# Twingate — Business VPN & Zero Trust Access

Twingate by Twingate Inc. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Twingate Inc. (https://www.twingate.com)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/twingate
- Alternatives: https://whats-best.ai/software/business-vpn/twingate/alternatives ([markdown](https://whats-best.ai/software/business-vpn/twingate/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Twingate Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Twingate, a zero trust access service, is scored strongest on identity and policy at 8: authentication is always delegated to the customer's identity provider, disconnecting that provider removes all synced users and groups, posture checks read from CrowdStrike, SentinelOne, Intune and Jamf, and re-authentication windows run from one hour to 31 days. Access and connectivity and deployment and administration hold at 7, while visibility and audit and architecture and assurance range 6 to 7 — the low scores reflect that real-time connection logging must be enabled on connectors and that the security whitepaper sits behind a lead-capture form. The lows are consistent: sovereignty at 3 to 4 and pricing transparency at 3 to 4. The contracting entity is Twingate Inc., a Delaware corporation under California law, the privacy policy acknowledges transfers of EEA, UK and Swiss personal data outside those regions, and although tier ceilings of 100 and 500 users are public, we found no public per-user price, so an annual cost cannot be computed from what is published.

**Speaks for it:**
- Access is defined per resource rather than per network, with connectors deployed behind your firewall and no inbound ports required
- Disconnecting the identity provider removes all synced users and groups
- Device posture checks draw on CrowdStrike, SentinelOne, Intune, Jamf and others before a connection is allowed
- A GraphQL admin API with three token permission levels, IP restrictions per token, and Terraform and Pulumi providers makes the network scriptable
- Audit logs ship with a documented JSON schema and can sync to an S3 bucket every five minutes or stream onward to Splunk, Datadog and syslog destinations

**Held against it:**
- We found no public per-user price for any tier, with unit pricing stated to sit on the order form
- We found no public information on where the control plane, connection logs or account data are hosted
- The security whitepaper sits behind a lead-capture form and the SOC 2 report is listed in a trust portal rather than published
- We found no public information on log retention periods per plan, alerts on unusual access, or a live session view that can end sessions
- We found no public information on named relay regions, always-on client behaviour, or MDM-based client rollout

**Best for:**
- You need least-privilege access defined per resource and tied to your identity provider, with synced users and groups removed when the provider is disconnected
- Your team administers infrastructure as code and wants a GraphQL admin API backed by Terraform and Pulumi providers
- You run an MSP and want a multi-tenant portal with consolidated monthly billing and a 14-day free proof of concept per customer network
- You must send audit logs onward to an S3 bucket or a SIEM such as Splunk or Datadog, with a documented JSON schema

**Avoid if:**
- You must compute an annual cost before contacting sales, since we found no public per-user price and Enterprise pricing is a custom MSA and SLA conversation
- Your procurement requires a non-US contracting entity or a named EEA hosting location, since Twingate Inc. is a Delaware corporation under California law, the privacy policy acknowledges transfers of EEA, UK and Swiss personal data outside those regions, and the sovereignty attributes list data residency and hosting options as unknown
- Your security review requires the SOC 2 report and whitepaper without form gates, since the SOC 2 sits in a trust portal and the whitepaper behind a lead-capture form

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Identity, access policy & device posture | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Logs, audit trail & incident response | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Deployment, API & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Architecture, reliability & security assurance | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 |
| European sovereignty | 1.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 2/5 | 1.5/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3/5** | **3/5** | **3.5/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Analytics tool: yes · yes [S9]
- California rights: yes [S9]
- Data protection representative: European Union · Switzerland · United Kingdom · DataRep [S9]
- Processor role: data_processor_or_subprocessor · European individual personal data submitted by customers [S9]
- Rep contact: [email] · https://www.datarep.com/twingate · DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland · DataRep, Leutschenbachstrasse 95, Zurich, 8050, Switzerland · DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingd… [S9]
- Security measures: yes [S8]
- Security safeguards: yes [S9]
- SOC 2 report: yes [S10]
- Threat intelligence sharing: sanitized subset · yes [S9]
- Trust center: yes [S10]

