# NetBird — Business VPN & Zero Trust Access

NetBird by NetBird GmbH holds a panel rating of 2/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: EU-Made; sovereignty: not determined.

- Vendor: NetBird GmbH (https://netbird.io)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/business-vpn/netbird
- Alternatives: https://whats-best.ai/software/business-vpn/netbird/alternatives ([markdown](https://whats-best.ai/software/business-vpn/netbird/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: NetBird GmbH
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

NetBird is a business VPN and zero-trust access service from NetBird GmbH of Berlin, contracting under German law, with an optional hosted reverse proxy. Its strongest criterion is sovereignty, scored 7-8: personal data is processed in the EU/EEA, application hosting runs on AWS restricted to EU/EEA servers, subprocessors are published with locations, and a data processing agreement is referenced — though user authentication runs through Auth0 in the USA under standard contractual clauses. Architecture and assurance follows at 4-6, resting on an ISO 27001 official certificate with audit report and a 2025 penetration test report, while the listed SOC 2 document is a letter of intent and no availability commitment was captured. Pricing transparency is the weakest mark at 2: contract mechanics are public, but no price figures appear. Judges split on visibility and audit, 0-4, over whether the traffic-event logging and event-streaming pages substitute for connection logs and SIEM export, and on deployment and administration, 2-5, where documented APIs satisfied some judges and missing multi-tenant tooling sank the service-provider score.

**Speaks for it:**
- Contracting entity is NetBird GmbH of Berlin under German law, with personal data processed in the EU/EEA and application hosting on AWS restricted to EU/EEA servers.
- Trust page lists an ISO 27001 official certificate, its audit report and a 2025 penetration test report.
- Subprocessor list is published with names, locations and safeguards, and a NetBird data processing agreement is referenced.
- Public API documentation and a self-hosted quickstart are captured.
- Terms run for an indeterminate period cancellable on 14 days' notice to the end of the month, with self-service cancellation from the account.

**Held against it:**
- No price figures, tier inclusions or seat minimums appear in the captured pages, leaving pricing transparency at 2.
- User authentication runs through Auth0 in the USA under standard contractual clauses.
- Judges split 0-4 on visibility and audit over whether the traffic-event logging and event-streaming documentation pages answer questions of connection logs, retention and SIEM export.
- Terms allow up to two hours of maintenance weekly on a shared, best-effort reverse proxy with no availability commitment captured.
- Captured pages give different signals on source availability: an 'OPEN SOURCE 30.7k' imprint badge versus terms stating the source code will not be disclosed.

**Best for:**
- Your procurement requires a German legal entity, EU/EEA processing and a published subprocessor list — sovereignty is the bench's strongest scoring at 7-8.
- You want assurance evidence before contracting: an ISO 27001 official certificate, its audit report and a 2025 penetration test report are published.
- You want a low-commitment start: month-to-month terms, 14 days' notice and self-service cancellation from the account.
- You have engineers who can work from the documented API and the self-hosted quickstart, where the higher deployment scores came from.

**Avoid if:**
- Your auditor asks who reached which system — visibility and audit scored 0 from several judges who found no public information on connection or access logs, retention periods or SIEM export.
- You need published prices or tier inclusions to budget a year — ask the vendor: the public pages we read do not show it
- You run a managed service provider across many client tenants — ask the vendor: the public pages we read do not show it
- Your environment includes nuclear, aviation or industrial safety systems, life-critical systems, medical devices or emergency-services infrastructure — the terms state the reverse proxy is not designed or intended for these.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 2/5 |
| Identity, access policy & device posture | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 2.5/5 |
| Logs, audit trail & incident response | n/r | n/r | n/r | 2/5 | n/r | 2/5 |
| Deployment, API & administration | 1.5/5 | 1.5/5 | 1/5 | 2/5 | 1.5/5 | 2.5/5 |
| Architecture, reliability & security assurance | 2.5/5 | 2/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 |
| European sovereignty | 3.5/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 |
| Pricing transparency | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| **Weighted verdict** | **2/5** | **1.5/5** | **1.5/5** | **2/5** | **2/5** | **2.5/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access controls: RBAC · Multi Factor Authentication · User Access Reviews · Password policy [S13]
- Badges: yes · yes · yes [S10]
- Badges: GDPR · ISO 27001 · DORA [S11]
- Certifications: SOC 2 Type II · DORA 2025 · ISO 27001 · GDPR [S13]
- Certifications: GDPR · ISO 27001 · DORA [S12]
- Cookie consent required matomo: yes [S12]
- Documents: SOC2 Letter of Intent · Penetration Test Report 2025 · ISO 27001 - Official Certificate · ISO 27001 - Audit Report [S13]
- DPA reference: yes [S11]
- Encryption: yes · yes · yes [S13]
- Ssl: yes [S12]
- Trust platform: Scytale.ai [S13]

