Business VPN & Zero Trust Access
Twingate
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Twingate Inc. · www.twingate.com
Compare with GoodAccess → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Twingate at a glance
- Vendor
- Twingate Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Twingate 3/5, the mean of 6 judges. Twingate, a zero trust access service, is scored strongest on identity and policy at 8: authentication is always delegated to the customer's identity provider, disconnecting that provider removes all synced users and groups, posture checks read from CrowdStrike, SentinelOne, Intune and Jamf, and re-authentication windows run from one hour to 31 days. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Twingate, a zero trust access service, is scored strongest on identity and policy at 8: authentication is always delegated to the customer's identity provider, disconnecting that provider removes all synced users and groups, posture checks read from CrowdStrike, SentinelOne, Intune and Jamf, and re-authentication windows run from one hour to 31 days. Access and connectivity and deployment and administration hold at 7, while visibility and audit and architecture and assurance range 6 to 7 — the low scores reflect that real-time connection logging must be enabled on connectors and that the security whitepaper sits behind a lead-capture form. The lows are consistent: sovereignty at 3 to 4 and pricing transparency at 3 to 4. The contracting entity is Twingate Inc., a Delaware corporation under California law, the privacy policy acknowledges transfers of EEA, UK and Swiss personal data outside those regions, and although tier ceilings of 100 and 500 users are public, we found no public per-user price, so an annual cost cannot be computed from what is published.
Speaks for it
- Access is defined per resource rather than per network, with connectors deployed behind your firewall and no inbound ports required
- Disconnecting the identity provider removes all synced users and groups
- Device posture checks draw on CrowdStrike, SentinelOne, Intune, Jamf and others before a connection is allowed
- A GraphQL admin API with three token permission levels, IP restrictions per token, and Terraform and Pulumi providers makes the network scriptable
- Audit logs ship with a documented JSON schema and can sync to an S3 bucket every five minutes or stream onward to Splunk, Datadog and syslog destinations
Held against it
- We found no public per-user price for any tier, with unit pricing stated to sit on the order form
- We found no public information on where the control plane, connection logs or account data are hosted
- The security whitepaper sits behind a lead-capture form and the SOC 2 report is listed in a trust portal rather than published
- We found no public information on log retention periods per plan, alerts on unusual access, or a live session view that can end sessions
- We found no public information on named relay regions, always-on client behaviour, or MDM-based client rollout
Best for
- You need least-privilege access defined per resource and tied to your identity provider, with synced users and groups removed when the provider is disconnected
- Your team administers infrastructure as code and wants a GraphQL admin API backed by Terraform and Pulumi providers
- You run an MSP and want a multi-tenant portal with consolidated monthly billing and a 14-day free proof of concept per customer network
- You must send audit logs onward to an S3 bucket or a SIEM such as Splunk or Datadog, with a documented JSON schema
Avoid if
- You must compute an annual cost before contacting sales, since we found no public per-user price and Enterprise pricing is a custom MSA and SLA conversation
- Your procurement requires a non-US contracting entity or a named EEA hosting location, since Twingate Inc. is a Delaware corporation under California law, the privacy policy acknowledges transfers of EEA, UK and Swiss personal data outside those regions, and the sovereignty attributes list data residency and hosting options as unknown
- Your security review requires the SOC 2 report and whitepaper without form gates, since the SOC 2 sits in a trust portal and the whitepaper behind a lead-capture form
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 4 of 5 |
| Logs, audit trail & incident response | 3.5 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 3.5 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 1.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
The documentation shows access defined per resource rather than per network: a client for Windows, macOS, Linux, Chrome, iOS and Android reaches the ERP or file server through a Connector we run behind our own firewall with no inbound ports, peer-to-peer first with Relays as fallback, and DNS for protected resources resolved locally by the Connector. Connectors deploy as Docker containers, Helm charts, AWS ECS/AMI or Azure Container Instances, with automatic load balancing, failover and a recommended minimum of two per network. We found no public information on dedicated static IPs for the supplier portal, on always-on or auto-connect behaviour, or on named gateway regions, which is what keeps this below the top level for us. 1 2 3 12 13 20