**Data**
- Audit log export admin console: json · yes [S4]
- Audit log export aws s3: json · yes · aws_s3 [S4]
- Customer data ownership: yes [S8]
- International transfers: appropriate safeguards put in place · yes [S9]
- Location collection purpose: connect users to nearest and fastest server [S9]
- Retention: service provision or account lifetime · yes [S9]
- Rights request verification: yes · yes [S9]
- S3 log export: yes [S7]
- Siem sync: yes [S7]
- Subject rights: confirm processing · access/copy · correct · restrict · object · erasure · portability · withdraw consent · lodge complaint with DPA [S9]

**Integrations**
- Admin API graphql: Admin API · GraphQL [S5]
- API auth: X-API-KEY header from admin console [S18]
- API coverage: Remote Networks, Connectors, Gateways · Resources and access assignments · Groups, Users, Devices, device posture · Security Policies and DNS filtering profiles · Service Accounts and Service Keys · Access requests, SSH certificate authori… [S5]
- API endpoint: X-API-KEY · POST · https://<subdomain>.twingate.com/api/graphql/ [S5]
- API endpoint: https://<network name>.twingate.com/api/graphql/ [S18]
- API schema introspection: yes [S5]
- API throttling limits: 60 · 429 · 20 [S5]
- API token generation: Admin Console > Settings > API > Generate Token [S5]
- API token ip restrictions: 0.0.0.0/0, ::/0 · yes · CIDR range or single IP · 10 [S5]
- API token permission levels: Read only · Read & Write · Read, Write & Provision [S5]
- Aws s3 export: audit logs · network events · DNS filtering logs · 5 [S17]
- Datadog agent: yes [S17]
- Getting started guide: yes [S18]
- Graphql API: GraphQL · yes [S18]
- Iac providers: Terraform · Pulumi · API [S1]
- Kubernetes operator: yes [S7]
- Pulumi provider: Twingate also offers a Pulumi Provider [S6]
- S3 sync doc: yes [S16]
- Syslog forwarding: yes [S17]
- Terraform cloud guides: GCP · AWS · Azure [S6]
- Terraform provider: yes [S5]
- Vector support: yes [S17]

**Legal**
- Affiliate agreement: Affiliate Program Agreement · yes [S10]
- Agentless beta terms: Agentless Beta terms · yes [S10]
- Agreement version date: April 22, 2024 · Customer Agreement [S8]
- Aws marketplace contract: Standard Twingate Contract for AWS Marketplace · yes [S10]
- California privacy notice: California Supplemental Privacy Notice · yes [S10]
- Community privacy notice: Community Privacy Notice · yes [S10]
- Community terms: Community Terms · yes [S10]
- Contract precedence: Order Form · Service Addendum · Customer Agreement [S8]
- Copyright: 2026 · Twingate [S10]
- Customer agreement: Customer Agreement · yes [S10]
- DPA: Data Processing Addendum · yes [S10]
- Dsa information: EU Digital Services Act Information · yes [S10]
- Fair use policy: Fair Use Policy · all services [S10]
- Governing law: California [S8]
- Marketplace addendum: Marketplace Addendum · yes [S10]
- Notices address: 541 Jefferson Ave, Suite 100, Redwood City, CA 94063, USA [S8]
- Partner agreement: Partner Program Agreement · yes [S10]
- Policy updates: yes [S9]
- Privacy email: privacy@twingate.com [S9]
- Scheduled maintenance: Scheduled maintenance Nov 14, 06:00-07:30 UTC; routine database version upgrade; approximately 2-5 minutes of expected impact [S21]
- Service addenda: Service Addenda · yes [S10]
- Support services terms: Support Services terms · yes [S10]
- User tos: User Terms of Service · yes [S10]
- Venue: San Mateo County, California state courts; Northern District of California federal courts [S8]
- Website terms: Website Terms · yes [S10]

**Pricing**
- Business user limit: 500 [S7]
- Credit card: yes [S7]
- Currency default: USD [S8]
- Enterprise addons: yes [S7]
- Enterprise msa SLA: yes [S7]
- Free plan termination right: yes [S8]
- Free trials evaluation only: evaluation only · yes [S8]
- Invoice terms: 30 [S8]
- Late interest: 1 [S8]
- Liability cap: fees paid in preceding 12 months on applicable Order Form [S8]
- Liability cap free trials: 100 [S8]
- Msp billing: consolidated billing for MSP Portal customers · monthly [S19]
- Msp poc trial: 14 · yes · POC per Customer Network [S19]
- Non refundable: yes · yes [S8]
- Overage billing: yes [S8]
- Teams user limit: 100 [S7]