**Data**
- Access after termination: no [S11]
- Deletion: withdrawal of consent · no longer necessary · lapse of legal retention periods [S12]
- Retention basis: HGB · AO [S12]
- Rights: access · rectification or erasure · restriction of processing · data portability · withdraw consent · objection [S12]
- Sharing recordings: recordings shareable via cryptographically secure random links; anyone with exact link can access [S12]

**Hosting**
- Residency: EU/EEA · yes [S12]
- Self or processor servers: NetBird-owned servers or engaged data processor servers [S11]

**Legal**
- Address: Berlin · Rosenthaler Str. 36 · 10178 [S10]
- Content license: worldwide, non-exclusive, royalty-free, term of agreement [S11]
- Controller: legal@netbird.io · NetBird GmbH · Rosenthaler Str. 36, 10178 Berlin [S12]
- Customer type: Germany · yes [S11]
- Entity: NetBird GmbH [S11]
- Entity name: NetBird GmbH [S10]
- Feedback license unlimited: yes [S11]
- Governing law: yes · Germany [S11]
- Liability paid services: intent or gross negligence, slight negligence only for essential obligations [S11]
- Marketing reference right: yes [S11]
- Place of jurisdiction: registered office of NetBird [S11]
- Policy change right: yes [S12]
- Privacy policy URL: https://netbird.io/privacy [S13]
- Register: Amtsgericht Berlin (Charlottenburg) · HRB 237529 B [S10]
- Register: Amtsgericht Berlin (Charlottenburg) · HRB 237529 B [S12]
- Terms URL: https://netbird.io/terms [S13]
- Tos change termination right: yes [S11]

**Pricing**
- Self service cancellation: yes [S11]
- Termination terms: indeterminate · 14 [S11]

**Product**
- AI openai beta: yes [S12]
- Continuity controls: Business Continuity and Disaster Recovery plans · Continuity and Disaster Recovery plans tested · Incident Response plan tested · Data backups and restoration procedures tested [S13]
- Endpoint controls: Endpoint Detection and Response · Disk encryption · Threat and Malware protection · Endpoint Management policies [S13]
- Maintenance window: 2 [S11]
- Newsletter double optin: yes [S12]
- Newsletter open tracking: Mailchimp · HubSpot [S12]
- Open source stars: 30700 [S10]
- Organization controls: Risk Assessment and treatment · Vendor Risk Management · Asset Management · Security Awareness Training [S13]
- Reverse proxy: optional hosted proxy services · yes [S11]
- Reverse proxy best effort: yes [S11]
- Reverse proxy limits: yes · yes · yes · yes [S11]
- Reverse proxy prohibited envs: life-critical systems · medical devices · emergency services · nuclear/aviation/industrial safety [S11]
- Scope by package: yes [S11]
- Security controls: Secure Software Development Lifecycle · Penetration Testing · Change Management · Vulnerability scanning [S13]
- Source code not disclosed: no [S11]

