Business VPN & Zero Trust Access
ZeroTier
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by ZeroTier, Inc. · www.zerotier.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
ZeroTier at a glance
- Vendor
- ZeroTier, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates ZeroTier 2.5/5, the mean of 6 judges. ZeroTier is a peer-to-peer mesh VPN judged strongest on deployment and administration, where scores sit at 7: a Terraform provider, documented APIs, Intune silent-install rollout and a self-hosted, air-gapped Enterprise edition. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
ZeroTier is a peer-to-peer mesh VPN judged strongest on deployment and administration, where scores sit at 7: a Terraform provider, documented APIs, Intune silent-install rollout and a self-hosted, air-gapped Enterprise edition. Access and connectivity and architecture and assurance follow at 6 to 7, resting on end-to-end encryption, per-device keys that never leave the device, SOC 2 Type II, FIPS 140-3 certificate #5424 and a March 2020 Trail of Bits protocol review — beside the vendor's own statement that forward secrecy is not currently provided. Weakest are identity and policy and visibility and audit at 4 to 5: single sign-on is OIDC-only and desktop-only, and the audit trail is a 30-day configuration log; we found no public information on SCIM, automatic deprovisioning, posture checks, per-connection logs or SIEM streaming. Sovereignty ranged 4 to 6, a spread the bench did not flag: judges weighed a San Francisco contracting entity and no public information on control-plane hosting against a Dutch-law DPA and self-hosting options. Pricing transparency ranged 4 to 6 as well; overage rates are published, base prices are not.
Speaks for it
- Deployment and administration scored 7, backed by a Terraform provider, documented agent and Central APIs, webhooks and an Intune silent-install guide.
- Traffic is encrypted end to end under per-device Curve25519 keys that never leave the device, and root relays cannot decrypt it.
- Assurance evidence includes SOC 2 Type II, FIPS 140-3 certificate #5424 and a March 2020 Trail of Bits protocol review, with the client open source on GitHub.
- A self-hosted, air-gapped Enterprise edition is offered, sized for 500+ devices, alongside a free Personal tier of 10 devices and one network.
- Per-device overage prices are published verbatim — "10 included devices, then $2.00 each" on Essential and "100 included devices, then $1.80 each" on Scale.
Held against it
- The vendor states forward secrecy is not currently provided.
- The audit log records API requests on networks, members and account settings for 30 days on Essential and Scale, and we found no public information on per-connection logs, export or SIEM streaming.
- Single sign-on is OIDC-only, supported only on macOS and Windows desktops, with Google Workspace requiring a Keycloak bridge, and we found no public information on SCIM, automatic deprovisioning or device posture checks.
- We found no public information on base plan prices or the Enterprise and Quantum licences, so an annual cost cannot be computed from these pages.
- We found no public information on where the hosted control plane, account data and logs are stored, and ISO 27001 and DORA are marked "Coming Soon".
Best for
- You run networks as code and deploy Windows fleets through Intune — deployment and administration is the criterion scored 7 across the range.
- You want a low-friction start: the Personal tier covers 10 devices and one network free, and joining a network requires no account registration.
- You can host it yourself — the Enterprise edition is self-hosted and air-gapped, sized for 500+ devices.
- You face a post-quantum mandate — the Quantum tier lists ML-KEM-1024 (FIPS 203) and ML-DSA-87 (FIPS 204) under CNSA 2.0.
Avoid if
- You require forward secrecy — the vendor states it is not currently provided.
- Your single sign-on must cover Linux, mobile or Google Workspace directly — it is desktop macOS and Windows only, and Google needs a Keycloak bridge.
- You must show auditors who reached which resource — the audit trail covers configuration actions, retained 30 days on Essential and Scale (90 days on Enterprise).
