Business VPN & Zero Trust Access
NetBird
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by NetBird GmbH · netbird.io
Compare with Tailscale → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
NetBird at a glance
- Vendor
- NetBird GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates NetBird 2/5, the mean of 6 judges. NetBird is a business VPN and zero-trust access service from NetBird GmbH of Berlin, contracting under German law, with an optional hosted reverse proxy. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
NetBird is a business VPN and zero-trust access service from NetBird GmbH of Berlin, contracting under German law, with an optional hosted reverse proxy. Its strongest criterion is sovereignty, scored 7-8: personal data is processed in the EU/EEA, application hosting runs on AWS restricted to EU/EEA servers, subprocessors are published with locations, and a data processing agreement is referenced — though user authentication runs through Auth0 in the USA under standard contractual clauses. Architecture and assurance follows at 4-6, resting on an ISO 27001 official certificate with audit report and a 2025 penetration test report, while the listed SOC 2 document is a letter of intent and no availability commitment was captured. Pricing transparency is the weakest mark at 2: contract mechanics are public, but no price figures appear. Judges split on visibility and audit, 0-4, over whether the traffic-event logging and event-streaming pages substitute for connection logs and SIEM export, and on deployment and administration, 2-5, where documented APIs satisfied some judges and missing multi-tenant tooling sank the service-provider score.
Speaks for it
- Contracting entity is NetBird GmbH of Berlin under German law, with personal data processed in the EU/EEA and application hosting on AWS restricted to EU/EEA servers.
- Trust page lists an ISO 27001 official certificate, its audit report and a 2025 penetration test report.
- Subprocessor list is published with names, locations and safeguards, and a NetBird data processing agreement is referenced.
- Public API documentation and a self-hosted quickstart are captured.
- Terms run for an indeterminate period cancellable on 14 days' notice to the end of the month, with self-service cancellation from the account.
Held against it
- No price figures, tier inclusions or seat minimums appear in the captured pages, leaving pricing transparency at 2.
- User authentication runs through Auth0 in the USA under standard contractual clauses.
- Judges split 0-4 on visibility and audit over whether the traffic-event logging and event-streaming documentation pages answer questions of connection logs, retention and SIEM export.
- Terms allow up to two hours of maintenance weekly on a shared, best-effort reverse proxy with no availability commitment captured.
- Captured pages give different signals on source availability: an 'OPEN SOURCE 30.7k' imprint badge versus terms stating the source code will not be disclosed.
Best for
- Your procurement requires a German legal entity, EU/EEA processing and a published subprocessor list — sovereignty is the bench's strongest scoring at 7-8.
- You want assurance evidence before contracting: an ISO 27001 official certificate, its audit report and a 2025 penetration test report are published.
- You want a low-commitment start: month-to-month terms, 14 days' notice and self-service cancellation from the account.
- You have engineers who can work from the documented API and the self-hosted quickstart, where the higher deployment scores came from.
Avoid if
- Your auditor asks who reached which system — visibility and audit scored 0 from several judges who found no public information on connection or access logs, retention periods or SIEM export.
- You need published prices or tier inclusions to budget a year — ask the vendor: the public pages we read do not show it
- You run a managed service provider across many client tenants — ask the vendor: the public pages we read do not show it
- Your environment includes nuclear, aviation or industrial safety systems, life-critical systems, medical devices or emergency-services infrastructure — the terms state the reverse proxy is not designed or intended for these.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 1.5 of 5 |
| Identity, access policy & device posture | 1.5 of 5 |
| Logs, audit trail & incident response | 2 of 5 |
| Deployment, API & administration | 1.5 of 5 |
| Architecture, reliability & security assurance | 2.5 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 1 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
The captured terms describe optional hosted reverse proxy services that "facilitate network connectivity between devices, networks, services, or the public internet", and device metadata fields point to AWS, GCP and Azure clouds with Docker, Kubernetes and OpenStack platforms. Beyond that, we found no public information in the captured facts on clients per platform, split tunnelling, static IPs for my supplier portal, site-to-site links or gateway locations. 11 12
The DevOps Engineer
The terms document optional hosted "Reverse Proxy" services that "facilitate network connectivity between devices, networks, services, or the public internet" on a shared, best-effort basis with quotas and bandwidth limits, and the homepage presents an open-source project with 30.7k stars. We found no public information in the captured pages on clients per platform, the protocol, per-resource access, NAT traversal or gateway and relay locations, so the access model is confirmed only at a basic level. 10 11 14 15
The MSP Technician
