# Tailscale — Business VPN & Zero Trust Access

Tailscale by Tailscale US Inc. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Tailscale US Inc. (https://tailscale.com)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/tailscale
- Alternatives: https://whats-best.ai/software/business-vpn/tailscale/alternatives ([markdown](https://whats-best.ai/software/business-vpn/tailscale/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Tailscale US Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S8]

## The panel's verdict

Tailscale, a WireGuard mesh VPN with identity-based access control, scored highest on identity and policy at 8 across the bench, built on default-deny grants, MFA inherited from your own identity provider and SCIM group sync. Access and connectivity, visibility and audit, and deployment and administration cluster at 7-8 — subnet routers, an API on every plan and tamper-detectable double logging, set against a fixed 90-day configuration-log cap. Architecture and assurance scores 7 across the bench on published cryptography detail and SOC 2 Type II, held down by audits available only on request and no public information on a status page or availability SLA. Sovereignty is weakest at 3-5: a US contracting chain — Tailscale US Inc., a Delaware corporation, with processing stated in Canada, Germany, the United States and the United Kingdom — against safeguards including a published DPA and standard contractual clauses, and no public information on EU hosting. Pricing transparency scores 5-7: Personal $0, Standard $8 per user per month and Premium $18 per user per month are public; Enterprise and extra ephemeral minutes are contact sales.

**Speaks for it:**
- Identity and policy scored 8 across the bench, with sign-in via your own SAML or OIDC provider and MFA inherited from it.
- Default-deny grants expose named resources rather than whole networks, with SCIM group sync removing access with the directory.
- Configuration audit logs run on all plans, and connections logged on both source and destination make tampering detectable.
- Private keys never leave nodes, the coordination server exchanges only public keys, and node and relay code is open source.
- Pricing is published per tier: Personal $0, Standard $8 per user per month, Premium $18 per user per month, with 50 tagged resources included.

**Held against it:**
- Sovereignty scored 3-5: contracting with Tailscale US Inc., a Delaware corporation, and processing stated in Canada, Germany, the United States and the United Kingdom.
- Configuration audit log retention is fixed at 90 days and cannot be configured.
- Latacora audits are available only on request, the vendor states it runs no bounty program, and we found no public information on a status page or availability SLA.
- Enterprise, extra ephemeral minutes and multiple tailnets are contact sales, so a larger deployment's annual cost is not computable from public pages.
- We found no public information on always-on auto-connect, clientless browser access for contractors, or named relay regions.

**Best for:**
- You want per-resource access — default-deny grants tied to an identity provider you already run, with MFA and SCIM group sync inherited.
- Your team deploys clients via MDM such as Intune or Jamf and wants a REST API available on every plan.
- You connect multi-cloud and on-premises networks with subnet routers and want just-in-time access gated by device posture from EDR and MDM tools.
- You manage servers or CI/CD runners and want SSH authorized by tailnet identity instead of shared keys.

**Avoid if:**
- Your compliance regime requires processing to stay within the EU — processing is stated in Canada, Germany, the United States and the United Kingdom.
- You need configuration audit logs kept longer than 90 days — retention is fixed at 90 days and cannot be configured.
- You require FIPS-validated cryptography — the vendor states its cryptographic implementations are not FIPS compliant.
- You must compute the full annual cost before committing — Enterprise, extra ephemeral minutes and multiple tailnets are contact sales.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 4/5 | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 |
| Identity, access policy & device posture | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Logs, audit trail & incident response | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Deployment, API & administration | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Architecture, reliability & security assurance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 1.5/5 | 1.5/5 | 2.5/5 |
| Pricing transparency | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 2.5/5 |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AI training prohibition: Customer consent for Customer's benefit · no [S9]
- California no direct marketing sharing: yes [S10]
- Children age: 16 · yes [S10]
- Covered laws: GDPR · UK Data Protection Act 2018 · Swiss FADP · CCPA · similar US state privacy laws · PIPEDA [S11]
- Crypto review: yes [S22]
- Data processor role: data processor / service provider under DPA [S10]
- Data subject requests: customer · yes [S11]
- Dnt not honored: no [S10]
- DPA available: Data Processing Addendum · yes · 2026-08-25 [S11]
- DPA conflict precedence: yes [S11]
- DPA incorporated: business use · yes [S9]
- DPA incorporated into agreement: Terms of Service or Main Service Agreement [S11]
- DPA scc: standard contractual clauses via Data Processing Addendum · yes [S10]
- DPA update process: next payment period (self-serve) · order form renewal · new order form [S11]
- Fips docs reference: FedRAMP and FIPS-140 considerations doc referenced [S22]
- Fips status: no [S22]
- GDPR representative: EU GDPR Representative under Article 27 · European Data Protection Office (EDPO) [S10]
- Gpc honored: yes [S10]
- Latacora audits: Latacora · yes [S12]
- Marketing opt out: contact request · email unsubscribe link · yes [S10]
- No HIPAA baa: no [S11]
- No sell or share: yes · yes [S11]
- No sensitive data required: no [S11]
- Public authority transparency report: privacy@tailscale.com · yes · yes [S11]
- Sanctions export controls: yes [S9]
- Security bulletins: yes [S12]
- Security page reference: https://tailscale.com/security/ [S10]
- Security policies public: GitHub · yes [S12]
- SOC 2: security · availability · confidentiality · yes [S12]
- SOC 2 report: customers, website or on request, subject to confidentiality · yes [S11]
- Subprocessor change notice days: 10 · 10 [S11]
- Subprocessor liability: yes [S11]
- Swiss transfers:  [S11]
- Termination refund on instruction violation: yes [S11]
- UK GDPR representative: UK GDPR representative under Article 27 · EDPO UK Ltd [S10]
- UK sccs: B · yes [S11]