- You need a firm annual cost up front — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3 of 5 |
| Identity, access policy & device posture | 2 of 5 |
| Logs, audit trail & incident response | 2 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 3 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 2.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
Devices form a peer-to-peer overlay with end-to-end encryption, falling back to the vendor's root servers when no direct path exists, and a documented Amazon VPC gateway with managed routes reaches a cloud network without opening inbound ports — close to what I need for the ERP and file server. Custom flow rules control which devices can talk to each other, though that is device-to-device rather than per-application access. We found no public information on dedicated static exit IPs for allowlisting, always-on or auto-connect, named gateway regions, or clientless access for contractors. 2 5 12 13
The DevOps Engineer
This is a genuine peer-to-peer mesh: devices connect directly whenever possible with the vendor's root servers as relay fallback, and the docs say what relaying costs in latency and packet loss, which is exactly the honest architecture disclosure I want. The AWS VPC gateway guide shows a self-run connector (a t2.nano EC2 instance routing a VPC range into the virtual network, deployable in Docker), managed routes give effective split tunnelling, and post-quantum key exchange with ML-KEM-1024 and CNSA 2.0 is documented on the Quantum tier. It falls short of the top anchors because access is granted per network and per device via flow rules rather than per application, and we found no public information on private or split DNS, clientless browser access for contractors, always-on auto-connect, named gateway or relay regions, or documented gateway high availability and failover. 2 5 12 13 6 4
The MSP Technician
The mesh is well documented: devices connect peer-to-peer, root servers relay only when no direct path exists, and the protocol and ciphers (Salsa20/12-Poly1305, AES-GMAC-SIV) are published. An Amazon VPC guide shows routing a cloud network through a self-run gateway instance, and custom flow rules restrict which devices may talk to each other. We found no public information on a per-platform client list, access per application rather than per device, clientless browser access for contractors, or named gateway regions. 2 13 4 12 5
The Operations Manager
Devices join with cryptographic identity, connect peer-to-peer whenever possible and fall back to the vendor's root relays when no direct path exists, with the protocol and cipher choices documented; an Amazon VPC gateway guide shows cloud links through an instance I would run myself, and freelancers can join from their own laptops because connecting to a network requires no account registration. We found no public information on always-on or auto-connect behaviour, named gateway or relay regions, or clientless browser access, so I have no evidence of a hotel-lobby fallback beyond the installed client. 2 4 12 13
The Information Security Officer
The mesh model is well documented: devices join with per-device cryptographic identity, traffic is encrypted end to end, connections are peer to peer with the vendor's root servers as relay fallback, and there is a guide for routing an Amazon VPC through a self-run gateway with managed routes defining which ranges traverse the overlay. For my control-system networks the gaps matter: the captured pages name no gateway or relay locations, and we found no public information on per-application access, clientless browser access for contractors, or always-on and auto-connect behaviour. 2 4 12 13 5 6
The Skeptic
A peer-to-peer mesh that falls back to the vendor's root servers when no direct path exists, end-to-end encrypted with keys that never leave the device — and the documentation says plainly that relaying brings increased latency and possible packet loss. Cloud links run through a gateway you build yourself on an EC2 instance needing only UDP 9993, spanning Layer 2 and Layer 3 across clouds, data centres and on-prem, and joining a network needs no account registration at all. We found no public information on gateway or relay locations, split tunnelling, always-on clients, or per-application access; the protocol is the vendor's own rather than WireGuard or IPsec, though its ciphers are documented. 2 4 12 13
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on is OIDC-based with role-based login controlling who may join a network, but it is a paid feature that works only on desktop macOS and Windows clients, and Google Workspace is not supported directly — a Keycloak bridge is the documented workaround. We found no public information on SCIM or automatic deprovisioning when a leaver's account is disabled, on device posture checks, or on session re-authentication, so I cannot confirm the same-day lockout I want from Entra ID. 2 5 14
