Business VPN & Zero Trust Access
Netmaker
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Netmaker, Inc. · www.netmaker.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Netmaker at a glance
- Vendor
- Netmaker, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Netmaker 3/5, the mean of 6 judges. Netmaker is an open-source virtual networking platform built on WireGuard. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Netmaker is an open-source virtual networking platform built on WireGuard. Its strongest scores are for connectivity and administration: access and connectivity and deployment and administration sit at 7, with identity and policy at 6-7. Judges credited combinable patterns — peer-to-peer mesh, split and full tunnel, site-to-site, hub-and-spoke — single sign-on with Google, Microsoft Entra ID and Okta, and a documented API, CLI and Intune silent install. Sovereignty is the weakest and most divided area, with scores spreading 2 to 4: contracting is with Netmaker, Inc. under New York law and exclusive New York County venue, and judges weighed that differently against the self-hosting path available on every plan. Architecture and assurance scored 4-5, and we found no public information on independent audits, a status page, or any SLA beyond a custom Enterprise MSA. Visibility and audit scores sit at 6, with traffic logs in beta, Business-plan only, and needing Netmaker team activation. Pricing transparency spans 5-6: Team is "STARTING $ 2 / active connection / month", Business $ 4, but the captured pages give different per-connection figures and Enterprise is custom.
Speaks for it
- Peer-to-peer WireGuard mesh with relays, split-tunnel egress, full-tunnel internet gateways, site-to-site and hub-and-spoke, combinable in one deployment.
- Single sign-on with Google, Microsoft Entra ID and Okta, with SCIM provisioning and just-in-time access requiring approval at the Enterprise tier.
- Traffic logs record source, destination, protocol, ports, direction and volume, and events stream to Datadog, Splunk, Microsoft Sentinel or Elastic Security.
- Server and client source code are open on GitHub, with a downloadable OpenAPI document, an NMCTL CLI, and silent Windows deployment via Microsoft Intune.
- Self-hosting is available on every plan, including an on-premises edition described as storing data entirely within your infrastructure.
Held against it
- New networks auto-generate default policies enabling unrestricted two-way communication, so least privilege must be configured by hand.
- Traffic logs are beta and Business-plan only, requiring activation by the Netmaker team when not in the plan, and we found no public information on retention periods.
- We found no public information on independent security audits, penetration tests, a bug bounty, a public status page, or an SLA below custom Enterprise contracts.
- Sovereignty scores spread 2 to 4 over contracting under New York law with exclusive New York County venue, no public information on where the hosted control plane or logs live, and terms barring air-gapping the commercial platform without permission.
- Enterprise is custom "Contact us", the captured pages give different figures for the per-connection rate, and we found no public information on VAT treatment, minimum seats or minimum term.
Best for
- You are an MSP or multi-client consultancy that needs per-tenant isolation with usage and billing monitoring per tenant.
- Your estate mixes managed servers and unmanaged contractor phones and laptops, which join through generated WireGuard config files or QR codes.
- You want to run the platform yourself, on-premises, with data stored entirely within your infrastructure.
- You administer Windows fleets through Microsoft Intune and want a silent, preconfigured desktop deployment.
Avoid if
- You need least privilege out of the box — new networks start open, with auto-generated two-way policies.
- You need a fixed, predictable annual budget — billing is per daily active connection, and the captured pages give different per-connection figures.
- Your procurement requires published service levels and independent audit evidence — service levels appear only as custom Enterprise contracts, and we found no public information on independent audits.
