# ZeroTier — Business VPN & Zero Trust Access

ZeroTier by ZeroTier, Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: ZeroTier, Inc. (https://www.zerotier.com)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/zerotier
- Alternatives: https://whats-best.ai/software/business-vpn/zerotier/alternatives ([markdown](https://whats-best.ai/software/business-vpn/zerotier/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: ZeroTier, Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S1]

## The panel's verdict

ZeroTier is a peer-to-peer mesh VPN judged strongest on deployment and administration, where scores sit at 7: a Terraform provider, documented APIs, Intune silent-install rollout and a self-hosted, air-gapped Enterprise edition. Access and connectivity and architecture and assurance follow at 6 to 7, resting on end-to-end encryption, per-device keys that never leave the device, SOC 2 Type II, FIPS 140-3 certificate #5424 and a March 2020 Trail of Bits protocol review — beside the vendor's own statement that forward secrecy is not currently provided. Weakest are identity and policy and visibility and audit at 4 to 5: single sign-on is OIDC-only and desktop-only, and the audit trail is a 30-day configuration log; we found no public information on SCIM, automatic deprovisioning, posture checks, per-connection logs or SIEM streaming. Sovereignty ranged 4 to 6, a spread the bench did not flag: judges weighed a San Francisco contracting entity and no public information on control-plane hosting against a Dutch-law DPA and self-hosting options. Pricing transparency ranged 4 to 6 as well; overage rates are published, base prices are not.

**Speaks for it:**
- Deployment and administration scored 7, backed by a Terraform provider, documented agent and Central APIs, webhooks and an Intune silent-install guide.
- Traffic is encrypted end to end under per-device Curve25519 keys that never leave the device, and root relays cannot decrypt it.
- Assurance evidence includes SOC 2 Type II, FIPS 140-3 certificate #5424 and a March 2020 Trail of Bits protocol review, with the client open source on GitHub.
- A self-hosted, air-gapped Enterprise edition is offered, sized for 500+ devices, alongside a free Personal tier of 10 devices and one network.
- Per-device overage prices are published verbatim — "10 included devices, then $2.00 each" on Essential and "100 included devices, then $1.80 each" on Scale.

**Held against it:**
- The vendor states forward secrecy is not currently provided.
- The audit log records API requests on networks, members and account settings for 30 days on Essential and Scale, and we found no public information on per-connection logs, export or SIEM streaming.
- Single sign-on is OIDC-only, supported only on macOS and Windows desktops, with Google Workspace requiring a Keycloak bridge, and we found no public information on SCIM, automatic deprovisioning or device posture checks.
- We found no public information on base plan prices or the Enterprise and Quantum licences, so an annual cost cannot be computed from these pages.
- We found no public information on where the hosted control plane, account data and logs are stored, and ISO 27001 and DORA are marked "Coming Soon".

**Best for:**
- You run networks as code and deploy Windows fleets through Intune — deployment and administration is the criterion scored 7 across the range.
- You want a low-friction start: the Personal tier covers 10 devices and one network free, and joining a network requires no account registration.
- You can host it yourself — the Enterprise edition is self-hosted and air-gapped, sized for 500+ devices.
- You face a post-quantum mandate — the Quantum tier lists ML-KEM-1024 (FIPS 203) and ML-DSA-87 (FIPS 204) under CNSA 2.0.