The DevOps Engineer
Single sign-on is OIDC with three login modes including group and role based access from the identity provider, and flow rules let me restrict which devices talk to which — a workable policy model, though a paid one (Essential and up). Two things cap it for me: SSO is only supported on macOS and Windows desktops, so Linux servers and my bastion would sit behind the device-exclusion list instead of identity, and the docs state Google's OIDC is not supported directly and needs a Keycloak SAML broker. We found no public information on SCIM or automated deprovisioning, device posture checks, just-in-time access with approval, or session re-authentication. 14 6 5
The MSP Technician
Single sign-on works through any OpenID Connect provider that supports PKCE, with standard, email-list and role-based login modes, but it runs only on macOS and Windows desktops, Google Workspace needs a Keycloak bridge, and routers, servers and embedded devices can be excluded from it entirely. The identity underneath is a per-device Curve25519 key whose private key never leaves the endpoint — solid, but device-based rather than user-and-device based. We found no public information on SCIM or automatic deprovisioning, multi-factor authentication for network access, or any device posture checks. 14 4 6
The Operations Manager
Single sign-on works through any OIDC provider that supports PKCE, with standard, email-list and role-based access modes per network, and flow rules plus Terraform let me pin each freelancer to exactly the devices they need — though Google Workspace needs a Keycloak bridge, OneLogin is listed as coming soon, and SSO only covers desktop clients. We found no public information on SCIM or directory-based deprovisioning or on device posture checks, so access ending with the contract would be a manual membership deauthorisation rather than an automatic one. 14 5 18
The Information Security Officer
Single sign-on is real — any OIDC provider with PKCE required, three login modes including role-based network access, and per-device Curve25519 keys whose private key never leaves the device. But sign-on works only on macOS and Windows desktops, Google OIDC needs a Keycloak bridge, and we found no public information on device posture checks before a connection, SCIM or automatic deprovisioning, or just-in-time access with approval — exactly what my auditor will ask about. 14 4 6 5 2
The Skeptic
Single sign-on is OIDC-only with PKCE required, works only on macOS and Windows desktops, and Google Workspace needs a Keycloak SAML bridge; three login modes let you restrict a network by email list or identity-provider roles, and flow rules control which devices may talk to each other. Each device carries a Curve25519 identity whose private key never leaves it, which is real. We found no public information on SCIM or directory sync, device posture checks, just-in-time access, or automatic deprovisioning when someone leaves — and the multi-factor authentication described on the security page covers the vendor's own internal systems, not the product's users. 14 4 5 2
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
A paid Organization Audit Log records 30 days of API and dashboard activity, 90 days on Enterprise, and the vendor states it logs only member IP addresses and administrative usage while root servers see routing metadata but cannot decrypt traffic; Prometheus metrics add per-peer latency and packet counters. We found no public information on per-user connection logs tied to resources, SIEM streaming or log export, or an active-session view with a forced disconnect. 4 6 15 16
The DevOps Engineer
There is an admin audit log — API requests affecting networks, members and account settings, from both the dashboard and the public API — with retention stated per plan at 30 days, 90 days on Enterprise and custom on Quantum, plus webhooks on network, member and organization events. The vendor is admirably clear about what it cannot see: root relays cannot decrypt traffic and see only routing metadata, and there is no vendor monitoring dashboard — you build your own Prometheus and Grafana stack from ten documented per-node metrics. What I miss for incident response is a connection log of who reached which resource from which device; the audit trail covers configuration, and we found no public information on log export, SIEM streaming, or security alerting. 15 6 5 16 4
The MSP Technician
There is an organization audit log of every dashboard and API action on networks, members and account settings, kept 30 days on the paid plans, 90 on Enterprise, custom on Quantum — enough to answer a client after a configuration incident, if it happens within the month. Beyond that we found no public information on connection logs per user and device, export by CSV or to a SIEM, or a view of active sessions; no monitoring dashboard is supplied and customers are told to build their own Prometheus and Grafana stack. 15 6 16
