate's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
We read Twingate's pricing page and plan table, the Home page, the terms and DPA, the subprocessor list, and docs on subscriptions, identity providers, Okta SCIM, device posture, Connectors, Resources, Exit Networks, DNS filtering, S3 sync, analytics, relays, customer data, SOC 2, HIPAA and FIPS on Oct 16, 2026. We did not sign up or start a trial.
The prices themselves are clear: Teams is $5 per user a month billed yearly or $6 monthly, and Business $10 or $12. One version of the plan table shows Teams monthly at $12, and the "Yearly -15%" badge is a little below the roughly 17% saving the two prices give.
The plan table and the docs disagree in a few places: S3 and SIEM sync and geoblocking are ticked for Home in the table but limited to Business and Enterprise (S3) or Enterprise (geoblocking) in the docs, and support pages differ on whether Teams gets ticketed support. Home, a non-commercial $15 plan, has several features Teams does not, such as Exit Networks, just-in-time access and 30-day logs.
Teams is $5 per user a month billed yearly, with group policies per Resource, native posture checks, the admin audit log and network logs.
vs Tailscale: Tailscale Standard is $8 per user, and NordLayer Core $11 plus a $40 server, billed yearly.
Connectors run in your networks with no cap on their number, and nothing between Client and Connector, Twingate’s Relays included, can decrypt the traffic, per the encryption docs.
Starter is free for 5 users with Google Workspace sign-in, resource policies, native posture checks and the Admin API, with no non-commercial restriction stated.
vs Tailscale: The free plans of Tailscale and ZeroTier are for non-commercial use.
The GraphQL Admin API, Terraform and Pulumi providers and a Kubernetes Operator are listed on every plan.
Okta, Entra ID, JumpCloud and other IdPs, SCIM and MDM or EDR posture integrations are on Business ($10 yearly, $12 monthly); Teams supports Google Workspace and social logins.
The plan table lists 7 days of log retention on Teams, 30 days on Business and 12 months on Enterprise; S3 and SIEM sync start on Business per the docs.
Workaround: Connector logs can be forwarded from journald to your own syslog or SIEM.
Admins, pending and disabled users and every service account are billed; on yearly plans, added users are charged monthly and reductions wait for renewal. Fees are not refundable.
Customer data is stored on Controller servers in the United States; no EU storage option or ISO 27001 certificate is stated.
Twingate bills per user a month, counting admins, pending and disabled users and service accounts. For our scenario, 25 users on Teams cost 25 × $5 = $125 a month billed yearly, or $5 per user ($150 a month month to month), computed, with Google Workspace sign-in. If the company signs in with Okta or Entra ID, Business is needed: 25 × $10 = $250 a month billed yearly (computed). Teams allows 100 users, 20 Remote Networks and 100 Resources; Business 500, 100 and 300. DNS filtering (a Business add-on), static IPs (an Enterprise add-on), extra support and privileged access beyond 5 Resources have no published price. Non-profits and education get a discount through sales.
Configuration (Remote Networks, Resources, groups, users, devices and policies) can be read through the GraphQL Admin API and managed with Terraform or Pulumi; no policy export file is described. Audit logs and network events download from the Admin Console as gzipped JSON. Cancelling means switching the subscription to Starter in the Admin Console, and the paid plan ends with its current term; the DPA commits to deleting or returning personal data, without a number of days.
From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US.
| Limit | As recorded |
|---|---|
| Billing unit | Per user per month, counting admins, pending and disabled users and service accounts |
| Free option | Starter: free for 5 users; 14-day trial of paid plans |
| Reference scenario (25 users) | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed |
| Annual vs monthly price | Teams $5 yearly or $6 monthly; Business $10 or $12 |
| Devices per user | 5 on every plan; custom on Enterprise |
| Okta / Entra ID sign-in | Business and up; Google Workspace on every plan |
| SCIM | Business and up (Okta SCIM) |
| Device posture | Native checks on every plan; MDM and EDR integrations from Business |
| Network flow logs | Every plan; 24 hours Starter, 7 days Teams, 30 days Business |
| SIEM streaming | Business and up per the docs; the plan table also ticks Home |
| Self-hosted parts | Connectors (always customer-run) |
| SOC 2 / ISO 27001 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated |
| HIPAA BAA | Not stated; the HIPAA page says to ask by email |
| EU data storage | No; data stored in the US |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Twingate yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Twingate yet.
Twingate lists 5 plans. The cheapest paid plan, Teams (billed yearly), costs $5/user/mo.
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: twingate.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, trust, legal, help center and developer pages of three zero-trust access services on the same day and scored them on the same six indicators. What 25 users cost, where SSO, SCIM, posture and logs sit, and who should pick which.