The DevOps Engineer
Connectors deploy as Docker containers, a Helm chart, ECS Fargate, an AWS AMI or a systemd service behind the firewall, hold only outbound connections to relays, and no inbound ports are required — that reaches our Hetzner fleet and the AWS cluster exactly the way I want. Access is per resource by FQDN or IP with peer-to-peer preferred and relays as fallback, DNS for protected resources resolved locally through the connector, and clients for macOS, Windows, Linux, Chrome, iOS and Android. I found no public information naming relay or gateway regions, on always-on or auto-connect behaviour, or on per-gateway throughput, which holds it below the top of this range. 2 3 12 13 20 1
The MSP Technician
Per-resource access through connectors behind the firewall with no inbound ports, peer-to-peer first with relays as fallback, connectors for Docker, Kubernetes, AWS ECS and Azure, and clients for Windows, macOS, Linux, iOS, Android and Chrome covers most of what my thirty client networks need, and the encryption and protocol design is documented in detail. We found no public information on named relay regions or always-on and auto-connect behaviour, and an agentless option appears only as beta terms. 1 2 3 6 12 13 18 20
The Operations Manager
Clients exist for every platform my freelancers carry, access is per resource rather than the whole network, peer-to-peer is the default with relays as fallback, and connectors run behind the client firewall in Docker, Kubernetes or the three big clouds with no inbound ports — that is the hotel-lobby resilience I need. I found no public information on always-on auto-connect, named gateway or relay regions, or clientless browser access for contractors beyond an agentless beta terms page. 1 2 3 6 7 12 13 20
The Information Security Officer
This is access per resource, not per network: least-privilege access lists confine each user to named resources, connectors sit behind our firewall with no inbound ports, peer-to-peer is the default with relays as fallback, and private DNS resolves locally through the connector. Clients cover Windows, macOS, Linux, iOS, Android and Chrome and connectors ship as containers for AWS, Azure and Kubernetes, though we found no public information on relay locations, always-on behaviour or clientless access for contractors. 1 2 3 12 13 20
The Skeptic
Per-resource access through connectors behind the firewall with no inbound ports, peer-to-peer first with relays as backup, DNS resolved locally by the connector, and connector images for Docker, Kubernetes, ECS Fargate and Azure — that is genuine resource-level access, not one tunnel into the office network. What I could not find: named relay or gateway regions, always-on or auto-connect clients, or a clientless path beyond an Agentless Beta by name. Self-hosting stops at the connector; the Relays and Controller stay Twingate's. 2 3 11 12 13 7 18
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Authentication is delegated to our identity provider with users and groups synced from one or more directories, and when the provider is disconnected all synced users and groups are removed, so a leaver is cut off the same day. Device posture checks name Intune, Jamf, CrowdStrike and SentinelOne with properties such as disk encryption, firewall, antivirus and OS version, and resource-level policies combine authentication, device security and location with MFA, re-authentication windows from 1 hour to 31 days, and access requests handled through approval groups. Least-privilege ACLs are generated per user and security policies are manageable through Terraform, which suits a three-person team perfectly. 2 5 14 15 18
The DevOps Engineer
Authentication is always delegated to an identity authority, Google Workspace works on every plan with other providers on Business and Enterprise, and disconnecting a provider strips its users and groups — that is the leaver story I need. Policies combine authentication, device security and location requirements per resource, least-privilege ACLs are generated for both client and connector, device posture pulls from CrowdStrike, SentinelOne, Intune, Jamf and Kandji, and access requests with approval and usage-based locking are real API operations alongside a re-authentication window from one hour to thirty-one days. Everything in the policy model is reachable through the Terraform provider so my Git workflow holds; directory sync is described without the SCIM label, and I found no public information on continuous in-session re-evaluation of identity or device state. 2 5 14 15 18
The MSP Technician