The Operations Manager
There is an organization audit log of dashboard and API actions on networks, members and account settings with 30-day retention (90 days on the Commercial tier), and the security pages state plainly what is and is not logged — member IP addresses and admin usage logs, with no telemetry leaving a device without opt-in. We found no public information on per-connection access logs, log export or SIEM streaming, so proving after the fact which freelancer reached which project system is not something the captured pages show. 15 6 4
The Information Security Officer
An organization audit log records API and dashboard actions on networks, members and account settings, retention is stated per plan at thirty days rising to ninety on Enterprise, and webhooks and Prometheus metrics exist. What I need to prove after an incident — who reached which resource from which device, kept long enough and streamed to our SIEM — is not evidenced: the metrics count packets and latency rather than access decisions, and we found no public information on SIEM streaming, per-user connection logs, or a live session view with the option to disconnect. 15 6 16 4 5
The Skeptic
What exists is a paid 30-day audit log of API requests affecting networks, members and account settings (90 days on Enterprise, custom on Quantum), plus an unusually honest statement of what the root servers see — ZeroTier addresses, physical IPs and timing — while telemetry is opt-in and anonymised. The vendor states it does not currently supply a monitoring dashboard; you assemble your own from Prometheus metrics, and webhooks notify network, member and organisation events. We found no public information on SIEM streaming, export of the audit logs, per-connection access logs, or alerts on unusual access. 15 6 4 16 5
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
The Intune guide walks through converting the MSI into an.intunewin package with a silent install command and PowerShell auto-join, which is exactly how my team would roll this out, and there is a documented REST API plus a Terraform provider managing networks, members and identities, webhooks and Docker images. Enterprise adds a self-hosted, air-gapped edition sized for 500+ devices. We found no public information on a multi-tenant console for service providers, and the vendor notes the newer Central interface does not yet reach feature parity with the old one. 5 6 15 17 18
The DevOps Engineer
This is where it clicks for my team: a Terraform provider managing networks, members, identities and flow rules as code against the Central API, with service-account tokens and a multicloud quickstart, so policies live in Git. Client rollout is covered by an Intune guide with silent MSI install and PowerShell auto-join, the agent and Central APIs are documented, webhooks exist, there is a self-hosted controller option and an air-gapped Enterprise edition, and support tiers with SLAs are stated per plan. The gaps are admin roles (admin seat counts and an owner-versus-administrator split rather than granular roles), no evidenced multi-tenant or MSP console, and the vendor itself notes some Central features are not yet in New Central. 18 5 17 6 16 15
The MSP Technician
Terraform manages networks, members and identities through the Central API, the Windows client installs silently and deploys via Intune with PowerShell auto-join scripting, and webhooks push network, member and organization events — this is exactly the automation an MSP wants for onboarding a new client. An Enterprise edition is self-hosted and air-gapped, and support runs from community to ticketed to priority with an SLA per plan. What we found no public information on is the part I need most: a multi-tenant console with one tenant per client and billing per tenant, and admin roles are limited to Owners and Administrators, with New Central still missing features that Central has. 18 17 5 6 14 15
The Operations Manager
A Central console with documented REST APIs, a Terraform provider for networks, members and flow rules, webhooks, and an Intune deployment guide with silent-install commands and PowerShell auto-join scripts — that is a setup a non-specialist can follow. A self-hosted, air-gapped Enterprise edition plus Docker or cloud-instance gateways are documented, while we found no public information on a multi-tenant console for service providers or on staged client and gateway updates. 5 6 16 17 18
The Information Security Officer
A small team is well served: a Terraform provider with network, member and identity resources and flow rules as code, Intune deployment with a silent MSI install and PowerShell auto-join, Docker support, a Central console with APIs and service-account tokens, webhooks, and an Enterprise edition that is self-hosted and air-gapped. Administrative roles appear to stop at owners and administrators, and we found no public information on a multi-tenant console for service providers. 18 17 5 6 16
