Business VPN & Zero Trust Access
GoodAccess
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by GoodAccess s.r.o. · www.goodaccess.com
Compare with Twingate → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
GoodAccess at a glance
- Vendor
- GoodAccess s.r.o.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates GoodAccess 3/5, the mean of 6 judges. GoodAccess is a business VPN and zero trust network access platform from GoodAccess s.r.o., a Czech company. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
GoodAccess is a business VPN and zero trust network access platform from GoodAccess s.r.o., a Czech company. It scores highest on identity and policy: single sign-on with nine identity providers, SCIM provisioning, enforced MFA, and a device posture check that disconnects devices when policy changes. Access and connectivity and visibility and audit follow: dedicated gateways with static IPs in 35+ locations, per-application Access Cards, and logs with published fields streaming to named SIEMs over syslog with TLS at one-minute intervals. Sovereignty scores lowest at 2-4: the contracting entity is proven, but we found no public information on where account data and logs are stored or processed, on subprocessors, or on a published data processing agreement — a spread in penalty, not facts. Architecture and assurance sits at 5: SOC 2 and ISO 27001 are stated, and we found no public information on published audit reports. Deployment and administration scores 5-6; pricing transparency scores 6-7, and the captured pages give different figures for the Premium per-user price, $11 and $14.
Speaks for it
- Access Cards assign permissions per application on a least-privilege basis, with single sign-on for nine named identity providers, SCIM provisioning and enforced MFA with biometrics.
- Dedicated cloud gateways with unique static IPs in 35+ locations serve client apps for Windows, Mac, Android, iOS, Linux and Chrome OS.
- Device posture checks cover thirteen restriction types from disk encryption to running processes and disconnect non-compliant devices when policy changes.
- Access, admin, threat blocker and posture logs with published fields stream to named SIEMs including Microsoft Sentinel and Splunk over syslog with TLS at one-minute intervals.
- Pricing is largely public: Essential at $7 per user per month with a minimum of 5 users, dedicated gateways at $49 per month, additional connectors at $29 per month, a free Starter plan, a 14-day trial of all premium features with no credit card required, and 20% saved with annual billing.
Held against it
- Sovereignty scores span 2 to 4, and we found no public information on where account data, identities and connection logs are stored or processed, who the subprocessors are, or a published data processing agreement.
- Architecture and assurance scores sit at 5: SOC 2 and ISO 27001 are stated, and we found no public information on published audit reports, a bug bounty, or a public status page with incident history.
- Deployment and administration scores span 5 to 6, and we found no public information on Terraform or configuration as code, granular admin roles, a multi-tenant console for service providers, or a self-hosted edition; the platform is described as 100% SaaS-delivered.
- The captured pages give different figures for the Premium per-user price ($11 and $14), the Enterprise tier is On Request with a minimum of 50 users, and we found no public information on VAT treatment or minimum term.
- Log retention is stated as 90 days on the paid plans with custom retention on Enterprise, and we found no public information on tamper-evidence or retention of a year or more.
Best for
- You need to retire a firewall VPN with per-application access and a static IP your suppliers can whitelist.
- You run a team of five or more users and want a 100% SaaS service with MSI client deployment through MDM.
- You need continuous device posture enforcement on freelancers' own laptops, from disk encryption to running processes.
- You need access logs with published fields streamed to Microsoft Sentinel or Splunk, with 90-day retention.
Avoid if
- Your procurement requires a published data processing agreement, named subprocessors and stated data residency before signing; sovereignty scored 2 to 4.
- You need published audit reports or a public status page with incident history for a regulated review; architecture and assurance scored 5.
- You need log retention of a year or more out of the box; stated retention is 90 days on the paid plans, with a custom option on Enterprise.