- You must contract under European law or venue, or air-gap the platform — the terms specify New York law, exclusive New York County venue, and bar air-gapping the commercial platform without permission.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 3.5 of 5 |
| Logs, audit trail & incident response | 3 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 2 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 3 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
WireGuard mesh with direct peer-to-peer links and relays as fallback, egress and internet gateways for split or full tunnel, site-to-site over hub-and-spoke with routers, managed DNS with rules pushed to clients, and apps for Windows, macOS, Linux plus iOS and Android — that covers our two plants and the sales office. The gateways are nodes we run ourselves, which the documentation says need a public IP address; we found no public information on a dedicated static IP as a product offering, clientless browser access for contractors, or vendor-run gateway regions. 3 4 7 12 13 21
The DevOps Engineer
WireGuard mesh with peer-to-peer as the default and relays as fallback, UDP hole punching so no inbound ports, netclient across many Linux dists plus Docker and a Kubernetes operator, remote access gateways handing config files to phones and laptops, and documented split tunnel, full tunnel, site-to-site and managed private DNS cover most of my estate. I found no public information on clientless browser access for contractors or hosted gateway and relay regions, and the docs state the gateway node should have a public IP, which keeps it below the top band. 4 5 7 9 12 13 21
The MSP Technician
This covers the patterns I actually deploy across thirty clients: a WireGuard mesh with direct peer-to-peer by default, relays and a Remote Access Gateway for phones and laptops, split tunnels via egress gateways, full tunnels via internet gateways, and site-to-site over static WireGuard on routers, all combinable in one deployment. Desktop apps for Windows, macOS and Linux plus iOS and Android, UDP hole punching and zero-touch NAT traversal are documented, and any WireGuard-capable contractor device can join with a generated config file. We found no public information on clientless browser access, on cloud connectors for AWS, Azure or Google Cloud beyond the Kubernetes operator, or on throughput figures per gateway type. 7 9 12 13 21
The Operations Manager
This fits my freelance model: peer-to-peer WireGuard mesh with relays and NAT traversal, desktop apps for Windows, macOS and Linux plus iOS and Android, split tunnelling through an egress gateway, full tunnel through an internet gateway, managed private DNS, and a contractor gets a generated WireGuard config or QR code on their own phone without a managed device. It stops short of the top levels on the parts I would want spelled out: gateway and relay regions are not described, there is no clientless browser access, cloud connectors stop at a Kubernetes operator, and the remote-access gateway expects a node with a public IP rather than one behind NAT. 4 9 12 13 18 21
The Information Security Officer
WireGuard mesh with direct peer-to-peer links and relays, egress and internet gateways for split- and full-tunnel, site-to-site via static WireGuard, and remote access gateways with DNS rules pushed to source devices cover nearly every access pattern we run; clients span Windows, macOS, Linux, iOS and Android, with Intune silent installs, start-on-login and always-on WireGuard configurations documented. We found no public information on named gateway or relay regions, clientless browser access for contractors, or post-quantum key exchange, which keeps this short of the top level. 4 5 12 13 18 21
The Skeptic
WireGuard mesh with direct peer-to-peer links, relays, remote access gateways, split-tunnel egress gateways, full-tunnel internet gateways, site-to-site and hub-and-spoke in one product, plus desktop apps for Windows, macOS and Linux, mobile apps for iOS and Android, and a long list of Linux systems for the agent. Managed private DNS, UDP hole punching, auto-start on login and plain WireGuard config files for contractor phones are all documented. It stops short of the top level because no gateway or relay regions are named, failover appears only as a listed feature without documented behaviour, and we found no public information on connectors for AWS, Azure or Google Cloud, throughput per gateway, or post-quantum key exchange. 4 7 12 13 18 21
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on with Microsoft Entra ID, Google and Okta plus MFA, groups synced from the identity provider, access rules down to ports and hostnames, session expiry on inactivity, SCIM provisioning and just-in-time access with approval on the Enterprise tier, and MDM and EDR posture checks on Business (marked beta). Two things temper it: the auto-generated default policies open unrestricted two-way communication until we tighten them by hand, and we found no public information on policies kept as code. 2 6 7 9 14 15 21
The DevOps Engineer
SSO with Google, Entra ID and Okta, SCIM provisioning on Enterprise, just-in-time access with explicit approval, and MDM/EDR posture checks with severity levels and real-time compliance monitoring are all documented, though posture checks are marked beta and gated behind a paid tier, with the pricing page and the feature docs naming different tiers. Policies can be default-deny by hostname, port and direction, but a new network auto-generates open two-way policies, so least privilege is opt-in. I found no public information on a Terraform provider or any policies-as-code path. 2 6 8 9 14 15 21
The MSP Technician