Resource policies combine authentication, device security and location requirements, with posture checks from CrowdStrike, SentinelOne, Intune, Jamf, Kandji and others, native MFA applied per resource, access requests with approve and reject, authentication frequency from one hour to 31 days, and users and groups removed automatically when the identity provider is disconnected. Google Workspace works on all plans with further providers on Business and Enterprise; the captured pages do not name Entra ID or Okta explicitly, and we found no public information on continuous in-session evaluation or hardware-bound device identity. 2 5 14 15 18
The Operations Manager
This is exactly my brief: policies attach to individual resources with group overrides, least-privilege ACLs mean a freelancer reaches only the one project system, and disconnecting the identity provider removes the synced users — access that ends with the contract. Device posture reads from CrowdStrike, Jamf, Intune and similar tools, access requests carry approval, and re-authentication can be forced as often as hourly. 2 14 15 18
The Information Security Officer
Access follows identity and device state: resources carry policies combining authentication, device security and location requirements, posture checks read from CrowdStrike, SentinelOne, Intune and Jamf before a connection is allowed, access requests require approval, re-authentication can be forced as often as hourly, and disconnecting the identity provider removes all synced users — which answers my auditor's leaver question. 2 14 15 18
The Skeptic
Authentication is always delegated to the customer's identity provider, disconnecting the provider removes the synced users, re-authentication windows run from one hour to 31 days, native MFA can be required per resource, and posture checks pull from CrowdStrike, SentinelOne, Intune and Jamf — a policy model a security team can actually read, with time-limited access requests and approval groups on top. Continuous in-session evaluation and hardware-bound device identity are not described. 2 14 15 18 5
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Audit logs record create, edit, delete and connect events across access, devices, policies and users, exportable as JSON from the admin console or synced to an S3 bucket, with the JSON schema documented and a SIEM guide covering Splunk, Datadog, syslog and Vector fed from Connector journald logs every five minutes. The documentation also states that Relays store no data or network-identifiable information and terminate no data-carrying connections. We found no public information on how long logs are kept per plan, on a live session view with remote disconnect, or on alerts for unusual access. 2 4 16 17
The DevOps Engineer
Audit logs cover create, edit, delete and connect events across users, groups, devices, policies and resources, export as JSON from the admin console or sync to an S3 bucket, and the JSON schema is published in full. Streaming to Datadog, syslog and Vector — and through Vector to Splunk, Elasticsearch and others — plus real-time connection logs from the connectors gives me a workable SIEM path, and connector offline/online email alerts exist. I found no public information on retention periods per plan, on filtering logs by user, device and resource, or on alerts for unusual access, so this stays short of the top band. 4 12 16 17
The MSP Technician
Audit logs cover create, edit, delete and connect events across access, devices, policies and users, with a documented JSON schema, export from the admin console, sync to an AWS S3 bucket every five minutes and routes into Datadog, syslog and via Vector into Splunk and others — exactly what I need to show a client after an incident. We found no public information on how long logs are kept per plan or on alerts for unusual access, and real-time connection logging on connectors must be enabled. 4 7 12 16 17 18
The Operations Manager
Connect events land in an audit log with a documented JSON schema covering users, devices and resources, exports go to the admin console or an S3 bucket every few minutes, and there are documented paths to Datadog, syslog and Splunk via Vector. I found no public information on log retention per plan, alerts on unusual access, or a live session view where I could kill a connection. 4 16 17
The Information Security Officer
Connect events and every create, edit and delete across access, policies, devices and users are recorded with a published JSON schema, the actor field captures Twingate's own support staff, and logs stream to an S3 bucket every five minutes or onward to Splunk, Datadog or any syslog-collecting SIEM. We found no public information on log retention periods per plan or alerting on unusual access. 4 16 17
The Skeptic
Audit logs cover connect, create, edit and delete events with actors of User, API or Twingate Support, a documented JSON schema, manual export from the admin console, sync to S3 every five minutes, and onward streaming to Splunk, Datadog and others via Vector and syslog, with DNS filtering logs included. What I could not find: a stated retention period per plan, a live session view with the ability to end sessions, or alerting beyond connector up/down emails. 4 16 17 12 9
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