- You need configuration as code or a self-hosted edition; the platform is described as 100% SaaS-delivered.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 3.5 of 5 |
| Logs, audit trail & incident response | 3.5 of 5 |
| Deployment, API & administration | 3 of 5 |
| Architecture, reliability & security assurance | 2.5 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
This covers most of what I need to retire the firewall VPN: client apps for every platform we run including ChromeOS, a dedicated gateway with a static IP I can whitelist at the supplier portal, split tunnelling, forced always-on, and a persistent connection that comes up at system startup before login. Access is granted per application through Access Cards, systems are defined by protocol, address and port, and site-to-site plus Cloud & Branch connectors for AWS, Azure, Google Cloud and OVHcloud run over IPsec, IKEv2 or OpenVPN across 35-plus gateway locations. It stops short of the top level: we found no public information on clientless browser access for contractors or connectors for Kubernetes. 1 3 4 14 19 21
The DevOps Engineer
One-click clients cover Windows, macOS, Linux, iOS, Android and Chrome OS with OpenVPN/IKEv2 protocol defaults, split tunnelling, forced always-on and persistent connect-at-startup; dedicated gateways with unique static IPs sit in 35+ locations, and Cloud & Branch connectors speak IPsec, IKEv2 or OpenVPN into AWS, Azure, Google Cloud and OVHcloud. Access Cards give per-application rather than whole-network access, and gateway assignment picks the lowest-latency location automatically. We found no public information on peer-to-peer mesh with relay fallback, connectors for Kubernetes, private or split DNS, clientless browser access for contractors, or connectors running as containers. 1 2 3 12 13 19 21 22
The MSP Technician
Dedicated cloud gateways with a static IP in a choice of 35+ locations, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, OpenVPN or IKEv2 for clients and IPsec or IKEv2 for site-to-site and cloud connectors into AWS, Azure, Google Cloud and OVHcloud — that covers nearly everything my thirty clients need. Per-application access through Access Cards plus forced always-on take it past a plain VPN. We found no public information on clientless browser access for contractors, split DNS, or peer-to-peer connections with relay fallback. 1 3 19 21 22
The Operations Manager
One-click client apps cover Windows, macOS, Linux, iOS, Android and ChromeOS, and remote access from freelancers' own laptops is supported with zero additional hardware. Access runs through a dedicated cloud gateway with its own static IP for whitelisting, offered in 35+ locations, with OpenVPN or IKEv2 on the client and IPsec, IKEv2 or OpenVPN on cloud and branch connectors for site-to-site into AWS, Azure, Google Cloud and OVHcloud. Per-application Access Cards, split tunnelling, forced always-on and a persistent connect-at-startup option round this out, though we found no public information on clientless browser access or peer-to-peer connections. 1 3 5 13 19 21 22
The Information Security Officer
Clients for every major platform including ChromeOS, per-application access through Access Cards, forced always-on, site-to-site links and Cloud and Branch connectors across AWS, Azure, Google Cloud and OVHcloud, dedicated gateways with static IPs in 35+ locations, and the tunnel protocols plus 10 Gbps gateway throughput documented. I found no public information on peer-to-peer connections with relay fallback, clientless browser access for contractors, or the individual gateway location names. 1 3 19 21 22
The Skeptic
Dedicated gateways with static IPs in 35+ locations, clients for six platforms including ChromeOS, split tunnelling, always-on and persistent pre-login connections, and site-to-site cloud and branch connectors over IPsec, IKEv2 or OpenVPN are all documented, and Access Cards assign permissions per application rather than per network. We found no public information on peer-to-peer connections with relays, clientless browser access for contractors, or split DNS, so this stays a gateway-hub model a notch below the top band. 1 3 13 19 22
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on with Microsoft Entra ID including SCIM provisioning is documented, so a leaver loses access the same day, with MFA, passkeys and biometrics on top. Access Cards assign least-privilege per-application permissions to members or groups, and device posture checks cover a long list of criteria from OS version and disk encryption to antivirus, registry keys and running services, re-checked periodically with non-compliant devices disconnected on policy change. We found no public information tying posture to EDR or MDM status such as Intune or CrowdStrike, and no policy-as-code or just-in-time approval workflow beyond time-based permissions. 5 9 15 16
The DevOps Engineer
Single sign-on is documented for nine-plus providers including Entra ID, Okta, Google Workspace and universal SAML, backed by SCIM provisioning, enforced MFA with PIN and biometrics, and least-privilege per-app Access Cards assignable to groups. The device posture engine is the standout: thirteen restriction types from disk encryption and antivirus to registry keys and running processes, rechecked every five minutes with non-compliant devices disconnected on policy change, plus time-based PIM/PAM permissions. We found no public information on policies kept as code, approval-based just-in-time workflows, or posture data sourced from EDR/MDM tools. 3 4 6 9 15 16 22