Single sign-on with Google, Microsoft Entra ID and Okta is on the Team plan, and Enterprise adds SCIM provisioning from those same providers, so a leaver at a client loses access automatically. Per-resource policies with tags, ports, hostnames and one-way traffic, beta posture checks reading MDM enrolment and EDR health, and just-in-time access requiring explicit approval are all documented. We found no public information on policies kept as code or hardware-bound device identity, and the auto-generated default policies open two-way communication between all users and resources, which I would have to tighten on day one. 2 6 9 14 15
The Operations Manager
User policies that decide who reaches which server, groups synced from Entra ID, Google or Okta, MFA even on the free tier and just-in-time access with approval are exactly the controls a consultancy with freelancers needs, and posture checks cover operating system, MDM and EDR state with non-compliant users flagged. Two cautions: new networks come with auto-generated policies enabling unrestricted two-way communication, so least privilege is mine to configure by hand, and SCIM provisioning, just-in-time access and SIEM sit on the Enterprise tier while posture checks are marked beta and Pro-only. 2 5 6 9 14 15
The Information Security Officer
SSO with Entra ID, Google and Okta, MFA, group-based user and resource policies down to direction, port, destination and hostname, SCIM provisioning from the major identity providers at the Enterprise tier, and just-in-time access requiring explicit approval are all documented; posture checks read MDM and EDR state including agent health, risk levels and check-in freshness. Two cautions for my audit file: posture checks are marked beta and Pro-only, and the default policies auto-generated on network creation enable unrestricted two-way communication rather than least privilege. 2 6 7 9 14 15
The Skeptic
SSO with Google, Microsoft Entra ID and Okta plus MFA are priced into the paid tiers, and SCIM provisioning, just-in-time access with explicit approval, and EDR and MDM posture checks are documented — the posture checks as a beta feature of the Business plan. What keeps me cautious: every new network is created with auto-generated default policies enabling unrestricted two-way communication between all users and all resources, so least privilege is a configuration project rather than the starting state, and we found no public information on continuous in-session re-evaluation, access approvals with expiry, or policies kept as code. 2 6 7 9 12 14 15
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Traffic logs record source, destination, protocol, port, direction and volume with filters and documented fields, audit logging ships with the Business plan, and an Enterprise SIEM integration streams audit and network activity to Datadog, Splunk, Microsoft Sentinel or Elastic Security. The traffic logs are marked beta, Business-only and need the Netmaker team to activate, and we found no public information on retention periods, export to CSV or API, or a statement of what traffic data is not logged. 9 16 17
The DevOps Engineer
Traffic logs record source, destination, protocol, port, direction and volume with documented fields and filters, audit logging ships on Business, and SIEM streaming to Datadog, Splunk, Microsoft Sentinel and Elastic Security is documented with a connection test. I found no public information on retention periods, vendor-side alerts or webhooks, or a statement of what traffic data is not logged. 2 9 16 17
The MSP Technician
After an incident I could show a client who talked to what: traffic logs with source, destination, protocol, ports, direction and volume, filterable and with domain names for external destinations, plus audit logging on the Business plan, and streaming to Datadog, Splunk, Microsoft Sentinel or Elastic Security is documented on Enterprise with a connection test. We found no public information on how long logs are kept, on a live session view with the ability to end sessions, or on what traffic data is and is not logged. Traffic logs are a Business-plan feature in beta that the Netmaker team must activate if not included in the plan. 9 16 17
The Operations Manager
Traffic logs record source, destination, protocol, ports, direction and volume with filters by time, protocol and source, and there is documented audit logging plus SIEM streaming to Datadog, Splunk, Microsoft Sentinel or Elastic Security, which is how I would prove afterwards which freelancer touched what. But traffic logs are a Business-plan beta that needs the vendor to activate them, SIEM sits on Enterprise, and we found no public information on retention periods, export formats, native alerts or a statement of what traffic data is not logged; revoking a lost device is a toggle or a delete in the console, which does cover my worst case. 7 9 12 16 17
The Information Security Officer
Traffic logs are documented with source, destination, protocol, port, direction and volume, and the SIEM integration streams audit and network activity events to Datadog, Splunk, Microsoft Sentinel and Elastic Security with a connection test — the log-to-SIEM path my auditor asks about exists, though at the top tiers only. We found no public information on log retention periods, alerting on unusual access, or tamper-evidence of the trail, and traffic logs are marked beta, Business-plan only, and require the Netmaker team to activate them. 2 7 9 16 17
The Skeptic
