NetBird vs Tailscale

NetBird

The captured pages describe a business VPN and zero-trust access product with an optional hosted reverse proxy that connects devices, networks and services, and the terms state that shared proxy path is not designed or intended for nuclear or industrial safety systems — a direct concern for our control-system environment. We found no public information on access granted per resource rather than per network, client platforms, the protocol used, or gateway locations, which is what I would need before answering my auditor.

Tailscale

Peer-to-peer WireGuard connections with DERP relays as fallback, NAT traversal without inbound firewall ports, subnet routers for site-to-site links with split DNS and high availability, app connectors with a Kubernetes operator, and per-resource grants rather than whole-network access cover exactly the access model I want for control systems. The pages state relay servers run in multiple regions without naming the individual locations, and I found no public information on clientless browser access for contractors or always-on auto-connect behaviour.

NetBird

The trust page states role-based access control, multi-factor authentication, user access reviews and a password policy, and user authentication runs through Auth0 as a listed subprocessor. We found no public information on single sign-on with our own identity provider, SCIM deprovisioning when someone leaves, groups or per-resource policies, or device posture checks before a connection is allowed — so I cannot treat this as least privilege for my network.

Tailscale

Access follows identity and device state rather than the network: single sign-on with any SAML or OIDC provider with MFA inherited from it, SCIM group sync, default-deny grants scoped per resource, device posture from EDR and MDM tools including CrowdStrike, just-in-time access with approval and expiry, forced re-authentication periods, and policy as code through GitOps. That is the level I would accept for OT access, though I found no public information on hardware-bound device identity or a documented emergency revocation procedure.

NetBird

We found no public information on connection or access logs, admin and configuration audit logs, retention periods, or export and streaming to a SIEM in the captured pages; the only logging-adjacent facts concern the vendor's own operations. This is precisely the question my auditor asked about who reached the control systems, and I cannot answer it from the public evidence I read.

Tailscale

Configuration audit logs are always on and record actor, action and target, network flow logs show node-to-node access, both stream to named SIEM systems including Splunk, and every connection is logged twice on source and destination with real-time streaming so tampering is detectable — which answers my auditor's question of who reached what. Retention is fixed at 90 days and cannot be extended in the product, failed login attempts and support-initiated changes are not captured, and I found no public information on alerts for unusual access.

NetBird

Support runs through Slack, GitHub and a public status page, defects are reported by email, and the terms allow weekly maintenance of up to two hours with package-based scope and self-service cancellation. We found no public information on an admin console, a documented API, MDM deployment of clients, administrator roles, or multi-tenant operation for a service provider.

Tailscale

A documented API available on all plans, MDM deployment with Jamf configuration profiles plus update control via Intune or Jamf, granular admin roles, Terraform, webhooks, multiple tailnets under one organisation, and per-tier support with 24/7 severity-one coverage on the paid tiers make this runnable by a small team. I found no public information on a self-hosted production edition of the control plane.

NetBird

Independent assurance is stated concretely: an ISO 27001 official certificate and audit report, a 2025 penetration test report and SOC 2 Type II are listed on the trust page, alongside a public status page, encryption and key management statements, and tested continuity and incident response plans. We found no public information on the architecture and data flow, a vulnerability disclosure contact or bug bounty, or an availability SLA — the terms instead give a best-effort shared reverse proxy and weekly maintenance windows. The captured pages also give different signals on source availability: the homepage promotes an open-source project with 30.7k stars while the terms state the software's source code will not be disclosed.

Tailscale

The architecture is published in detail — the coordination server holds only public keys, private keys never leave the node, relays cannot decrypt traffic, existing connections survive a coordination-server outage and relay regions fail over — and independent audits by Latacora, SOC 2 Type II and periodic third-party penetration tests are all stated. The audit reports themselves are available only on request rather than published, there is no bug bounty, and I found no public information on a status page with incident history.

NetBird

The contracting entity is NetBird GmbH in Berlin under German law, personal data is processed in the EU/EEA with application hosting on named AWS infrastructure restricted to EU/EEA servers, the subprocessor list is published with locations, a data processing agreement is referenced, and ISO 27001 and SOC 2 are stated. For my requirements the chain is not clean end to end: user identities (email and user ID) pass through Auth0 in the USA under standard contractual clauses, several web-facing subprocessors sit in the USA, and we found no public information pinning where connection logs and identities specifically reside.

Tailscale

The contracting entity is a US corporation in Delaware, transfers from the EU rely on standard contractual clauses, and information is processed in Canada, Germany, the United States and the United Kingdom with no statement that identities and logs stay in Europe — this is the dimension that fails my requirement. A data processing agreement exists, the European Data Protection Office acts as the EU GDPR representative and a subprocessor page is referenced with ten days' notice of changes, but the captured pages do not name the subprocessors or their locations.

NetBird

The terms publish contract mechanics — an indeterminate term terminable with 14 days' notice to the end of the month, self-service cancellation from the account, package-based scope, and usage-based pricing with bandwidth limits and quotas for reverse-proxy features — but no price figures, tiers or scaling rules appear in the captured pages. An annual cost for a given number of users and gateways cannot be computed from what was captured.

Tailscale

Three tiers are public — $0 free forever, $8 per user, per month and $18 per user, per month — with tagged resources beyond the 50 included at $1 per month for every tagged resource, ephemeral-minute allowances, SSH host limits and the plan requirements for log streaming and posture attributes all stated, and taxes expressly excluded from the fees. The Enterprise tier is custom-priced through sales, the ephemeral add-on is contact sales, and I found no public information on minimum seats or a minimum term.