The MSP Technician
Single sign-on with Entra ID, Okta, Google Workspace, JumpCloud and universal SAML, SCIM provisioning from Entra, MFA with PIN and biometrics, and per-app Access Cards with least-privilege assignment — a model I can defend to a client auditor. Device posture is unusually deep for this class: disk encryption, antivirus, firewall, registry keys and running services, re-checked every five minutes with non-compliant devices disconnected. We found no public information on posture checks fed from EDR or MDM tools, approval-based just-in-time access beyond the listed time-based permissions, or policies kept as code. 4 9 15 16
The Operations Manager
Single sign-on works with Microsoft Entra ID, Okta, Google Workspace, JumpCloud and universal SAML, and SCIM provisioning means a departing freelancer's access ends when their account is disabled. Access Cards grant permissions per application on a least-privilege basis, and the device posture check re-evaluates OS version, disk encryption, running and updated antivirus, firewall and registry keys every 5 minutes, promptly disconnecting a device that stops complying. We found no public information on posture checks fed from EDR or MDM tools or on just-in-time approval, though time-based permissions are listed. 9 12 15 16 22
The Information Security Officer
Single sign-on with nine named identity providers, SCIM provisioning documented, least-privilege per-application assignment through Access Cards, and device posture checks that run at install, at login and every few minutes and disconnect non-compliant devices when a policy changes — the model I need before answering who could reach the control systems. I found no public information on posture sourced from EDR or MDM tools, policies kept as code, or device identity bound to hardware. 5 9 15 16 22
The Skeptic
Single sign-on with nine named identity providers, SCIM provisioning, enforced MFA with biometrics, and a device posture check with a long published list of criteria — disk encryption, antivirus, registry key, running process — re-evaluated every few minutes with non-compliant devices disconnected is genuinely documented. Time-based permissions are listed, but posture sources are generic antivirus and registry checks rather than named EDR or MDM tools, and we found no public information on policies as code, approval workflows, or hardware-bound device identity. 4 9 15 16
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Access logs record which users and devices reached which systems, with documented fields for user account ID, source and target IP, timestamp and data volume, plus separate admin, threat blocker, device posture and gateway access log types. Streaming to named SIEMs including Microsoft Sentinel and Splunk runs over syslog with TLS in one-minute intervals, and the API can trigger actions such as blocking a user when a threat is detected. Retention is stated at 90 days on both paid tiers with a custom option on Enterprise, and we found no public information on in-product alerting or on keeping logs on our own infrastructure. 7 17 18
The DevOps Engineer
Gateway access, system, admin, threat-blocker and device-posture logs are documented with their fields (user account ID, source and target IP, timestamp, data volume), streamable via syslog with TLS in JSON to named SIEMs including Microsoft Sentinel and Splunk in one-minute intervals, with the API able to trigger actions such as blocking a user. Retention is stated per plan — 90 days on Essential and Premium, custom on Enterprise — a real-time view of active users and devices exists, and the vendor states access logs are not available to anyone but the customer. We found no public information on retention of a year or more, alerts beyond posture-failure email notifications, or full export in an open, documented format. 4 7 9 17 18 22
The MSP Technician
Access logs record user account, source and target IP, timestamp and data volume, admin and gateway access logs exist, and everything streams as JSON over Syslog with TLS to Sentinel, Splunk, Elastic and others at one-minute intervals — enough to put in front of a client after an incident. Retention is 90 days on the standard tiers, custom on Enterprise. We found no public information on retention of a year or more, CSV export, or a documented log schema. 9 17 18 22
The Operations Manager
The product logs user account ID, source and target IP, connection timestamp and data volume for access to the network and each business system, keeps them 90 days on the paid tiers with a custom period on Enterprise, and states the access logs are available to no one but the customer. Admin logs, threat blocker logs, posture check logs and gateway access logs can stream to a SIEM as JSON over Syslog — UDP, TCP or TCP with TLS — in one-minute intervals, and the dashboard shows active users and devices in real time. We found no public information on retention beyond that, on filtering logs by user or resource, or on tamper-evidence. 4 7 9 17 18
The Information Security Officer