The Skeptic
The Central console and its documented agent and Central APIs manage networks and members, a Terraform provider covers network, member and identity resources with service-account tokens, and Windows rollout goes through Intune with a silent MSI install and PowerShell auto-join. A self-hosted controller, an air-gapped Enterprise edition, Docker deployment and per-plan support tiers with an SLA in the docs are all evidenced. We found no public information on a multi-tenant console for service providers, staged update rollouts, or managed deployment for macOS and Linux; admin granularity shown is organization owners versus administrators, with admin counts capped per plan. 17 18 5 6 12 14
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The architecture is published: per-device Curve25519 identities with private keys that never leave the device, end-to-end encryption, open-source client code on GitHub, and root relays that cannot decrypt traffic, backed by a SOC 2 Type II examination, FIPS 140-3 certificate #5424 and a March 2020 Trail of Bits protocol review. The vendor itself states the protocol does not currently provide forward secrecy. We found no public information on control-plane high availability, a public status page, incident history, or what happens to existing connections if the hosted service is down. 2 3 4 7
The DevOps Engineer
The security page is the kind of disclosure I ask vendors for: Curve25519 device identities with private keys that never leave the device, end-to-end encryption, a published Trail of Bits review of the protocol and cryptographic design from March 2020, a SOC 2 Type II examination with the report available via a trust centre, CVE publication, a security contact, and an explicit statement that root servers cannot decrypt relayed traffic though they see addresses and timing. Client source is open on GitHub and the platform runs a distributed data plane. Working against a higher score: the docs state forward secrecy is not currently provided (the Quantum platform with ML-KEM and CNSA 2.0 is a separate product), the 2020 audit is dated, ISO 27001 and DORA are marked coming soon, and we found no public information on bug bounty scope, control-plane high availability, or what happens to live connections during a vendor outage. 4 13 6 2 3
The MSP Technician
The security pages publish what the root servers can and cannot see (routing metadata but not traffic content), per-device keys that never leave the endpoint, end-to-end encryption, a Trail of Bits review of the protocol design from March 2020, SOC 2 Type II, and CVE publication, and the client is open source. Against that, the vendor states there is currently no forward secrecy, ISO 27001 and DORA are marked coming soon, and we found no public information on a public status page, incident history, control-plane failover, or a bug bounty. 4 6 7
The Operations Manager
The security page documents the mesh design — Curve25519 identities whose private keys never leave the device, end-to-end encryption, roots that see routing metadata but cannot decrypt traffic — with client code open on GitHub, a Trail of Bits protocol review from March 2020, SOC 2 Type II, FIPS 140-3 certificate #5424, a published CVE practice and an SLA section in the docs. The same page states that forward secrecy is not currently provided, and we found no public information on control-plane high availability, a status page or public incident history. 4 2 3 6
The Information Security Officer
The security documentation is candid: root relays see routing metadata such as ZeroTier addresses, physical IPs and timing but cannot decrypt traffic; it discloses that forward secrecy is not currently provided; client source is on GitHub; and a March 2020 Trail of Bits review of the protocol and cryptography is recorded alongside SOC 2 Type II and a FIPS 140-3 certificate. The independent review is protocol-scoped and dates from 2020, ISO 27001 and DORA are marked coming soon, and we found no public information on control-plane failover, a public status page, or a bug bounty. 4 2 6 3 1
The Skeptic
The security documentation says what the root servers can and cannot do — they relay but cannot decrypt, and they see routing metadata — the client is open source on GitHub, each device's keys stay on the device, and a SOC 2 Type II examination plus FIPS 140-3 certificate 5424 are stated, with a Trail of Bits protocol review dated March 2020. But the same pages state plainly that forward secrecy is not provided, and ISO 27001 and DORA appear only as "Coming Soon" — announced, not done. We found no public information on a public status page, incident history, control-plane high availability, or what happens to existing connections when the vendor's coordination service is unreachable — the first questions I ask of any network product. 4 6 16 1 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The controller is ZeroTier, Inc. of San Francisco with ZeroTier Europe B.V. in Utrecht as GDPR representative, and there is a published October 2025 data processing agreement using Dutch law for the contractual clauses and pointing to a public subprocessor list at the Trust Center; an Enterprise self-hosted, air-gapped edition would let us run the controller on our own servers. We found no public information on where the hosted control plane, account data or logs are stored, and only the Quantum plan is shown with a sovereign cloud option. 6 7 9 10