The vendor presents NetBird as a business VPN and zero trust access service, and the terms describe optional hosted reverse proxy services that facilitate connectivity between devices, networks, services and the public internet on a shared, best-effort basis with quotas and fair-use limits. Beyond that we found no public information on the protocol, client platforms, gateway or relay locations, site-to-site links or per-resource access. 1 11
The Operations Manager
The terms describe optional hosted proxy services that connect devices, networks, services and the public internet, the vendor presents the product as an open-source WireGuard mesh with a self-hosted route, and the captured documentation includes pages on how agents connect and on site-to-site links — clearly a genuine remote-access product rather than a consumer VPN or filter. But we found no public information in the captured facts on clients per platform, gateway or relay locations, split tunnelling, or letting a contractor reach one project system and nothing else, which is precisely what my freelancers need. That lands it just above the basic level. 11 10 14 15
The Information Security Officer
The captured pages describe a business VPN and zero-trust access product with an optional hosted reverse proxy that connects devices, networks and services, and the terms state that shared proxy path is not designed or intended for nuclear or industrial safety systems — a direct concern for our control-system environment. We found no public information on access granted per resource rather than per network, client platforms, the protocol used, or gateway locations, which is what I would need before answering my auditor. 1 11
The Skeptic
The terms describe optional hosted proxy services connecting devices, networks and the public internet on a shared, best-effort basis with quotas and fair-use, and documentation pages cover how the agent network works and site-to-site links. We found no captured facts on client platforms, split tunnelling, gateway locations, or access scoped per resource. 11 14 15
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Account authentication runs through Auth0 in the USA under standard contractual clauses, and the trust page lists multi-factor authentication, role-based access control and user access reviews among established controls. We found no public information in the captured facts on single sign-on with Microsoft Entra ID, SCIM or directory sync to cut off a leaver the same day, or on groups, per-resource policies and device posture checks. 12 13
The DevOps Engineer
The privacy policy shows user authentication running through Auth0 in the USA under standard contractual clauses, and the trust page lists role-based access control, multi-factor authentication and user access reviews as established controls — a basic identity layer. We found no public information in the captured pages on single sign-on with Entra ID, Google Workspace or Okta, SCIM deprovisioning, per-resource policies, just-in-time access or device posture checks. 12 13 16 17
The MSP Technician
The trust page lists role-based access control, multi-factor authentication, user access reviews and a password policy as established controls. We found no public information on single sign-on with the major identity providers, SCIM or directory sync, group policies per resource, or device posture checks. 13
The Operations Manager
The trust page states multi-factor authentication and role-based access control, the privacy policy shows authentication runs through Auth0, and the captured documentation includes pages on groups and access policies, device posture checks and SCIM sync with Microsoft Entra ID — on paper, exactly the machinery that ends a leaver's access with the contract. Nothing captured shows the actual policy model or confirms I could pin a freelancer to a single project system and nothing else. Solidly between the levels. 13 12 4 16 17
The Information Security Officer
The trust page states role-based access control, multi-factor authentication, user access reviews and a password policy, and user authentication runs through Auth0 as a listed subprocessor. We found no public information on single sign-on with our own identity provider, SCIM deprovisioning when someone leaves, groups or per-resource policies, or device posture checks before a connection is allowed — so I cannot treat this as least privilege for my network. 12 13
The Skeptic
Documentation covers groups and access policies, posture checks and Microsoft Entra ID SCIM sync, and the trust page lists role-based access control and multi-factor authentication. We found no captured facts on just-in-time access, session re-authentication, or which EDR or MDM tools the posture checks read from. 4 13 16 17
Logs, audit trail & incident response
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead not rated — no public information
We found no public information on connection or access logs, admin audit trails, retention periods or SIEM export; the captured documentation pages on traffic events and event streaming produced no confirmed facts, and the trust page describes NetBird's own access reviews and incident-response testing rather than anything my team could query after an incident. 13 18 19
The DevOps Engineer not rated — no public information
We found no public information on connection or access logs, admin audit logs, retention periods, SIEM streaming or session visibility in the captured pages. The trust page's access reviews and tested incident-response plan describe organizational controls rather than customer-facing logging. 13 18 19
The MSP Technician not rated — no public information