**Product**
- Access requests API: yes · accessRequestApprove · accessRequestReject · accessRequests query [S18]
- Acl intersection: Traffic allowed only if in intersection of Client ACL and Connector ACL [S2]
- Admin requirement on idp removal: yes [S14]
- Age restriction: 16 [S9]
- Always blocked countries: Cuba · Iran · North Korea · Syria · no [S15]
- API first: yes [S1]
- Audit log action types: create · edit · delete [S16]
- Audit log actor types: User · API · Twingate Support [S16]
- Audit log API key permissions: read only · read write · provision [S16]
- Audit log categories: Access, API Keys, Devices, Device Integrations, Device Security, Secure DNS, Network, Policies, Service Accounts, Users & Groups, Machine Keys, Data Exports, MFA Configurations [S4]
- Audit log event types: create, delete, edit, and connect events [S4]
- Audit log s3 sync: yes [S16]
- Audit log service account key states: active · expired · revoked · deleted [S16]
- Audit log targets: targets include Remote Network, Connector, Resource, API key, User, Group, Device, Service Account, Service Account Key [S16]
- Audit log timestamp utc ISO: UTC ISO date-time string [S16]
- Audit log use cases: troubleshooting or investigatory purposes [S4]
- Audit logs available: yes [S4]
- Audit logs json schema: yes [S16]
- Auditability: yes [S1]
- Auth frequency range: 31 · 1 [S15]
- Ca lets encrypt: Twingate obtains its signed certificate for twingate.com from Let's Encrypt [S20]
- Client local dns: DNS for protected Resources proxied and resolved locally via Remote network Connector [S2]
- Client platforms: macOS · Windows · Linux · Chrome · iOS · Android [S11]
- Client protocols: TCP · UDP · yes [S2]
- Client tls tunnel: certificate-pinned TLS to Connector [S2]
- Collected data types: yes · yes · yes · yes [S9]
- Components: Controller · Client · Connector · Relay [S2]
- Components: Controller · Clients · Connectors · Relay infrastructure [S3]
- Components: Client · Connector · Relays · Controller [S20]
- Connection token jwt: Controller issues a Connection Token, a JWT signed by the Controller, containing the Connector certificate's SHA-256 digest [S20]
- Connector anonymous id: Connectors identified to Clients only by anonymized hash-generated unique ID [S2]
- Connector capacity: A single Connector can handle traffic for hundreds of users [S13]
- Connector deployment: behind firewall of private Remote network [S2]
- Connector deployment environments: Docker · K8s (Helm Chart) · Azure ContainerInstance · Linux systemd · AWS ECS Fargate · AWS AMI · Docker for Microsoft Windows [S12]
- Connector deployment location: Connectors are deployed behind the firewall [S13]
- Connector dns: Connector performs local DNS resolution for FQDN Resources [S2]
- Connector heartbeat sha256: Connector sends heartbeat to Controller with SHA-256 digest of its self-signed certificate, which the Controller stores [S20]
- Connector load balancing: yes · yes [S13]
- Connector logging journald: Connectors log all events in real time via journald [S17]
- Connector max count: yes [S13]
- Connector names: yes · yes · yes [S12]
- Connector outbound relay: Connector maintains active outbound connections with at least one Relay (no inbound firewall openings required) [S2]
- Connector required: At least one Connector must be deployed for access to Resources in a Remote Network [S13]
- Connector self signed cert: Connector generates a key pair at startup and creates a self-signed certificate [S20]
- Connector status emails: yes · yes [S12]
- Connector windows docker warning: Linux VM using Hyper-V [S12]
- Connectors definition: Connectors are Twingate components deployed behind your firewall to provide access to private Resources [S12]
- Connectors run as: container or Linux systemd service [S12]
- Content filtering: yes [S1]
- Controller data flow: no [S2]
- Controller hosting: Twingate · yes · yes [S2]
- Controller idp delegation: delegated to third-party identity authority / IdP [S2]
- Default policy: yes · yes · no [S15]
- Device controls: yes [S1]
- Device management API: yes · deviceArchive · deviceBlock · deviceUnarchive · deviceUnblock · deviceUpdate [S18]
- Device only policy: yes [S15]
- Device posture check: crowdstrike · jamf · kandji · iru · inTune · sentinelOne · onePassword · manualVerification · hardDriveEncryption · screenLockPasscode · firewall · biometric · antivirus · osVersion [S18]
- Device security modes: Any Device · Only Trusted Devices · Custom · Any Device [S15]
- Dns client interaction: Users can access private DNS addresses without having access to the private DNS resolver, handled transparently by the Twingate Client [S3]
- Dns filtering: yes [S1]
- Dns filtering addon: yes [S7]
- Encryption: yes [S7]
- Encryption goals: Encryption goals are confidentiality and authentication; traffic cannot be decrypted by any third party including Twingate [S20]
- Fqdn ip access: Access via FQDN or IP address without knowledge of underlying network [S2]