The DevOps Engineer
The contracting party is ZeroTier, Inc. of San Francisco as owner and data controller, with ZeroTier Europe B.V. in Utrecht acting as GDPR representative and the Dutch Data Protection Authority named for complaints; the DPA puts Dutch law on the standard contractual clauses. Subprocessors are listed at trust.zerotier.com with 14 days' notice of changes, data is encrypted at rest with AES-256, and return-or-delete terms are published at 60 days. But we found no public information on where the control plane, accounts, identities or logs are hosted, and the traffic path runs peer-to-peer through the vendor's US-run root servers, so the chain of custody for metadata stays American; the self-hosted controller and air-gapped Enterprise edition are the customer's own chain. 9 10 8 6
The MSP Technician
The contracting entity and data importer is ZeroTier, Inc. of San Francisco, with ZeroTier Europe B.V. in Utrecht as GDPR representative, a published data processing addendum governed by Dutch law with the Dutch DPA as supervisory authority, and subprocessors listed at the vendor's Trust Center; SOC 2 Type II is stated. Where the hosted control plane, logs and identities actually sit is not stated in anything we read. A self-hosted, air-gapped Enterprise edition and a sovereign cloud for Quantum give a customer a way to keep the chain on European servers, which is the route we would take for clients who ask. 9 10 6 8
The Operations Manager
ZeroTier, Inc. of San Francisco is the owner, controller and processor, with ZeroTier Europe B.V. in Utrecht as GDPR representative, a published data processing addendum under Dutch governing law for the contract clauses, and subprocessors listed at the Trust Center with fourteen days' notice of changes — but the captured pages do not state where the control plane, logs and account data are hosted. An Enterprise self-hosted, air-gapped edition is offered and the pages say it can run fully air-gapped with policy enforced locally, though we found no public information confirming it keeps every record on the customer's own servers. 9 10 6 1
The Information Security Officer
The contracting entity and data controller is ZeroTier, Inc. of San Francisco, with ZeroTier Europe B.V. in Utrecht as GDPR representative, a published October 2025 data processing addendum under Dutch governing law, subprocessors listed at the Trust Center, and a self-hosted air-gapped Enterprise edition plus a sovereign cloud option for the Quantum product. Where the hosted control plane, identities and logs are stored is not stated on the captured pages and the subprocessor locations are not given there, so my requirement for logs and identities kept in Europe is not proven. 9 10 8 6 1
The Skeptic
The owner, controller and data importer is ZeroTier, Inc. of San Francisco, with ZeroTier Europe B.V. in Utrecht as GDPR representative and the Dutch data protection authority named for its processing; a data processing agreement dated October 2025 with standard contractual clauses and Dutch governing law is published, and subprocessors are listed at the vendor's Trust Center. We found no public information on where the hosted control plane, account data and logs are actually stored. A self-hosted, air-gapped Enterprise edition and a "Sovereign" delivery option for ZeroTier Quantum are offered, which would put the chain on the customer's own servers. 9 10 6 1
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Tiers and inclusions are public: a free Personal tier with 10 devices and one network, Essential with 10 networks, five admins and 10 included devices then "$2.00 each", Scale with 100 included devices then "$1.80 each" and unlimited networks, with support level and audit-log retention shown per tier. The terms state billing in United States dollars, net 30, auto-renewal with cancellation at least three days before the next term, and taxes borne by the customer. We found no public information on the base subscription price for the paid tiers, the Enterprise self-hosted licence or the Quantum plan, so I cannot compute an annual cost from the captured pages. 6 8 14
The DevOps Engineer