The GraphQL admin API covers remote networks, connectors, gateways, resources, groups, users, devices, device posture and security policies, with token permission levels and IP restrictions, and it is backed by a Terraform provider, a Pulumi provider and a Kubernetes operator — the configuration-as-code story a three-person team can actually maintain. A multi-tenant MSP portal manages several customer networks with consolidated monthly billing and a 14-day free proof of concept per network. We found no public information on deploying the client itself through Intune, on centrally managed client updates, or on a self-hosted edition. 5 6 12 18 19
The DevOps Engineer
A GraphQL admin API with full schema introspection, documented throttling limits and three token permission levels, backed by both a Terraform and a Pulumi provider with cloud deployment guides for GCP, AWS and Azure, is precisely the code-first administration I run. The MSP portal manages multiple customer networks per account with consolidated monthly billing, a 14-day proof of concept per network and per-network admin assignment. I found no public information on MDM deployment packages for the clients, granular admin roles, a self-hosted edition, or webhook and ticketing integrations, and support response times appear only as Enterprise add-ons with custom MSA and SLAs. 5 6 12 19 7
The MSP Technician
A GraphQL admin API with token permission levels and IP restrictions, Terraform and Pulumi providers, a Kubernetes operator, and above all a multi-tenant MSP portal where I create Customer Networks, assign admins and get consolidated monthly billing per client with a 14-day free proof of concept per network — that is the console I want. We found no public information on client deployment through MDM such as Intune or Jamf, on granular admin roles beyond network admin assignment, or on staged client and gateway update rollouts. 5 6 7 12 18 19
The Operations Manager
The whole network is scriptable — a GraphQL API covering resources, policies and devices, Terraform and Pulumi providers, and a multi-tenant MSP portal with a 14-day proof-of-concept period per customer network, which is how my hourly external provider would run it. I found no public information on MDM client rollout, admin role granularity, or support response times per plan. 5 6 18 19
The Information Security Officer
A GraphQL admin API covers networks, connectors, resources, policies, device posture and service accounts with token permission levels and IP restrictions, Terraform and Pulumi keep configuration as code, and service providers get a multi-tenant portal with consolidated monthly billing. We found no public information on MDM-based client rollout or support response times per plan. 5 6 12 19
The Skeptic
A GraphQL admin API with introspection, three token permission levels, IP restrictions per token, Terraform and Pulumi providers, and a real multi-tenant MSP portal with consolidated monthly billing and a 14-day proof-of-concept period per customer network — a provider can run this without touching a GUI. Client rollout through MDM, granular admin roles, stated support response times per plan and any self-hosted edition are not described. 5 6 18 19 7 12
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The architecture is published in unusual detail: Clients and Connectors run on our side, Twingate hosts only the Relays and a clustered, redundant Controller that never touches the data flow, and traffic is end-to-end encrypted with certificate-pinned TLS and session keys that the Relays cannot decrypt. A SOC 2 report is available through the trust portal, a responsible disclosure policy is published, and the status page shows scheduled maintenance with expected impact windows. The security whitepaper sits behind a form-fill, and we found no public information on open-source components, a bug bounty, incident post-mortems, or what happens to live connections if the control plane goes down. 2 10 11 20 21
The DevOps Engineer
The published architecture is unusually candid: the controller never touches the data flow, relays are TURN-equivalent and cannot decrypt traffic because session keys exist only between client and connector, and connectors identify themselves to clients only by an anonymized hash. Encryption specifics — certificate pinning, self-signed connector certificates, SHA-256 heartbeats, signed JWT connection tokens — sit on public documentation pages, the controller is described as redundant and clustered, and a SOC 2 report, a responsible disclosure policy and a public status page with scheduled-maintenance notices exist. I found no public information on open-source components, on whether existing connections survive a control-plane outage, or on published incident post-mortems, and the security whitepaper sits behind a lead-capture form. 2 10 11 20 21
The MSP Technician