We found no public information on connection or access logs, an admin audit trail, retention periods per plan, active-session views, or export and streaming to a SIEM; the captured pages on traffic-event logging and event streaming gave me nothing I could rely on. 18 19
The Operations Manager
The captured documentation includes dedicated pages on traffic events logging and on event streaming, and the trust page lists user access reviews and a tested incident response plan — more than a bare list of connected users. But we found no public information on retention periods, export formats or a live session view I could use to kill a connection from a hotel lobby. Just below the middle level on documentation existence alone. 18 19 13
The Information Security Officer not rated — no public information
We found no public information on connection or access logs, admin and configuration audit logs, retention periods, or export and streaming to a SIEM in the captured pages; the only logging-adjacent facts concern the vendor's own operations. This is precisely the question my auditor asked about who reached the control systems, and I cannot answer it from the public evidence I read. 18 19
Deployment, API & administration
panel disagrees
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
The terms allow cancellation by logging into the account, defects go to hello@netbird.io, support runs through Slack, GitHub and a status page, and a weekly maintenance window of up to two hours is fixed in the terms. We found no public information in the captured facts on deploying clients through Intune or another MDM, a documented API, admin roles or multi-tenant management. 10 11
The DevOps Engineer
Support channels are named — Slack, GitHub and a NetBird status page, with defects reported by email — customers get an account with self-service cancellation, maintenance is capped at two hours a week, and role-based access control is listed on the trust page. The documentation set includes public API pages, but we found no public information in the captured pages on client deployment through MDM, configuration as code, a Terraform provider, granular admin roles or multi-tenant set-up. 10 11 13 20 21
The MSP Technician
Support runs through Slack, GitHub and a status page, defects go to an email address, and the terms allow weekly maintenance of up to two hours plus self-service cancellation by logging into the account. We found no public information on a central admin console, a documented API, MDM deployment of clients, admin roles, or a multi-tenant console I could run thirty clients from. 10 11
The Operations Manager
A public API is documented together with a management API section, a self-hosted quickstart exists, support runs through Slack, GitHub and a status page, and a customer can cancel by logging into the account with month-to-month terms and 14 days' notice. We found no public information on deploying clients through device management tools, admin roles, multi-tenant set-up or response times — and with no IT department, the push-deployment story is what I would actually buy on. Between the levels. 20 21 7 10 11
The Information Security Officer
Support runs through Slack, GitHub and a public status page, defects are reported by email, and the terms allow weekly maintenance of up to two hours with package-based scope and self-service cancellation. We found no public information on an admin console, a documented API, MDM deployment of clients, administrator roles, or multi-tenant operation for a service provider. 10 11
The Skeptic
API documentation, a self-hosted quickstart, support via Slack, GitHub and a status page, defect reports by email, and an indeterminate contract with self-service cancellation on 14 days' notice are all public in the captures. We found no captured facts on MDM-based client rollout, administrator roles, or running several tenants or organisations in one account. 7 10 11 20 21
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The trust page lists an ISO 27001 official certificate with audit report, a 2025 penetration test report, SOC 2 Type II, tested business-continuity and incident-response plans, and encryption with key management established, plus a public status page. The captured pages give different positions on source code — the imprint shows "OPEN SOURCE 30.7k" while the terms state the software's source code will not be disclosed — and we found no public information on what the control plane or relays can see, on high-availability behaviour, or on an availability commitment beyond the two-hour weekly maintenance window. 10 11 13
The DevOps Engineer
The trust page lists an ISO 27001 official certificate and audit report, a SOC 2 Type II attestation and a 2025 penetration test report, alongside tested continuity and incident-response plans, encryption at rest, in transit and key management, and the site runs a public status page. The homepage presents an open-source project with 30.7k stars while the terms state "the object or source code of the Software will not be disclosed" — the captured pages give different signals on source availability — and we found no published architecture describing what the coordination servers or relays can see, no SLA and no vulnerability disclosure contact. 10 11 13
The MSP Technician
The trust page states SOC 2 Type II, ISO 27001 with an official certificate and audit report, a 2025 penetration test report, encryption at rest and in transit with key management, and tested business continuity, disaster recovery and incident response plans. The captured pages give different pictures on source code: the imprint displays an 'OPEN SOURCE 30.7k' badge while the terms state 'The object or source code of the Software will not be disclosed.' We found no public information on the architecture and data flow, control-plane failover, or an availability SLA. 10 11 13