**Avoid if:**
- You require forward secrecy — the vendor states it is not currently provided.
- Your single sign-on must cover Linux, mobile or Google Workspace directly — it is desktop macOS and Windows only, and Google needs a Keycloak bridge.
- You must show auditors who reached which resource — the audit trail covers configuration actions, retained 30 days on Essential and Scale (90 days on Enterprise).
- You need a firm annual cost up front — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Identity, access policy & device posture | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2.5/5 |
| Logs, audit trail & incident response | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2.5/5 |
| Deployment, API & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Architecture, reliability & security assurance | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 3/5 | 2/5 |
| Pricing transparency | 2.5/5 | 3/5 | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 |
| **Weighted verdict** | **2.5/5** | **3/5** | **3/5** | **2.5/5** | **2.5/5** | **2.5/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Brazil lgpd: yes [S9]
- Certifications in lieu of audit: yes · 12 [S10]
- Controller roles: Usage Data · Administration Data · yes [S10]
- Cve publication: yes [S4]
- Data breach notification: written, without undue delay [S10]
- Deidentified data commitment: yes [S10]
- Disaster recovery: yes · yes [S10]
- Dora ISO: coming soon · coming soon [S6]
- DPA: https://www.zerotier.com/dpa/ · yes [S8]
- DPA available: October 2025 · yes [S10]
- Dutch DPA complaints: Dutch Data Protection Authority (Autoriteit Persoonsgegevens) for data processed by ZeroTier Europe B.V. [S9]
- Employee background checks: yes · yes · yes [S4]
- Encryption: AES-256 across all plans [S6]
- Encryption at rest: AES-256 · TLS 1.2+ [S10]
- Encryption key storage: yes [S10]
- Fips: FIPS 140-3 · FIPS 203 · FIPS 204 · 5424 [S2]
- Fips 140 3: FIPS 140-3 · 5424 [S1]
- Fips 140 3: FIPS 140-3 · 5424 [S10]
- Fips 203 204: FIPS 203 · FIPS 204 [S1]
- Fips algorithms: FIPS 203 · FIPS 204 [S10]
- Fips certificate: FIPS 140-3 · 5424 [S6]
- First party marketing only: no [S9]
- GDPR: yes [S1]
- GDPR: GDPR [S2]
- GDPR: yes [S6]
- GDPR badge: yes [S10]
- GDPR user rights: yes [S9]
- Governing law: Netherlands [S10]
- Gpc honored: yes [S9]
- Key exchange: ML-KEM-1024 / ECC-384 · ECC-256 [S6]
- Marketing cookies policy: no [S9]
- MFA: yes [S10]
- No data sale: yes · yes [S10]
- Policy last updated: 2025-12-09 [S9]
- Quantum algorithms: CNSA 2.0 · ML-KEM-1024 (FIPS 203) · ML-DSA-87 (FIPS 204) [S1]
- Rights response time: yes · within one month [S9]
- Security contact: legal@zerotier.com [S8]
- Security measures: commercially reasonable technical and organizational measures [S8]
- SOC 2: yes · SOC 2 Type II [S1]
- SOC 2: SOC 2 Type II [S2]
- SOC 2: Type II · yes [S6]
- SOC 2 type2: yes · via Trust Center [S4]

**Data**
- Backup overwrite period: 60 [S10]
- Categories processed: encrypted data packets · usage data including IP address · name and contact info · encrypted data packets · ticket contents · usage data including IP address [S10]
- Collected types: personal data (name, address, email, language, resume) · approximate geolocation (IP-derived, no precise GPS) · device information (IP address, operating systems) · usage data · trackers · payment info [S9]
- Data sharing categories: analytics providers · infrastructure providers · advertising networks · payment processors · HR/recruitment platforms [S9]
- Deletion of covered data: yes [S10]
- Minimal collection: yes [S4]
- No network traffic tracking: no [S9]
- Payment info handling: no · yes [S9]
- Payments via external providers: yes [S9]
- Purposes of processing: building and running the application · advertising · analytics · A/B testing · displaying external content · productivity activities · handling payments · infrastructure monitoring · live chat interaction · online surveys · remarketing and… [S9]
- Retention: retained as long as required by purpose, longer for legal obligation or consent [S9]
- Return deletion: 60 · yes [S10]
- Sold to third parties: no [S9]
- Third party dpas: yes [S9]
- Transfer frequency: continuous [S10]

**Hosting**
- Public sector partner: Carahsoft · public sector [S1]
- Self hosted enterprise: yes · yes · 500+ [S6]

**Integrations**
- Alternative tools: Prometheus Blackbox exporter · SmokePing · UptimeKuma [S16]
- API token creation legacy central: API Access Tokens · yes [S18]
- API token creation new central: service accounts · yes [S18]
- Controller API: ZeroTier Controller API for programmatic network management [S16]
- Docker: yes · yes [S5]
- Products named: ZeroTier One · ZeroTier Central [S10]
- Prometheus grafana: yes · yes [S16]
- SSO google unsupported: Keycloak as SAML Identity Broker · no [S14]
- SSO keycloak SAML bridge: Keycloak SAML Identity Broker · yes [S14]
- SSO onelogin role access: coming_soon · no [S14]
- Terraform: yes · yes [S5]
- Terraform flow rules: Terraform network module accepts flow_rules configuration [S18]
- Terraform multicloud guide: A multicloud edition of the Terraform quickstart exists [S18]
- Terraform network module: zerotier/network/zerotier · 1.0.0 [S18]
- Terraform provider: ZeroTier offers a Terraform Provider that manages networks via the Central API [S18]
- Terraform token env var: ZEROTIER_CENTRAL_TOKEN [S18]
- Webhooks: yes · yes · yes [S5]