**Subprocessors**
- Auth0: Auth0 · User Authentication · Privacy Shield / EU SCCs [S12]
- Aws: AWS · Application hosting and CDN · EU/EEA servers only [S12]
- Brevo: Brevo (Sendinblue) · Email delivery, Onboarding, CRM [S12]
- Cloudflare: Cloudflare · Bot management, CDN, Website security [S12]
- Google ads: Google Ads · Advertising, Conversion tracking [S12]
- Hotjar: Hotjar · Analytics [S12]
- Hubspot: HubSpot · Marketing, Analytics, CRM [S12]
- Matomo: Matomo (InnoCraft) · Analytics · EU/EEA servers, IP anonymized [S12]
- Microsoft clarity: Microsoft Clarity · Analytics [S12]
- New relic: New Relic · APM and error reporting [S12]
- Openai: OpenAI · Beta AI features · yes [S12]
- Openai no personal data: yes [S12]
- Reddit: Reddit · Advertising, Conversion tracking [S12]
- Trust center list: yes [S12]

**Support**
- Channels: Slack · GitHub · Status page [S10]
- Defect report email: hello@netbird.io [S11]

## Questions

### Is NetBird European?

Yes. whats-best.ai classifies NetBird as EU-Made.

### Where does NetBird store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does NetBird have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to NetBird?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [NetBird alternatives](https://whats-best.ai/software/business-vpn/netbird/alternatives).

## Head-to-head

- [NetBird vs Tailscale](https://whats-best.ai/compare/netbird-vs-tailscale.md)

## What this page leaves out

- 284 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 26 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://netbird.io/ (checked 2026-11-05)
- [S2] Documentation: https://docs.netbird.io/ (checked 2026-11-05)
- [S3] Documentation (architecture): https://docs.netbird.io/about-netbird/how-netbird-works (checked 2026-11-05)
- [S4] Documentation (groups and access policies): https://docs.netbird.io/manage/access-control (checked 2026-11-05)
- [S5] Documentation (networks and routing): https://docs.netbird.io/manage/networks (checked 2026-11-05)
- [S6] Documentation (identity providers): https://docs.netbird.io/selfhosted/identity-providers (checked 2026-11-05)
- [S7] Documentation (self-hosting): https://docs.netbird.io/selfhosted/selfhosted-quickstart (checked 2026-11-05)
- [S8] API documentation: https://docs.netbird.io/api (checked 2026-11-05)
- [S9] Pricing page: https://netbird.io/pricing (checked 2026-11-05)
- [S10] Legal notice: https://netbird.io/imprint (checked 2026-11-05)
- [S11] Terms of service: https://netbird.io/terms (checked 2026-11-05)
- [S12] Privacy policy (with subprocessors and hosting): https://netbird.io/privacy (checked 2026-11-05)
- [S13] Security / trust page: https://trust.netbird.io/ (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://docs.netbird.io/agent-network/how-it-works (checked 2026-11-05)
- [S15] Access model & connectivity — found from sitemap: https://docs.netbird.io/use-cases/remote-access/site-to-site (checked 2026-11-05)
- [S16] Identity, access policy & device posture — found from sitemap: https://docs.netbird.io/manage/access-control/posture-checks (checked 2026-11-05)
- [S17] Identity, access policy & device posture — found from sitemap: https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-scim-sync (checked 2026-11-05)
- [S18] Logs, audit trail & incident response — found from sitemap: https://docs.netbird.io/manage/activity/traffic-events-logging (checked 2026-11-05)
- [S19] Logs, audit trail & incident response — found from sitemap: https://docs.netbird.io/manage/activity/event-streaming (checked 2026-11-05)
- [S20] Deployment, API & administration — found from sitemap: https://docs.netbird.io/api/introduction (checked 2026-11-05)
- [S21] Deployment, API & administration — found from sitemap: https://docs.netbird.io/manage/public-api (checked 2026-11-05)
- [S22] Architecture, reliability & security assurance — found from sitemap: https://docs.netbird.io/selfhosted/maintenance/scaling/high-availability (checked 2026-11-05)

---

Cite as: whats-best.ai, "NetBird — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/netbird

Corrections: https://whats-best.ai/correct/1591?target=page