The Operations Manager
The trust page lists an official ISO 27001 certificate with its audit report, a 2025 penetration test report, SOC 2 as a letter of intent, tested business-continuity and incident-response plans, and encryption at rest, in transit and key management; a public status page, an architecture page and a self-hosted high-availability guide are also captured. The captured pages give different statements on source code — the imprint displays "OPEN SOURCE 30.7k" while the terms state the software's source code will not be disclosed — so I treat neither as settled. No SLA, bug bounty or incident history appears in the captured facts, and the terms allow up to two hours of maintenance a week, which keeps me below the higher marks. 13 10 11 3 22
The Information Security Officer
Independent assurance is stated concretely: an ISO 27001 official certificate and audit report, a 2025 penetration test report and SOC 2 Type II are listed on the trust page, alongside a public status page, encryption and key management statements, and tested continuity and incident response plans. We found no public information on the architecture and data flow, a vulnerability disclosure contact or bug bounty, or an availability SLA — the terms instead give a best-effort shared reverse proxy and weekly maintenance windows. The captured pages also give different signals on source availability: the homepage promotes an open-source project with 30.7k stars while the terms state the software's source code will not be disclosed. 10 11 13
The Skeptic
The trust page lists an official ISO 27001 certificate with its audit report, a 2025 penetration test report and SOC 2 Type II whose document on file is a letter of intent, and architecture and high-availability documentation pages exist. The captured pages give different pictures on source code: the imprint shows an open-source badge with 30.7k stars, while the terms state the source code will not be disclosed. We found no whitepaper on what the vendor can see, no bug bounty, and terms allowing the tool to be declined up to two hours weekly with no availability figure captured. 3 10 11 13 14 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
NetBird GmbH is registered in Berlin (HRB 237529 B) under German law and jurisdiction, the privacy policy commits to processing personal data in the EU/EEA with application hosting on AWS's Luxembourg entity restricted to EU/EEA servers, and there is a subprocessor list with names, locations and safeguards, a referenced data processing agreement, and ISO 27001. On the other hand, user authentication runs through Auth0 in the USA under Privacy Shield/EU standard contractual clauses, and several US website and marketing tools such as Cloudflare, HubSpot, Microsoft Clarity and Reddit appear in the list without a stated safeguard. 10 11 12 13
The DevOps Engineer
NetBird GmbH of Rosenthaler Straße, Berlin, registered at Amtsgericht Charlottenburg, contracts under German law, and the privacy policy commits to processing personal data in the EU/EEA with AWS limited to EU/EEA servers for application hosting. Subprocessors are listed with addresses, purposes and safeguards — though user authentication runs through Auth0 in the USA under standard contractual clauses, and marketing analytics reach Cloudflare, HubSpot, Microsoft Clarity and Reddit in the USA, some without a stated safeguard. A data processing agreement is declared applicable and ISO 27001 and SOC 2 Type II are stated, which lands this just short of a fully sovereign chain. 10 11 12 13
The MSP Technician
The contracting party is NetBird GmbH of Berlin under German law and jurisdiction, the privacy policy states personal data is processed in the EU/EEA with application hosting on Amazon Web Services EMEA in Luxembourg on EU/EEA servers only, a full subprocessor list with locations and safeguards is published, and the terms state a NetBird data processing agreement applies. Identity runs through Auth0 in the USA under EU Standard Contractual Clauses, and marketing and analytics processors in the USA are likewise listed with safeguards. ISO 27001 and GDPR are stated on the trust page. 10 11 12 13
The Operations Manager
The contracting entity is NetBird GmbH in Berlin under German law, the privacy policy states personal data is processed in the EU/EEA with application hosting on AWS confined to EU/EEA servers, and every subprocessor is listed with location and safeguard — including authentication through US-based Auth0 under standard contractual clauses and an Irish entity for application monitoring. A NetBird data processing agreement is referenced in the terms, and ISO 27001 plus SOC 2 are stated on the trust page, with an open-source self-hosted edition documented as the alternative chain. My one deduction is that user authentication identities flow through a US processor, so I sit at the strong-but-not-top mark. 12 11 10 13
The Information Security Officer
The contracting entity is NetBird GmbH in Berlin under German law, personal data is processed in the EU/EEA with application hosting on named AWS infrastructure restricted to EU/EEA servers, the subprocessor list is published with locations, a data processing agreement is referenced, and ISO 27001 and SOC 2 are stated. For my requirements the chain is not clean end to end: user identities (email and user ID) pass through Auth0 in the USA under standard contractual clauses, several web-facing subprocessors sit in the USA, and we found no public information pinning where connection logs and identities specifically reside. 11 12 13