**Legal**
- Arbitration: yes · yes [S8]
- Entity: ZeroTier, Inc. · 2026 [S1]
- Entity name: ZeroTier, Inc. [S8]
- EU representative: ZeroTier Europe B.V. · Stadsplateau 29, 3521 AZ Utrecht [S9]
- Importer entity: ZeroTier Inc. · 48 Market St #911530 San Francisco, California 94104 [S10]
- Msa override: yes [S8]
- Owner: ZeroTier, Inc. · 548 Market St #911530, San Francisco, CA 94104 [S9]
- Privacy contact: privacy@zerotier.com [S10]
- Privacy policy: https://www.zerotier.com/privacy-policy [S8]
- Termination rights: yes [S8]
- Terms version: August 2024 [S8]

**Pricing**
- Auto renew: yes [S8]
- Cancellation notice: Service customer portal · 3 [S8]
- Charity discount: registered charities and educational organizations · 50 [S6]
- Currency: USD [S8]
- Data deletion after nonpayment: 28 [S8]
- Essential additional devices: 10 · 2 [S6]
- Essential limits: 5 · 10 [S6]
- Free tier partial: yes · yes [S8]
- Free trial data loss: yes [S8]
- Free trial liability cap: 100 [S8]
- Liability cap: amount paid or $100, whichever is greater [S8]
- Non refundable: no [S8]
- Payment processor: Stripe [S8]
- Price change notice: 30 [S8]
- Pricing page: https://www.zerotier.com/pricing [S8]
- Scale additional devices: 100 · 1.8 [S6]
- Scale limits: 10 · unlimited [S6]
- SSO paid feature: yes · Essential · Commercial [S14]
- Subscription suspension lock: subscription auto-renews at end of term [S8]
- Subscription terms: no · net 30 · yes [S8]
- Taxes user pays: yes [S8]

**Product**
- Air gapped: yes [S1]
- API provision: ZeroTier agent (Client API) · Central API · query networks and peers · manage network configuration · manage network membership [S5]
- Audit log retention: 30 days · custom · 30 days · 90 days [S6]
- Audit logs access: Accessed via Organization Audit Log link in Organization section of Account page [S15]
- Audit logs coverage: networks · members · account settings [S15]
- Audit logs paid: Essential · Commercial · yes [S15]
- Audit logs retention: 30 [S15]
- Audit logs scope: Central dashboard · public API [S15]
- Auto join scripting: PowerShell auto-join scripting supported for Windows networks [S17]
- Automated testing code review: yes · yes [S4]
- Avoid ip conflict: VPC and ZeroTier networks must not have overlapping IP ranges; renumbering or NAT hacks advised otherwise [S12]
- Aws vpc gateway guide: Guide for routing between an Amazon VPC and a ZeroTier virtual network via an EC2 gateway instance [S12]
- Capabilities: cloud-to-cloud networking · global device fleets · identity-based access control · Layer 2 and Layer 3 networking · programmable network management [S2]
- Ciphers: Salsa20/12-Poly1305 · AES-GMAC-SIV (ZeroTier One 1.6+) [S4]
- Client source on github: yes [S4]
- Code server: yes · yes [S5]
- Compatibility docs: OS and device compatibility documentation provided [S3]
- Components: ZeroTier One · ZeroTier Quantum [S1]
- Content license: yes [S8]
- Controller API: ZeroTier Central or a self-hosted controller's API can authorize members and add routes [S12]
- Core mechanisms: cryptographic identity for joining devices · end-to-end encryption · peer-to-peer connections when possible · central policy enforced locally at endpoints [S2]
- Custom flow rules: custom flow rules controlling device-to-device communication · yes [S5]
- Custom routes: Managed routes can be added pointing VPC ranges via a gateway's ZeroTier-side IP [S12]
- Data plane: distributed data plane across all plans [S6]
- Dependency vulnerability scans: yes [S4]
- Encryption claim: secure, encrypted connections [S7]
- End to end encryption: yes [S4]
- Enterprise air gapped: Enterprise [S6]
- Enterprise features: yes · Priority with enhanced SLA · yes · 90-day · yes [S6]
- Essential features: yes · OIDC · Ticketed with SLA · 30-day · yes [S6]
- Free tier: yes [S1]
- Identity curve25519: yes · yes [S4]
- Industries: Auto and Transport · Defense · Education · Enterprise IT · Finance and Banking · Government · Healthcare and Pharma · Hospitality and Gaming · IoT and Edge Computing · Manufacturing · MSPs and Telcos [S1]
- Industries: Auto and Transport · Defense · Education · Enterprise IT · Finance and Banking · Government · Healthcare and Pharma · Hospitality and Gaming · IoT and Edge Computing · Manufacturing · MSPs and Telcos [S2]
- Intune deployment supported: yes [S17]
- Intune win32 deployment: Win32 Content Prep Tool conversion of MSI to .intunewin [S17]
- Ipv4 forwarding: Gateway requires enabling IPv4 IP forwarding on the EC2 instance [S12]
- Key ownership: no [S1]
- Member bridging setting: allow_ethernet_bridging [S18]
- Metric data bytes: zt_data · Counter · protocol · direction [S16]
- Metric general packet: zt_packet · Counter · packet_type · direction [S16]
- Metric network level: Gauge · zt_num_networks [S16]