**Data**
- Access review: quarterly [S12]
- Audit logs double logging: source · destination · double logging [S21]
- Audit logs streaming: Audit logs streamed in real time from each node to central logging service; connections logged on both source and destination [S21]
- Backup: 1 · 1 [S12]
- Customer configurable retention: Aperture and PAM logs, events, recordings · yes [S10]
- Deletion on termination: no · yes [S9]
- Encryption: yes · yes [S12]
- Law enforcement warrant content: search warrant with probable cause [S10]
- Log retention controllable: mesh metadata only · yes [S21]
- Logs export streaming: Logging service streams data out to other systems for analysis [S21]
- Notification law enforcement: prohibited by law · emergency · counterproductive · yes [S10]
- Overage billing: next billing cycle · yes [S8]
- Retention: no longer than necessary for processing purposes [S10]
- Retention: yes [S12]
- Retention procedures available: yes · yes [S11]
- Return destruction days: 30 · yes [S11]
- Tagged resources no autoscale: no [S8]
- Traffic not hosted: no · yes [S9]

**Hosting**
- Aws marketplace: yes [S8]
- Azure marketplace: yes [S8]
- Processing locations: Canada · Germany · United States · United Kingdom [S10]
- Production access controls: yes · yes · yes [S12]

**Integrations**
- API policy file: yes [S16]
- Audit logs API: /api/v2/tailnet/{tailnetId}/logging/configuration · yes · logs:configuration:read [S17]
- Audit logs API pagination: no [S17]
- Count: 100 [S1]
- Jamf bundle ids: io.tailscale.ipn.macsys · io.tailscale.ipn.macos [S19]
- Jamf client variants: Mac App Store · Standalone [S19]
- Jamf deployment scope: Jamf configuration profile deployment scope can target All Computers [S19]
- Jamf policy application requirement: yes [S19]
- Jamf policy platforms: macOS · iOS [S19]
- Jamf pro deployment: yes · deploy Tailscale via Jamf Pro MDM [S19]
- Jamf schema source: ProfileManifestsMirror project on GitHub [S19]
- Jamf self service distribution: Tailscale distributed via Jamf becomes available in the Self Service app across the fleet [S19]
- Jamf validation date: 2026-01-05 [S19]
- Other types: Private endpoints · Vector [S18]
- SCIM group sync: yes [S16]
- Siem systems: Axiom · Cribl · Datadog · Elasticsearch Logstash (data stream) · Panther · Splunk (HTTP Event Collector) [S18]
- Splunk hec compatible: yes [S18]
- Terraform: Terraform support [S4]
- Third party export: identity providers · cloud storage providers · security and monitoring tools · yes [S10]
- Vector pipeline: Vector usable as pipeline via Splunk HEC source [S18]
- Webhooks: yes [S2]
- Webhooks: webhooks [S4]