The Skeptic
NetBird GmbH is registered in Berlin, contracts under German law, and the privacy policy states processing in the EU/EEA with application hosting on named AWS infrastructure in Luxembourg limited to EU/EEA servers, alongside a public subprocessor list with locations and a referenced data processing agreement. Identity still runs through Auth0 in the US under standard contractual clauses, and the same privacy policy lists device hostnames among data shared with OpenAI for beta features while also stating no personal data is transmitted to OpenAI. We found no captured statement of where connection logs specifically reside, nor the published text of the data processing agreement. 10 11 12 13
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The captured terms are clear on commercial mechanics — packages whose scope depends on the subscription, an indeterminate term cancellable monthly with 14 days' notice, self-service cancellation, and reverse proxy features subject to usage-based pricing, bandwidth limits, connection or relay quotas and fair-use policies. But no per-user or per-tier price figure appears in the captured facts, so I cannot compute what a 140-user year costs or whether a dedicated IP comes extra. 11
The DevOps Engineer
The terms confirm a package-based service — "The provided scope of the Services depends on the package the Customer subscribes for" — with reverse proxy features possibly subject to usage-based pricing, bandwidth limits and fair-use policies, an indeterminate term cancellable by month's end on fourteen days' notice, and self-service cancellation from the account. We found no public price per user or device, tier inclusions, minimum seats or self-hosted licence price in the captured pages, so a real annual cost cannot be computed from them. 9 11
The MSP Technician
The terms publish an indeterminate contract cancellable to the end of the month with 14 days' notice, self-service cancellation in the account, and usage-based pricing, bandwidth limits and fair-use quotas for reverse proxy features. We found no public information on per-user or per-device prices, tier inclusions, minimum seats, VAT treatment or the price of a self-hosted licence. 11
The Operations Manager
The captured terms tell me the scope depends on the subscribed package, the agreement runs month-to-month with 14 days' notice and self-service cancellation, and some reverse-proxy features carry usage-based pricing, bandwidth limits and fair-use quotas. But no per-user or per-tier price figure appears anywhere in the captured facts, so I cannot compute what a year for fifty people plus freelancers would cost. Contract terms are public; the price itself is not visible to me. 9 11
The Information Security Officer
The terms publish contract mechanics — an indeterminate term terminable with 14 days' notice to the end of the month, self-service cancellation from the account, package-based scope, and usage-based pricing with bandwidth limits and quotas for reverse-proxy features — but no price figures, tiers or scaling rules appear in the captured pages. An annual cost for a given number of users and gateways cannot be computed from what was captured. 9 11
The Skeptic
The public terms state that scope depends on the package, that reverse proxy features may carry usage-based pricing, bandwidth limits, quotas and fair-use, and that the contract runs indefinitely with monthly termination on 14 days' notice and self-service cancellation. The captured pricing page shows no price figures, and we found no per-user price, tier inclusions or seat minimums. 9 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about NetBird
Is NetBird European?
Yes. whats-best.ai classifies NetBird as EU-Made.
Where does NetBird store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does NetBird have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to NetBird?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: NetBird alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 284 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 26 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage netbird.io Checked 5 Nov 2026 Details →
- 2 Documentation docs.netbird.io Checked 5 Nov 2026 Details →
- 3 Documentation (architecture) docs.netbird.io Checked 5 Nov 2026 Details →
- 4 Documentation (groups and access policies) docs.netbird.io Checked 5 Nov 2026 Details →
- 5 Documentation (networks and routing) docs.netbird.io Checked 5 Nov 2026 Details →
- 6 Documentation (identity providers) docs.netbird.io Checked 5 Nov 2026 Details →
- 7 Documentation (self-hosting) docs.netbird.io Checked 5 Nov 2026 Details →
- 8 API documentation docs.netbird.io Checked 5 Nov 2026 Details →
- 9 Pricing page netbird.io Checked 5 Nov 2026 Details →
- 10 Legal notice netbird.io Checked 5 Nov 2026 Details →
- 11 Terms of service netbird.io Checked 5 Nov 2026 Details →
- 12 Privacy policy (with subprocessors and hosting) netbird.io Checked 5 Nov 2026 Details →
- 13 Security / trust page trust.netbird.io Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 15 Access model & connectivity — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 17 Identity, access policy & device posture — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 19 Logs, audit trail & incident response — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 21 Deployment, API & administration — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap docs.netbird.io Checked 5 Nov 2026 Details →