The architecture is published down to which component sees what: client and connector on the customer side, relays and controller with Twingate, the controller never touching data flow, and an encryption design where relays cannot decrypt traffic, backed by certificate-pinned TLS tunnels and session keys, with the controller described as fully redundant and clustered. A SOC 2 report, trust center, responsible disclosure policy and status page exist; the security whitepaper sits behind a form, and we found no public information on a bug bounty, open-source components, or whether existing connections survive a control-plane outage. 1 2 10 11 20 21
The Operations Manager
The architecture is published in unusual detail — customer-hosted client and connector, Twingate-hosted relays and a redundant, clustered controller, plus an encryption walkthrough showing relays cannot decrypt traffic — alongside a SOC 2 report in a trust portal, a responsible disclosure policy and a public status page. The security whitepaper sits behind a form, and I found no public information on open-source components, a bug bounty, or what happens to live connections if the control plane goes down. 2 10 11 20 21
The Information Security Officer
The architecture pages state what each component sees — the Controller never touches data flow, relays cannot decrypt, and session keys are negotiated between client and connector — backed by a SOC 2 report in the Trust Portal, a responsible disclosure policy and a public status page with maintenance notices. The security whitepaper sits behind a lead-capture form, and we found no public information on a bug bounty, open-source components, or what happens to existing connections when the control plane is down. 2 10 11 20 21
The Skeptic
The architecture is published and readable: who hosts what, relays that cannot decrypt, session keys exchanged against the connector's self-signed certificate, and a controller described as redundant and clustered, plus a responsible disclosure policy and a status page with maintenance notices. But the security whitepaper sits behind a lead-capture form, the SOC 2 report is listed in a trust portal rather than published, and nothing says what happens to existing connections when the vendor's own controller goes down — the first question I ask. 2 20 11 10 21 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting entity is Twingate Inc., a Delaware corporation in Redwood City, under California law with San Mateo County venue, and the privacy policy confirms that personal data from the EEA, UK or Switzerland may be transferred and processed outside those regions. What we can verify on the European side is a published Data Processing Addendum, a published subprocessor list, and a data protection representative in Cork for the EU, Switzerland and the UK. We found no public information on where the control plane, user identities or connection logs are actually hosted. 8 9 10 20
The DevOps Engineer
The contracting entity is Twingate Inc., a Delaware corporation in Redwood City under California law with exclusive venue in San Mateo County, and the privacy policy states that personal data from the EEA, UK and Switzerland may be transferred and processed outside those regions. A data processing addendum and a subprocessor list are published, a data protection representative (DataRep) is named for the EU, Switzerland and the UK, and a SOC 2 report is available through the trust portal. I found no public information on where the control plane, connection logs or account data are hosted, or on any EU hosting option, which caps this well below the top of the range. 8 9 10
The MSP Technician
Twingate Inc. is a Delaware corporation under California governing law, and personal data from the EEA, UK and Switzerland may be transferred and processed outside those areas under stated safeguards, with a data processing addendum, a published subprocessor list and a data protection representative in Cork, Zurich and London. We found no public information on where the control plane, logs or identities are hosted, and no European hosting option or self-hosted edition is described, so the chain runs through a US vendor. 8 9 10
The Operations Manager
The contracting entity is Twingate Inc. of Redwood City under California law, transfers outside the EEA are acknowledged with general safeguards, and there is a DataRep representative in Cork plus a published data processing addendum and subprocessor list. I found no public information on where the control plane, logs or identities are hosted, so I cannot verify a European chain. 8 9 10
The Information Security Officer
Twingate Inc. is a Delaware corporation under California law, and the privacy policy states that personal data from the EEA, UK and Switzerland may be transferred and processed outside those regions under safeguards it does not name. A data processing addendum, a published subprocessor list and a data protection representative in Cork exist, but we found no public information on where account data, identities or connection logs are stored, and the control plane is Twingate-hosted only. 8 9 10
The Skeptic