**Legal**
- Applicability: Order Form customers · self-serve customers · free customers [S9]
- Contracting entity by schedule: contracting entity identified in Schedule A of the Terms [S9]
- Copyright entity: 2026 · Tailscale Inc. [S10]
- Copyright entity: Tailscale Inc. [S8]
- Copyright entity: Tailscale Inc. [S3]
- DPA: yes · yes [S12]
- Effective date: August 25, 2026 [S10]
- Entity: Tailscale Inc. [S1]
- Quebec exception: Province of Quebec and Canada [S9]
- Statute of limitations: 1 [S9]
- Termination for cause refund: pro rata [S9]
- Terms last updated: 2026-08-25 [S9]
- Venue business customers: New York County, New York, USA · yes [S9]

**Pricing**
- Billing periods: monthly · annually · yes [S9]
- Device posture attributes by plan: Premium · Enterprise · All plans · Standard · Premium · Enterprise · Standard · Premium · Enterprise [S15]
- Enterprise: Enterprise · yes [S3]
- Invoice currency: USD · 30 [S9]
- Jamf integration plans: Standard · Premium · Enterprise [S19]
- Late interest rate: 1.5 [S9]
- Marketplace purchases: yes · yes [S9]
- Nonprofit discount: entity documentation · yes [S8]
- Payment method: yes [S9]
- Personal: yes · Personal · 0 [S3]
- Personal price: free forever · 0 [S8]
- Plan availability: Premium · Enterprise [S18]
- Plan changes prorated: yes [S9]
- Premium: Premium · 18 [S3]
- Premium price: 18 [S8]
- Refund policy: yes [S9]
- Standard: Standard · 8 [S3]
- Standard price: 8 [S8]
- Tagged resource addon: 1 [S8]
- Taxes excluded: no [S9]

**Product**
- Accept routes flag: --accept-routes · yes [S13]
- Access control methods: grants · ACLs [S5]
- Acl central policy distributed enforcement: distributed, at each node · central on coordination server [S21]
- Acl migration recommendation: yes [S5]
- Acl permission management: yes · yes · yes [S11]
- Acl tests: yes [S2]
- Acls: yes [S2]
- Acls: yes · yes [S12]
- Adaptive policy engine: Per-runner and per-repo access control with Grants and adaptive policy engine [S3]
- Advertise routes flag: --advertise-routes=<CIDR> · yes [S13]
- Aead ciphers: AES-128-GCM · ChaCha20-Poly1305 · dynamic based on AES hardware acceleration [S22]
- Aperture: AI governance, LLM session recordings including local and MCP tool calls [S8]
- Aperture llm provider disclosure: yes [S10]
- Aperture standalone: yes [S8]
- API auth token case sensitive: yes [S7]
- API key expiry days: 90 · 1 [S7]
- API plan availability: yes [S7]
- API token revocable: yes [S7]
- API token roles required: Owner · Admin · IT admin · Network admin [S7]
- API token source: access token · Keys page of the admin console [S7]
- API trust credentials: trust credentials provide delegated fine-grained control [S7]
- App connectivity: Connects Kubernetes clusters, SaaS apps, and third-party apps [S3]
- App connector: app connectors [S4]
- Application networking: Application networking via 65+ integrations [S2]
- Audit log access: admin console Logs page · yes [S6]
- Audit log event grouping: eventGroupID [S17]
- Audit log events scope: write actions from admin console and API [S17]
- Audit log node key dedup: yes [S17]
- Audit log revert: Owner · Admin · IT admin · yes [S17]
- Audit log service events: yes [S17]
- Audit log shared nodes: yes [S17]
- Audit log targets: Tailnet · Billing · User · Group · Node · Admin console · login.tailscale.com · Invite · Share · API · API key · OAuth client · OIDC federated identity · OAuth access token [S17]
- Audit logging: configuration audit logging [S4]
- Audit logging availability: all plans [S17]
- Audit logging can disable: no [S17]
- Audit logging content: action · actor · target · time [S17]
- Audit logging delay: seconds · no [S17]
- Audit logging export: yes [S17]
- Audit logging failed logins: no [S17]
- Audit logging limitations: write actions only · no [S17]
- Audit logging no data plane: no · yes [S17]
- Audit logging policy diff: yes [S17]
- Audit logging retention: 90 · yes [S17]
- Audit logging siem streaming: yes [S17]
- Audit logging storage configurable: no · 90 [S17]
- Audit logging support initiated: no [S17]
- Audit logs default and retention: 90 · yes [S6]
- Audit logs siem streaming: yes [S6]
- Auth keys:  [S2]
- Auth keys: auth keys [S4]
- Auto update methods: admin_console · client_settings · system_policies_mdm · yes [S20]
- Ci grants: Grants for CI workflows [S3]
- Cicd extension: CI/CD connectivity, ephemeral access [S8]
- Cli update command: tailscale update · Linux · Windows · macOS [S20]
- Client logging opt out: --no-logs-no-support · TS_NO_LOGS_NO_SUPPORT · yes · yes [S6]
- Client not required on devices: no [S13]
- Cloud route table option: yes [S13]
- Configuration audit logging: yes [S2]
- Configuration audit logs: action type · actor · target resource · time · yes [S6]
- Configuration log streaming: export audit and administrative activity to external platforms [S18]
- Continuous verification: yes [S3]