Gateway access, admin, threat blocker and device posture logs are documented and streamed to a SIEM over syslog with TLS in JSON at one-minute intervals, with named security operations integrations and stated log fields, and retention of 90 days on the paid plans with custom retention on Enterprise. Ninety days is short when my auditor asks about a full year, and I found no public information on log signing, tamper-evidence or long-term export formats. 7 9 16 18 22
The Skeptic
The log fields are published — user account ID, source and target IP, connection timestamp, data volume — and admin, gateway access, threat blocker and posture logs stream to named SIEM tools over Syslog with TLS in one-minute intervals. Retention is stated as 90 days with a custom option on the top plan and the vendor states the access logs "are not available to anyone except you"; we found no public information on tamper-evident logs or retention of a year or more. 4 9 17 18
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
The client ships as an MSI for MDM deployment with silent install, no-restart and per-user update switches plus a persistent flag and a default protocol — exactly what an Intune rollout needs — and there is a central web control panel and a documented REST API with scoped tokens, expiry, IP allowlists and activity monitoring. Support is priority chat and email on Premium and 24/7 phone on Enterprise, with a product changelog in the docs. We found no public information on Terraform or configuration as code, a multi-tenant console for service providers, or a self-hosted edition; the platform is described as 100% SaaS-delivered. 3 9 19 20
The DevOps Engineer
A central Control Panel, a documented REST API with a Postman collection and tokens carrying scopes, expiry, IP restrictions and activity monitoring, and MSI deployment through MDM with silent-install, no-restart and auto-update switches cover the day-to-day, with priority chat and email support on Premium and 24/7 phone on Enterprise, and setup claimed in ten minutes. We found no public information on a Terraform provider or configuration as code, granular admin roles beyond Admin and Team Owner, a multi-tenant console for service providers, or a self-hosted edition — the platform is described as 100% SaaS-delivered. 3 9 17 19 20 21
The MSP Technician
MSI deployment with silent-install, auto-update and protocol switches rolls out through MDM, the REST API takes scoped bearer tokens with IP allow-listing and a Postman collection, setup is quoted at ten minutes, and support runs chat and email with 24/7 phone at Enterprise. As a service provider with thirty tenants, what holds the score down is that we found no public information on a multi-tenant console with a tenant per client, per-tenant billing, Terraform or configuration as code, granular admin roles, or a self-hosted edition — the platform is described as 100% SaaS. 1 3 19 20 21
The Operations Manager
A web Control Panel manages the whole team, deployment is claimed at 10 minutes or one hour with no expert skills needed, and the client installs as an MSI through MDM tools with silent install, no-restart, auto-update and persistent-connection switches preconfigured. There is a documented REST API with scoped, expiring tokens restricted to allowed IP addresses, a Postman collection and activity monitoring, plus priority chat and email support on Premium and 24/7 phone on Enterprise. We found no public information on a Terraform provider, a multi-tenant console for service providers, or granular administrator roles. 1 3 9 19 20 21
The Information Security Officer
MSI packages for MDM deployment with silent install and centrally managed auto-updates, a documented API with a Postman collection and tokens scoped with expiry and IP restrictions, a central control panel, and support channels stated per plan up to 24/7 phone on Enterprise. I found no public information on a Terraform provider, a multi-tenant console for service providers, granular admin roles, or a self-hosted edition — the platform is described as 100% SaaS. 1 3 19 20 21
The Skeptic
A central control panel, a documented REST API with scoped, expiring, IP-restricted tokens plus a Postman collection, and MSI deployment through MDM with silent-install flags and automatic updates are all written down, with support channels stated per plan. We found no public information on Terraform or configuration-as-code, a multi-tenant console for service providers, granular admin roles beyond the Admin, or a self-hosted edition — the platform is described as 100% SaaS — and the API requires the Premium plan or higher. 3 9 19 20 21
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The documentation publishes an architecture overview naming the gateway, the team perimeter, the client apps and how connectors attach over IKEv2 or IPsec, and the vendor states SOC 2 and ISO 27001 certification with GDPR and HIPAA compliance, which is more than marketing. Encryption in transit is described and the client protocol defaults to OpenVPN or IKEv2, but key management is not described, and an SLA page exists though its terms are not shown. We found no public information on published audit or pentest reports, a bug bounty, the vendor's status page or incident history, or what happens to existing connections when the control plane is unavailable. 3 12 19 21
The DevOps Engineer