**Subprocessors**
- Change notice days: 14 [S10]
- List URL: https://trust.zerotier.com · yes [S10]

**Support**
- Community: Community & Support resources include GitHub, Reddit, Bluesky [S3]
- Docs: Docs · Support · Download [S1]
- Documentation: yes [S6]
- Documentation: Documentation site maintained by ZeroTier, Inc. [S12]
- Escalation trigger: contact network admin if high latency or packet jitter persists more than four hours [S13]
- Plan support: Ticketed · Priority · Community · Ticketed · Priority [S6]
- Security reports email: security@zerotier.com · yes [S4]
- SLA docs: yes · yes [S5]
- SLA page: Documentation site includes a Service Level Agreement (SLA) section [S3]

75 more facts on the canonical page: https://whats-best.ai/software/business-vpn/zerotier

## Questions

### Is ZeroTier European?

No. whats-best.ai classifies ZeroTier as Rest of world.

### Where does ZeroTier store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does ZeroTier have a free plan?

Yes. ZeroTier has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19174).

### What are the best alternatives to ZeroTier?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [ZeroTier alternatives](https://whats-best.ai/software/business-vpn/zerotier/alternatives).

## What this page leaves out

- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://www.zerotier.com/ (checked 2026-11-05)
- [S2] Features page (platform): https://www.zerotier.com/platform/ (checked 2026-11-05)
- [S3] Documentation: https://docs.zerotier.com/ (checked 2026-11-05)
- [S4] Documentation (security): https://docs.zerotier.com/security/ (checked 2026-11-05)
- [S5] API documentation: https://docs.zerotier.com/api (checked 2026-11-05)
- [S6] Pricing page: https://www.zerotier.com/pricing/ (checked 2026-11-05)
- [S7] About page: https://www.zerotier.com/about/ (checked 2026-11-05)
- [S8] Terms of service: https://www.zerotier.com/tos/ (checked 2026-11-05)
- [S9] Privacy policy: https://www.zerotier.com/privacy-policy/ (checked 2026-11-05)
- [S10] Data processing agreement (dpa): https://www.zerotier.com/dpa/ (checked 2026-11-05)
- [S11] Security / trust page: https://trust.zerotier.com/ (checked 2026-11-05)
- [S12] Access model & connectivity — found from sitemap: https://docs.zerotier.com/aws-vpc-gateway/ (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://docs.zerotier.com/faq/relaying/ (checked 2026-11-05)
- [S14] Identity, access policy & device posture — found from sitemap: https://docs.zerotier.com/sso/ (checked 2026-11-05)
- [S15] Logs, audit trail & incident response — found from sitemap: https://docs.zerotier.com/audit-logs/ (checked 2026-11-05)
- [S16] Logs, audit trail & incident response — found from sitemap: https://docs.zerotier.com/metrics-monitoring/ (checked 2026-11-05)
- [S17] Deployment, API & administration — found from sitemap: https://docs.zerotier.com/intune-deployment/ (checked 2026-11-05)
- [S18] Deployment, API & administration — found from sitemap: https://docs.zerotier.com/terraform/ (checked 2026-11-05)
- [S19] Architecture, reliability & security assurance — found from sitemap: https://docs.zerotier.com/sla/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "ZeroTier — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/zerotier

Corrections: https://whats-best.ai/correct/1600?target=page