**Support**
- Audit logs admin console: all admin console users · time · action · actor · Logs page [S17]
- Channels: Support · Sales · Partnerships · Security · Changelog [S1]
- Gold: 24/7 [S8]
- Jamf help channel: support · sales [S19]
- Opt out email channel: privacy@tailscale.com [S10]
- Platinum: 24/7 [S8]
- Privacy contact: privacy@tailscale.com [S10]
- Security contact: security@tailscale.com [S12]
- Standard: best-effort business hours · yes [S8]

222 more facts on the canonical page: https://whats-best.ai/software/business-vpn/tailscale

## Questions

### Is Tailscale European?

No. whats-best.ai classifies Tailscale as Rest of world.

### Where does Tailscale store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Tailscale have a free plan?

Yes. Tailscale has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19220).

### What are the best alternatives to Tailscale?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Cloudflare Zero Trust (3.5/5)](https://whats-best.ai/software/business-vpn/cloudflare-zero-trust) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Tailscale alternatives](https://whats-best.ai/software/business-vpn/tailscale/alternatives).

## Head-to-head

- [Tailscale vs NordLayer](https://whats-best.ai/compare/nordlayer-vs-tailscale.md)
- [Tailscale vs NetBird](https://whats-best.ai/compare/netbird-vs-tailscale.md)

## What this page leaves out

- 16 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://tailscale.com/ (checked 2026-11-05)
- [S2] Features page: https://tailscale.com/features (checked 2026-11-05)
- [S3] Features page (zero trust networking): https://tailscale.com/use-cases/zero-trust-networking (checked 2026-11-05)
- [S4] Documentation: https://tailscale.com/docs (checked 2026-11-05)
- [S5] Documentation (access control): https://tailscale.com/docs/features/access-control (checked 2026-11-05)
- [S6] Documentation (logging): https://tailscale.com/docs/features/logging (checked 2026-11-05)
- [S7] API documentation: https://tailscale.com/docs/reference/tailscale-api (checked 2026-11-05)
- [S8] Pricing page: https://tailscale.com/pricing (checked 2026-11-05)
- [S9] Terms of service (names the contracting entity): https://tailscale.com/terms (checked 2026-11-05)
- [S10] Privacy policy: https://tailscale.com/privacy-policy (checked 2026-11-05)
- [S11] Data processing agreement (dpa): https://tailscale.com/dpa (checked 2026-11-05)
- [S12] Security / trust page: https://tailscale.com/security (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://tailscale.com/docs/features/site-to-site (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://tailscale.com/docs/features/subnet-routers (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://tailscale.com/docs/features/device-posture (checked 2026-11-05)
- [S16] Identity, access policy & device posture — found from sitemap: https://tailscale.com/docs/features/access-control/just-in-time-access (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://tailscale.com/docs/features/logging/audit-logging (checked 2026-11-05)
- [S18] Logs, audit trail & incident response — found from sitemap: https://tailscale.com/docs/features/logging/log-streaming (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://tailscale.com/docs/integrations/mdm/jamf (checked 2026-11-05)
- [S20] Deployment, API & administration — found from sitemap: https://tailscale.com/docs/install (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://tailscale.com/how-it-works (checked 2026-11-05)
- [S22] Architecture, reliability & security assurance — found from sitemap: https://tailscale.com/docs/concepts/tailscale-encryption (checked 2026-11-05)

---

Cite as: whats-best.ai, "Tailscale — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/tailscale

Corrections: https://whats-best.ai/correct/1597?target=page