The support docs publish an architecture overview naming the Team, the dedicated cloud Gateway and its tasks, the Admin and the Cloud/Branch connectors; SOC 2 and ISO 27001 certification are claimed, an SLA document is listed, and customers can configure their environment in high-availability. We found no public information on what the vendor's gateways or control plane can see of customer traffic, published audit or pentest reports, a bug bounty, a public status page with incident history, or open-source components, and encryption is described in general terms without a key-management scheme. 3 4 11 12 21 22
The MSP Technician
The documentation publishes a real architecture overview — the Team as secure perimeter, a dedicated cloud Gateway, Systems defined by protocol, IP and port — and SOC 2 and ISO 27001 certification is stated, with an SLA document listed among the resources. Encryption is described only in general terms, and we found no public information on published audit or penetration-test reports, a public status page, incident history, or what happens to existing connections when the control plane is down. 3 12 21 22
The Operations Manager
The documentation lays out the architecture — a Team as the secure perimeter, a cloud-based gateway dedicated to one company, systems defined by protocol, IP and port, and connectors joining private networks over IKEv2 or IPsec — with OpenVPN and IKEv2 named for clients and encryption described for data in transit. SOC 2 and ISO 27001 certification is stated, a vulnerability disclosure statement exists, an SLA document is published, and the environment can be configured for high availability. We found no public information on published audit reports, a bug bounty, a public status page, or how keys are managed. 3 11 12 21 22
The Information Security Officer
A getting-started architecture overview documents the Team, Gateway and Client components and the tunnel protocols, SOC 2 and ISO 27001 certification is stated, an SLA document is published, high availability is configurable and gateway throughput is given. For the independent assurance a regulated buyer needs — published audit reports or summaries, a bug bounty, a vulnerability disclosure contact, a public status page with incident history — I found no public information. 2 3 9 12 21
The Skeptic
An architecture overview names the components and what the gateway does, SOC 2 and ISO 27001 certification is stated, high availability is mentioned and an SLA page exists — but these are statements, not published reports. On the questions that decide trust the pages are silent: we found no public information on a public status page with incident history, on what happens to existing connections when the vendor's own control plane is down, on key management, or on a bug bounty; encryption is described in marketing terms, with OpenVPN and IKEv2 named as client protocols. 3 12 19 21 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The legal pages name GoodAccess s.r.o., a Czech company with a company ID, so the contracting party is in the EU. Beyond that we found no public information on where account data, identities, connection logs and configuration are stored and processed, who the subprocessors are, or a published data processing agreement; the 35-plus worldwide gateway footprint is a network feature and says nothing about where the records live. 11 17
The DevOps Engineer
The contracting entity is evidenced — GoodAccess s.r.o., a Czech company with a published company ID — alongside privacy policy, terms, acceptable-use policy and SLA, and SOC 2/ISO 27001 stated. We found no public information on where the control plane, account data, identities and connection logs are stored and processed, on the subprocessors, or on a published data processing agreement, so the chain beyond the legal entity cannot be assessed. 3 10 11 12
The MSP Technician
The one link in the chain the pages prove is the contracting entity: GoodAccess s.r.o., a Czech company with a registered company ID in Ústí nad Labem. Beyond the privacy policy and terms, we found no public information on where account data, identities, connection logs and configuration are stored, who runs the control plane infrastructure, which subprocessors sit behind it, or a published data processing agreement. 11
The Operations Manager
The contracting entity is firm: GoodAccess s.r.o., a Czech company named in its legal pages, with a privacy policy and terms published. Beyond that, we found no public information on where the control plane, account data and connection logs are stored and processed, who the subprocessors are, or whether a data processing agreement is offered, and no European hosting claim appears on the captured pages. 10 11
The Information Security Officer
The contracting entity is GoodAccess s.r.o., a Czech company named with its company registration number on the legal pages, and a privacy policy with GDPR compliance claims exists. Everything else my auditor will ask about — where account data, user and device identities and connection logs are stored and processed, who the subprocessors are, and whether a data processing agreement is published — I found no public information on. 10 11 12
The Skeptic
The contracting entity is proven — GoodAccess s.r.o., a Czech company — and SOC 2 and ISO 27001 are stated. But on what actually decides sovereignty the pages are silent: we found no public information on where account data, identities and connection logs are stored and processed, who the subprocessors are, or a published data processing agreement. 3 11