Traffic logs record source, destination, protocol, ports, direction and volume with filters and documented entry fields, audit logging ships from the Business plan, and events stream to Datadog, Splunk, Microsoft Sentinel and Elastic Security from Enterprise, with per-client revocation available. But traffic logs are marked beta and plan-gated, and we found no public information on retention periods, alerts on unusual access, log export in an open format, or any statement of what traffic data is and is not logged — the questions an investigator asks first. 2 9 12 16 17
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
There is a step-by-step Intune deployment guide for the Windows desktop app with silent install flags and a preconfigured config file — exactly what my team needs instead of another weekend on the firewall — plus a documented REST API with a downloadable OpenAPI document and a CLI, multi-tenant management with an MSP platform, and every plan supporting cloud or on-premises. We found no public information on a Terraform provider or webhooks and ticketing integrations, and support runs by email with no stated response times. 8 9 18 19 21
The DevOps Engineer
A downloadable OpenAPI spec, an NMCTL CLI, a tenants page plus an MSP platform for multi-customer work, administrator/auditor/network-user roles, and a real self-hosted and on-prem edition with the server running as a Docker container cover most of a small team's needs. The Intune guide does silent Windows installs with preconfigured startup, but I found no public information on MDM deployment for macOS or on a Terraform provider and configuration as code. The licence also bars air-gapping the commercial instance without permission, and response times per plan are not stated. 7 8 9 10 18 19 21
The MSP Technician
This is close to what I run: the Account Management UI manages tenants with isolated networks and gateways per tenant, per-tenant usage and bill monitoring, backed by a dedicated MSP platform and a partner programme with margins. An OpenAPI 3.1.1 document and the NMCTL CLI are published, Netmaker Desktop deploys silently through Microsoft Intune with automatic configuration and start-on-login, and every plan supports cloud or on-premises. We found no public information on a Terraform provider, webhooks into ticketing or chat tools, or support response times per plan — support is by email, with standard, priority and dedicated tiers named but unquantified. 8 9 18 19
The Operations Manager
A single command enrols a server, a QR code onboards a phone, and the Intune guide silently installs, preconfigures and auto-starts the Windows desktop client at login, which is the kind of setup someone who is not an IT specialist can follow. There is a central console, a documented REST API with a downloadable OpenAPI document, admin roles of administrator, auditor and network user, tenant management with an MSP platform, and Docker or systemd for the server; we found no public information on Terraform or other configuration-as-code, on webhooks or ticketing integrations, or on MDM deployment guides beyond Intune on Windows. 4 8 9 18 19 21
The Information Security Officer
A documented REST API with a downloadable OpenAPI specification and an NMCTL CLI, an Intune deployment guide with silent install and automatic startup, an auditor role alongside administrator and network user, multi-tenant management with an MSP platform, and a production-documented on-premises edition make this runnable by a small team or a service provider. We found no public information on a Terraform provider, configuration as code, staged client and gateway update rollouts, or support response times per plan. 6 7 8 9 18 19
The Skeptic
A documented REST API with a downloadable OpenAPI specification and a CLI, Docker or systemd server deployment, Intune packaging with silent install and preconfigured startup, admin roles, and per-tenant isolation, billing and usage monitoring for managed service providers — with cloud or on-premises available on every plan and email support at three named tiers. We found no public information on Terraform or configuration as code, webhooks or ticketing integrations, or staged rollout of client and gateway updates. 7 8 9 10 18 19 21
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The architecture is documented in real depth — golang server, MQTT broker, CoreDNS, database choices, UDP hole punching — with server and client open source on GitHub, traffic direct peer-to-peer, and failover servers on the Pro edition. But nothing published proves the security claims: we found no public information on independent audits or penetration tests, a bug bounty, a status page or an SLA with numbers, and the terms disclaim all warranties. 4 7 9 10 21
The DevOps Engineer
The architecture page names the components — server, clients, MQTT broker, DNS service — and both server and netclient are open source on GitHub, with auto-rerouting, DNS load balancing and Pro failover servers covering reliability. I found no public information on what the server or relays can see of the traffic, nor on independent audits, a bug bounty, a public status page or a published SLA; Enterprise gets custom MSA and SLAs only. 4 7 9 21
The MSP Technician
The building blocks are public and inspectable — the server and netclient are open-source Go binaries on GitHub, the MQTT broker, database options and Caddy proxy are documented, traffic runs peer-to-peer over WireGuard, and failover servers with automatic rerouting around failed nodes are listed features. For a buyer who must prove it to a client, assurance is thin: we found no public information on independent security audits, penetration test reports, a bug bounty, a public status page or control-plane availability, and the only SLA we found is a custom MSA on Enterprise. The terms also bar air-gapping the commercial platform without permission because usage is reported for billing. 4 7 9 10 21
The Operations Manager