The pricing page names every tier with per-device scaling: Personal free with 10 devices and one network, Essential with 10 included devices then $2.00 each, Scale with 100 included devices then $1.80 each, admin counts and audit-log retention per tier, and Enterprise sized for 500+ devices self-hosted and air-gapped — though the Enterprise price itself is not published. Billing terms are explicit: USD, net 30 invoiced in advance, non-refundable, auto-renewal with cancellation at least three days before term, taxes borne by the customer. What keeps me from computing a full annual cost: single sign-on is gated behind paid tiers, no monthly-versus-annual split is given, and we found no public information on the price of the self-hosted or Quantum licence. 6 8 14
The MSP Technician
The pricing page shows a free tier (10 devices, one network, community support), Essential with 10 networks, five admins and 10 included devices then "$2.00 each", and Scale with unlimited networks, 10 admins, 100 included devices then "$1.80 each", plus up to 50% off for charities and education — the device scaling is quotable. Billing is in US dollars, taxes are borne by the customer, subscriptions auto-renew and cancellation needs three days' notice through the customer portal. The base plan price itself is not among the figures we captured, and the self-hosted Enterprise and Quantum editions are unpriced, so a full annual quote still needs the vendor. 6 8
The Operations Manager
The pricing page shows the tiers with their limits — free personal use with ten devices, Essential with ten networks and five admins plus $2.00 per additional device, Scale with unlimited networks and $1.80 per additional device after a hundred — and the terms state USD billing, net-30 invoicing in advance, non-refundable payments and that the customer pays applicable taxes. We found no public information on the base subscription price per plan, monthly versus annual billing, or the price of the self-hosted Enterprise licence, so I cannot compute my annual cost from the captured pages. 1 6 8 14
The Information Security Officer
The plan structure is public with a clear per-device scaling rule — Essential at 10 included devices then $2.00 each, Scale at 100 included devices then $1.80 each — plus admin counts, audit-log retention and support level per plan, net-30 invoicing in US dollars, non-refundable terms, three-day cancellation notice before auto-renewal, and taxes borne by the customer. The base price of each plan and the self-hosted Enterprise licence are not on the captured pages, so a full annual cost cannot be computed from what we read. 6 8 14 15
The Skeptic
The pricing page shows plan limits — devices, networks, admins, audit-log retention, support level — and per-device overage prices quoted exactly as "10 included devices, then $2.00 each" on Essential and "100 included devices, then $1.80 each" on Scale, with a free Personal tier and up to 50% off for charities and educational organisations. The terms state auto-renewal with cancellation at least three days before the next term, invoicing in advance payable net thirty in United States dollars, non-refundable payments, and taxes including VAT borne by the customer. We found no public information on the base price of each plan, monthly versus annual billing, or Enterprise and Quantum pricing, so a buyer cannot compute the real annual cost from these pages. 6 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about ZeroTier
Is ZeroTier European?
No. whats-best.ai classifies ZeroTier as Rest of world.
Where does ZeroTier store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does ZeroTier have a free plan?
Yes. ZeroTier has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to ZeroTier?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: ZeroTier alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.zerotier.com Checked 5 Nov 2026 Details →
- 2 Features page (platform) www.zerotier.com Checked 5 Nov 2026 Details →
- 3 Documentation docs.zerotier.com Checked 5 Nov 2026 Details →
- 4 Documentation (security) docs.zerotier.com Checked 5 Nov 2026 Details →
- 5 API documentation docs.zerotier.com Checked 5 Nov 2026 Details →
- 6 Pricing page www.zerotier.com Checked 5 Nov 2026 Details →
- 7 About page www.zerotier.com Checked 5 Nov 2026 Details →
- 8 Terms of service www.zerotier.com Checked 5 Nov 2026 Details →
- 9 Privacy policy www.zerotier.com Checked 5 Nov 2026 Details →
- 10 Data processing agreement (dpa) www.zerotier.com Checked 5 Nov 2026 Details →
- 11 Security / trust page trust.zerotier.com Checked 5 Nov 2026 Details →
- 12 Access model & connectivity — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 14 Identity, access policy & device posture — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 15 Logs, audit trail & incident response — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 16 Logs, audit trail & incident response — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 17 Deployment, API & administration — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 18 Deployment, API & administration — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
- 19 Architecture, reliability & security assurance — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →