Security / trust page — Tailscale

Cited by

Facts read from this source

• SOC 2 Report an error

  “Tailscale has completed a SOC 2 Type II certification, meeting AICPA's Trust Services Criteria for security, availability, and confidentiality.”

• Latacora audits Report an error

  “Tailscale works with Latacora, a security firm that specializes in information security, to conduct security audits. Security audits are available on request”

• Security policies public Report an error

  “Tailscale publishes the security policies we use publicly, so you can transparently see where we are in terms of security maturity.”

• Security bulletins Report an error

  “Tailscale publishes security bulletins to disclose security issues in our product.”

• SSO MFA Report an error

  “Tailscale relies on your existing identity provider to authenticate users. Any authentication settings from your identity provider are automatically used by Tailscale, including MFA and context-aware access.”

• Supported idps Report an error

  “Authenticate to Tailscale with identity providers including Google, Microsoft AD, GitHub, Okta, and OneLogin.”

• Acls Report an error

  “ACLs are directional and default deny.”

• User roles Report an error

  “Tailscale provides multiple user roles that restrict who can modify your tailnet’s configurations.”

• Tailnet lock Report an error

  “Tailnet lock lets you control which nodes are signed and verified by trusted nodes in your tailnet, meaning you don’t need to trust the Tailscale coordination server for distributing public node keys to peer nodes in your tailnet.”

• E2e encryption Report an error

  “Tailscale is built on top of WireGuard®, a modern VPN that provides end-to-end encryption between devices. Tailscale cannot read your traffic.”

• Metadata collection Report an error

  “We do receive metadata about which of your private nodes connect to which other private nodes, including public IP addresses. This is required to provide the service”

• Keys never leave nodes Report an error

  “Your devices’ private encryption keys never leave their respective nodes, and our coordination server only collects and exchanges public keys.”

• Derp no logging Report an error

  “DERP relay servers do not log your data — you can confirm this yourself as the code is open-source.”

• Works without coordination server Report an error

  “Even if Tailscale's coordination server is down, you can still access your network.”

• Derp regions Report an error

  “The DERP servers run in multiple regions and have no shared state between regions, which means a DERP region can have an outage and your Tailscale clients will fail over to a different one.”

• Go language Report an error

  “Tailscale’s core functionality, including the coordination server, logging infrastructure, DERP relay servers, and clients, are written in Go.”

• Production access controls Report an error

  “Requires business need to access the production environment. Requires SSO and MFA to manage the production environment. Requires connections over Tailscale or using SSH keys to access the production environment.”

• Encryption Report an error

  “Encrypts data at rest and in transit.”

• Backup Report an error

  “Backs up data at least hourly, and tests recovery at least annually.”

• Access review Report an error

  “Reviews access permissions at least quarterly.”

• Retention Report an error

  “Retains data in line with our Privacy Policy.”

• Security contact Report an error

  “Get in touch with our security team at security@tailscale.com to disclose any security vulnerabilities.”

• No bounty program Report an error

  “Tailscale does not have a bounty program.”

• DPA Report an error

  “Does Tailscale have a DPA? Who are your subprocessors?”

• Shared responsibility model Report an error

  “To understand how responsibilities are shared between you and Tailscale, see the shared responsibility model.”

• Hardening guide Report an error

  “we recommend following our hardening guide.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Identity, access policy & device posture
• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Identity, access policy & device posture
• The IT Lead Logs, audit trail & incident response
• The IT Lead Architecture, reliability & security assurance
• The MSP Technician Access model & connectivity
• The MSP Technician Identity, access policy & device posture
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Identity, access policy & device posture
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Identity, access policy & device posture
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Identity, access policy & device posture
• The Skeptic Architecture, reliability & security assurance
• The Skeptic European sovereignty