The architecture documentation names the moving parts — server, clients, MQTT broker, DNS service, database options — puts server and client source code on GitHub, and describes automatic re-routing around failed nodes, DNS-based load balancing and failover servers. We found no public information on independent audits or penetration tests, a bug bounty, a public status page with incident history, or what happens to live sessions if the coordination service goes down, and the only SLA mentioned is a custom MSA on the Enterprise plan. 4 7 9 21
The Information Security Officer
The architecture page names the components, message broker, databases and proxy choices, the server and netclient source are published on GitHub, and failover plus automatic rerouting on node failure are documented. The assurance evidence my regulator expects is thin: we found no public information on independent security audits or penetration tests, a bug bounty, a public status page with incident history, or an availability SLA on the business plans — service levels appear only as custom Enterprise contracts. 4 7 9 21
The Skeptic
The architecture is published in real detail — a Go server, an MQTT broker, CoreDNS, relays and gateways, with server and client source on GitHub — and traffic is peer-to-peer over WireGuard, with a captured cybersecurity incident disclosure policy page. But we found no public information on independent audits or pentest reports, a bug bounty, a public status page, an SLA below custom enterprise agreements, or what happens to connections when the coordination server is down; and the terms forbid air-gapping the commercial instance without permission because the vendor bills on usage, so the self-hosted control plane still calls home. 4 7 9 10 20 21
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting entity is Netmaker, Inc. under New York law with exclusive venue in New York County, and where account data, identities and logs are hosted is not stated; the Enterprise tier lists a "Choice of Data Residency" without naming locations. An on-premises edition keeps data on our own infrastructure, though the terms forbid air-gapping the commercial platform without permission, and we found no public information on a data processing agreement or a subprocessor list beyond Stripe for payments. 7 9 10 11
The DevOps Engineer
Contracting is Netmaker, Inc. under New York law, payment runs through Stripe, and where the hosted control plane and logs live is not stated; I found no data processing agreement or subprocessor list. Enterprise sells a choice of data residency and the on-prem edition documents data stored entirely within your infrastructure, but the commercial licence bars air-gapping without permission and allows aggregate usage reporting, so the self-hosted chain still reports home. 7 9 10 11
The MSP Technician
The contracting entity is Netmaker, Inc. under New York law with exclusive venue in New York County, the privacy policy covers only the vendor's website while naming just Stripe for payment, and we found no public information on where the cloud control plane, identities and logs are hosted or which subprocessors process them. Enterprise lists a "Choice of Data Residency" without naming locations, so I could not confirm a European chain for a SaaS rollout across my tenants. The documented escape hatch is self-hosting on every plan, including an on-premises professional edition with "data stored entirely within your infrastructure", which would put identities, logs and configuration on servers I control in Hamburg — though the commercial platform may not be air-gapped without permission. 7 9 10 11
The Operations Manager
Netmaker, Inc. contracts under New York law with exclusive venue in New York County, and we found no public information on where the cloud control plane, identities and logs are stored, on a subprocessor list beyond Stripe for payments, or on a data processing agreement; the privacy policy covers website activity only. The workable European path is self-hosting — a free self-hosted edition and an on-premises edition stated to keep data entirely within our infrastructure, plus a choice of data residency on Enterprise — though the commercial licence bars air-gapping without permission so usage data still flows for billing. 7 9 10 11
The Information Security Officer
The contracting entity is Netmaker, Inc. under New York governing law with exclusive venue in New York County, Stripe is named for payment processing, and we found no public information on where the cloud control plane, identities and logs are hosted, on a data processing agreement, on security certifications, or on a subprocessor list. The mitigations I can verify are an on-premises edition described as storing data entirely within our infrastructure, available on every plan, and an Enterprise-tier choice of data residency whose options are not itemised; the commercial licence also bars air-gapping our instance without permission. 7 9 10 11
The Skeptic
The contracting entity is Netmaker, Inc. under New York law with exclusive New York venue, subprocessors are unnamed beyond Stripe for payments, and the privacy policy covers the website's online activities only, not the service. A genuine self-hosted path exists — an on-premises edition documented as keeping data entirely on customer infrastructure — but the terms bar air-gapping the commercial instance without permission so usage reporting can continue, and the Enterprise tier offers a choice of data residency without naming any location. We found no public information on a data processing agreement. 7 9 10 11 21