The contracting entity is Twingate Inc., a Delaware corporation under California law, and the relays and controller are hosted by Twingate in unstated locations; a data processing addendum and a subprocessor list exist, an EU data protection representative is appointed in Ireland, Switzerland and the UK, and transfers outside the EEA are acknowledged. No EU hosting of logs or account data is offered anywhere I read, and Google Analytics runs on the service with an opt-out. 8 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The pricing page names the tiers — up to 100 users with SSO via Google Workspace, up to 500 users with provisioning and management via an identity provider, and Enterprise with custom MSA and SLAs — plus a free trial and credit-card payment, while custom DNS filtering appears only as an unpriced add-on. We found no public information on a per-user price; the customer agreement states that monetary amounts sit on the order form in USD, with invoices due within 30 days, prorated per-user overage billing, and non-refundable fees. For budgeting a 140-person firm we cannot derive an annual cost from what is published. 1 7 8 19
The DevOps Engineer
The pricing page names tiers with user ceilings — Teams up to 100 users, Business up to 500 — plus credit-card payment, DNS filtering and additional support as add-ons, and the MSP portal consolidates monthly billing per customer network. The captured pages give no price per user for any tier, Enterprise pricing is a custom MSA conversation, the add-ons are unpriced, and the terms only state that amounts are denominated in USD, invoices are due within 30 days, overage users are billed prorated, and fees are non-refundable. A buyer cannot compute an annual cost from what is published here. 1 7 8 19
The MSP Technician
Tiers are public with their shape — Teams up to 100 users, Business up to 500 users with identity-provider provisioning, DNS filtering as an add-on — and the MSP portal offers consolidated monthly billing with a 14-day free proof of concept per customer network. The captured pages carry no per-user price figure at all, with unit pricing said to live in the order form, so I cannot quote a client thirty Business users without contacting the vendor first. 1 7 8 19
The Operations Manager
The tier structure is public — a free trial, Teams to 100 users with Google SSO, Business to 500 users with identity-provider provisioning, a marked DNS-filtering add-on and consolidated MSP billing with net-30 invoicing — but I found no public information on the per-user price of any tier, so I cannot compute what a fifty-person year costs. 1 7 8 19
The Information Security Officer
The pricing page names tiers with user caps of 100 and 500 and some inclusions, a free trial exists, the MSP portal offers a 14-day proof of concept per customer network, and contract terms state USD invoicing due within 30 days with prorated overage billing. We found no public information on a price per user, prices for the add-ons beyond their existence, minimum seat counts, or VAT treatment. 7 8 19
The Skeptic
Tier names, user ceilings of 100 and 500, a free trial, credit-card payment, USD invoicing at net 30 days and add-ons for DNS filtering and support are public — but we found no public price per user or per plan, and Enterprise is a custom contract with negotiated SLAs. A buyer cannot compute the annual cost from what is published. 7 8 19 1
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Twingate
Is Twingate European?
No. whats-best.ai classifies Twingate as Rest of world.
Where does Twingate store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Twingate have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Twingate?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Twingate alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 40 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.twingate.com Checked 5 Nov 2026 Details →
- 2 Documentation (how it works) www.twingate.com Checked 5 Nov 2026 Details →
- 3 Documentation (architecture) www.twingate.com Checked 5 Nov 2026 Details →
- 4 Documentation (audit logs) www.twingate.com Checked 5 Nov 2026 Details →
- 5 API documentation www.twingate.com Checked 5 Nov 2026 Details →
- 6 Documentation (Terraform) www.twingate.com Checked 5 Nov 2026 Details →
- 7 Pricing page www.twingate.com Checked 5 Nov 2026 Details →
- 8 Terms of service (customer agreement) www.twingate.com Checked 5 Nov 2026 Details →
- 9 Privacy policy www.twingate.com Checked 5 Nov 2026 Details →
- 10 Legal center www.twingate.com Checked 5 Nov 2026 Details →
- 11 Security whitepaper www.twingate.com Checked 5 Nov 2026 Details →
- 12 Access model & connectivity — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 14 Identity, access policy & device posture — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 16 Logs, audit trail & incident response — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 18 Deployment, API & administration — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 20 Architecture, reliability & security assurance — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap www.twingate.com Checked 5 Nov 2026 Details →