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Published tiers give a per-user price with a five-user minimum on both paid plans, a free Starter tier, a 14-day trial without a card, a free tier, and priced add-ons: a dedicated gateway at $49/month and additional Clouds & Branch connectors at $29/month, with annual billing saving 20%. The feature-to-plan mapping is stated, so I can see that SSO and SCIM, SIEM streaming and device posture need Premium. The captured pages give different figures for the Premium per-user price ($11 versus $14 per user per month), the Enterprise tier is On Request from 50 users, and we found no public information on VAT treatment or a minimum term. 3 9 15
The DevOps Engineer
Essential is $7 per user per month (min. 5 users) and Premium is priced per user per month — the captured pages give different figures for Premium, $11 and $14 — with +$49/mo per dedicated gateway, $29/mo per additional Clouds & Branch connector, a free Starter tier, an extra 20% saved with annual billing, and per-plan gating documented for SSO/SCIM, SIEM, device posture and API integration. Enterprise is On Request at a 50-user minimum. We found no public information on VAT treatment or minimum term. 3 9 15 16 18 20 22
The MSP Technician
Per-user prices are public and quotable: Essential at $7 per user per month, minimum 5 users, Premium at $11 per user per month (the captured pages give different figures for Premium, $11 and $14), dedicated gateway at +$49 per month, additional connectors at $29 per month, 20% saved on annual billing, plus a free Starter plan and a 14-day trial with no card. Enterprise is priced "On Request" from 50 users. We found no public information on VAT treatment or minimum term, so for larger clients the final quote still needs a call. 3 9 22
The Operations Manager
The paid tiers are public with seat minimums — Essential at $7 PER USER / MONTH, Premium at either $11 or $14 PER USER / MONTH as the captured pages give different figures — plus +$49/mo per dedicated gateway, a $29/mo add-on for additional cloud and branch connectors, an extra 20% saved with annual billing, a free Starter tier and a 14-day trial of all premium features with no card required. Plan gating is clear: SSO and SCIM, SIEM integration, the API and device posture check all start at Premium. Enterprise is priced On Request, and we found no public information on VAT treatment or minimum term. 3 9 15 18 22
The Information Security Officer
Essential is public at $7 per user per month with a minimum of 5 users, dedicated gateway add-ons at $49 per month and cloud or branch connectors at $29 per month, a free Starter plan, a 14-day no-card trial, the feature-to-tier mapping for SSO, SCIM, SIEM and device posture, and an extra 20% saving with annual billing. The captured pages give different figures for the Premium per-user price ($11 and $14), Enterprise is on request, and VAT treatment and minimum term are not stated. 3 9 17 22
The Skeptic
Essential and Premium are priced per user with minimum seats, dedicated gateways at $49/mo, cloud and branch connectors at $29/mo, a 20% saving with annual billing, per-plan log retention, and a free Starter plan — most of a real cost model is public. The captured pages give different figures for the Premium price ($11 and $14 per user per month), the Enterprise tier is "On Request", and we found no public information on VAT treatment or minimum term. 3 9 22
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about GoodAccess
Is GoodAccess European?
Yes. whats-best.ai classifies GoodAccess as EU-Made.
Where does GoodAccess store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does GoodAccess have a free plan?
Yes. GoodAccess has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to GoodAccess?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: GoodAccess alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 58 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.goodaccess.com Checked 5 Nov 2026 Details →
- 2 Features page www.goodaccess.com Checked 5 Nov 2026 Details →
- 3 Features page (zero trust network access) www.goodaccess.com Checked 5 Nov 2026 Details →
- 4 Features page (access control) www.goodaccess.com Checked 5 Nov 2026 Details →
- 5 Features page (device posture) www.goodaccess.com Checked 5 Nov 2026 Details →
- 6 Features page (single sign-on) www.goodaccess.com Checked 5 Nov 2026 Details →
- 7 Features page (access logs) www.goodaccess.com Checked 5 Nov 2026 Details →
- 8 Documentation support.goodaccess.com Checked 5 Nov 2026 Details →
- 9 Pricing page www.goodaccess.com Checked 5 Nov 2026 Details →
- 10 About page www.goodaccess.com Checked 5 Nov 2026 Details →
- 11 Terms, privacy policy and SLA (names the operating company) www.goodaccess.com Checked 5 Nov 2026 Details →
- 12 Security / trust page www.goodaccess.com Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap www.goodaccess.com Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap www.goodaccess.com Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap www.goodaccess.com Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap support.goodaccess.com Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap www.goodaccess.com Checked 5 Nov 2026 Details →