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Tiers are public — a free self-hosted tier, Team at $ 2 / active connection / month and Business at $ 4 / active connection / month, a 7-day trial, and an estimator example showing a platform fee of $10 and a first network at $0 — but Enterprise (SCIM, SIEM, data residency) is contact-us only, and minimum seats, minimum term and VAT treatment are not stated. The captured pages give different figures for the per-connection rate, and billing per daily active connection makes a fixed annual budget harder to defend in the next round. 9 10 16
The DevOps Engineer
Team and Business are public at $2 and $4 per active connection per month, billing per daily active connection, with a cost estimator, a free self-hosted tier and a 7-day trial, and the tier walls are explicit. Enterprise is contact-us, the on-prem licence is unpriced, and VAT, minimum term and monthly-versus-annual billing are not stated. The captured pages give different figures for the per-connection rate — the estimator adds a platform fee and a different per-connection price than the headline tiers — so I cannot compute a final invoice from the pages alone. 9 10 16
The MSP Technician
Quoting is genuinely possible for the middle tiers: "STARTING $ 2 / active connection / month" on Team and "STARTING $ 4 / active connection / month" on Business, with a worked estimator showing a platform fee of $10 and "Total: $13 / month" for one network and one connection, billed per daily active connection. Feature gating is public — SSO on Team, audit logging, posture checks and traffic logs on Business, SCIM, SIEM, just-in-time access and data residency on Enterprise — but Enterprise is "Custom Contact us", so the features a regulated client would need are unpriced. We found no public information on VAT treatment, minimum seats or minimum term, and traffic logs must be activated by the Netmaker team if not in the plan. 9 10 16
The Operations Manager
Team starts at $ 2 / active connection / month and Business at $ 4, with a free self-hosted tier, a seven-day free trial and a public estimator showing a $10 platform fee, $0 for one network, $3 for one connection and a $13 monthly total; Enterprise is custom pricing on contact. We found no public information on VAT treatment, minimum seats, minimum term or monthly-versus-annual billing, and the captured pages give different per-connection figures, with $2 and $4 tier starting prices against a $3.00 rate in the estimator example. 9 10
The Information Security Officer
Team and Business tiers are published at a starting price of $2 and $4 per active connection per month on a per-daily-active-connection model, with a platform fee, network fee and a worked estimator example, plus a free self-hosted tier and a seven-day trial. The annual cost still cannot be fully computed from public pages: Enterprise is custom on request, features such as traffic logs sit behind a higher tier and require team activation, and we found no public information on VAT treatment, minimum seats or minimum term. 9 10 16
The Skeptic
Tier cards show STARTING $ 2 / active connection / month for Team and $ 4 / active connection / month for Business, with a worked example showing a $10 platform fee and a $13 / month total, a 7-day trial, a free self-hosted tier, clear per-tier feature gating, and billing terms like the 1.5% monthly finance charge stated. The captured pages give different figures for the per-connection price — the tier cards say starting $2 while the example computes at $3.00 per active connection — and Enterprise is custom quote; we found no public information on VAT treatment, minimum seats, minimum term length, or monthly versus annual billing. 9 10 16
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Netmaker
Is Netmaker European?
No. whats-best.ai classifies Netmaker as Rest of world.
Where does Netmaker store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Netmaker have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Netmaker?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Netmaker alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 23 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.netmaker.io Checked 5 Nov 2026 Details →
- 2 Features page www.netmaker.io Checked 5 Nov 2026 Details →
- 3 Features page (remote access gateway) www.netmaker.io Checked 5 Nov 2026 Details →
- 4 Features page (mesh VPN) www.netmaker.io Checked 5 Nov 2026 Details →
- 5 Features page (access control lists) www.netmaker.io Checked 5 Nov 2026 Details →
- 6 Features page (user management) www.netmaker.io Checked 5 Nov 2026 Details →
- 7 Documentation docs.netmaker.io Checked 5 Nov 2026 Details →
- 8 API documentation docs.netmaker.io Checked 5 Nov 2026 Details →
- 9 Pricing page www.netmaker.io Checked 5 Nov 2026 Details →
- 10 Terms of service www.netmaker.io Checked 5 Nov 2026 Details →
- 11 Privacy policy www.netmaker.io Checked 5 Nov 2026 Details →
- 12 Access model & connectivity — found from sitemap docs.netmaker.io Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap docs.netmaker.io Checked 5 Nov 2026 Details →
- 14 Identity, access policy & device posture — found from sitemap learn.netmaker.io Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap learn.netmaker.io Checked 5 Nov 2026 Details →
- 16 Logs, audit trail & incident response — found from sitemap learn.netmaker.io Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap learn.netmaker.io Checked 5 Nov 2026 Details →
- 18 Deployment, API & administration — found from sitemap learn.netmaker.io Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap docs.netmaker.io Checked 5 Nov 2026 Details →
- 20 Architecture, reliability & security assurance — found from sitemap www.netmaker.io Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap docs.netmaker.io Checked 5 Nov 2026 Details →