**Subprocessors**
- List: yes [S10]

**Support**
- Community: yes [S7]
- Last updated: Documentation page last updated 6 months ago [S6]
- Maintenance off peak: endeavored [S8]
- Onboarding session: Live Onboarding Session [S7]
- Status maintenance: yes [S10]
- Status page: yes [S1]
- Status page maintenance notice: Status page with scheduled maintenance notice linked from footer [S11]

72 more facts on the canonical page: https://whats-best.ai/software/business-vpn/twingate

## Questions

### Is Twingate European?

No. whats-best.ai classifies Twingate as Rest of world.

### Where does Twingate store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Twingate have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Twingate?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Twingate alternatives](https://whats-best.ai/software/business-vpn/twingate/alternatives).

## Head-to-head

- [Twingate vs GoodAccess](https://whats-best.ai/compare/goodaccess-vs-twingate.md)

## What this page leaves out

- 40 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 14 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 9 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.

## Sources

- [S1] Vendor homepage: https://www.twingate.com/ (checked 2026-11-05)
- [S2] Documentation (how it works): https://www.twingate.com/docs/how-twingate-works (checked 2026-11-05)
- [S3] Documentation (architecture): https://www.twingate.com/docs/architecture (checked 2026-11-05)
- [S4] Documentation (audit logs): https://www.twingate.com/docs/audit-logs (checked 2026-11-05)
- [S5] API documentation: https://www.twingate.com/docs/api-overview (checked 2026-11-05)
- [S6] Documentation (Terraform): https://www.twingate.com/docs/terraform-getting-started (checked 2026-11-05)
- [S7] Pricing page: https://www.twingate.com/pricing (checked 2026-11-05)
- [S8] Terms of service (customer agreement): https://www.twingate.com/terms (checked 2026-11-05)
- [S9] Privacy policy: https://www.twingate.com/privacy (checked 2026-11-05)
- [S10] Legal center: https://www.twingate.com/legal (checked 2026-11-05)
- [S11] Security whitepaper: https://www.twingate.com/resources/twingate-security-whitepaper (checked 2026-11-05)
- [S12] Access model & connectivity — found from sitemap: https://www.twingate.com/docs/connectors (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://www.twingate.com/docs/remote-networks (checked 2026-11-05)
- [S14] Identity, access policy & device posture — found from sitemap: https://www.twingate.com/docs/identity-providers (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://www.twingate.com/docs/resource-policies (checked 2026-11-05)
- [S16] Logs, audit trail & incident response — found from sitemap: https://www.twingate.com/docs/audit-logs-schema (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://www.twingate.com/docs/siem-guide (checked 2026-11-05)
- [S18] Deployment, API & administration — found from sitemap: https://www.twingate.com/docs/api (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://www.twingate.com/docs/msp (checked 2026-11-05)
- [S20] Architecture, reliability & security assurance — found from sitemap: https://www.twingate.com/docs/how-encryption-works-in-twingate (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://www.twingate.com/terms/sla (checked 2026-11-05)

---

Cite as: whats-best.ai, "Twingate — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/twingate

Corrections: https://whats-best.ai/correct/1598?target=page