whats-best.ai
Search Sign in

Business VPN & Zero Trust Access

ZeroTier

Rest of world Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by ZeroTier, Inc. · www.zerotier.com

Report an error on this page Is this your product? →

Link to this page

ZeroTier: AI-assisted analysis on whats-best.ai ZeroTier: AI-assisted analysis on whats-best.ai (dark)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

ZeroTier at a glance

Vendor
ZeroTier, Inc.
Headquarters
Not stated on the vendor’s pages as of 5 Nov 2026
Data hosting
Not stated on the vendor’s pages as of 5 Nov 2026
Free plan
Yes, per the vendor’s own page source, captured 5 Nov 2026
Panel verdict
The AI panel rates ZeroTier 2.5/5, the mean of 6 judges. ZeroTier is a peer-to-peer mesh VPN judged strongest on deployment and administration, where scores sit at 7: a Terraform provider, documented APIs, Intune silent-install rollout and a self-hosted, air-gapped Enterprise edition. how scores are made
As of
Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources

ZeroTier alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The DevOps Engineer

Weighted verdict

Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The DevOps Engineer

Panel median The DevOps Engineer This judge’s scores over the panel median. Each label opens its reasoning below.
Scores per criterion, in stars out of 5
Criterion Panel median The DevOps Engineer
Access model & connectivity 3 of 5 3.5 of 5
Identity, access policy & device posture 2 of 5 2 of 5
Logs, audit trail & incident response 2 of 5 2 of 5
Deployment, API & administration 3.5 of 5 3.5 of 5
Architecture, reliability & security assurance 3 of 5 3.5 of 5
European sovereignty 2.5 of 5 2 of 5
Pricing transparency 2.5 of 5 3 of 5

Access model & connectivity

How this is scored

What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.

0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.

3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.

5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.

8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.

10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.

Report an error

The DevOps Engineer

This is a genuine peer-to-peer mesh: devices connect directly whenever possible with the vendor's root servers as relay fallback, and the docs say what relaying costs in latency and packet loss, which is exactly the honest architecture disclosure I want. The AWS VPC gateway guide shows a self-run connector (a t2.nano EC2 instance routing a VPC range into the virtual network, deployable in Docker), managed routes give effective split tunnelling, and post-quantum key exchange with ML-KEM-1024 and CNSA 2.0 is documented on the Quantum tier. It falls short of the top anchors because access is granted per network and per device via flow rules rather than per application, and we found no public information on private or split DNS, clientless browser access for contractors, always-on auto-connect, named gateway or relay regions, or documented gateway high availability and failover. 2 5 12 13 6 4

Report an error

Identity, access policy & device posture

How this is scored

Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.

0 — No user identity at all; a shared key or configuration file grants access to the whole network.

3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.

5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.

8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.

10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.

Report an error

The DevOps Engineer

Single sign-on is OIDC with three login modes including group and role based access from the identity provider, and flow rules let me restrict which devices talk to which — a workable policy model, though a paid one (Essential and up). Two things cap it for me: SSO is only supported on macOS and Windows desktops, so Linux servers and my bastion would sit behind the device-exclusion list instead of identity, and the docs state Google's OIDC is not supported directly and needs a Keycloak SAML broker. We found no public information on SCIM or automated deprovisioning, device posture checks, just-in-time access with approval, or session re-authentication. 14 6 5

Report an error

Logs, audit trail & incident response

How this is scored

What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.

0 — No logs of any kind; the admin cannot see who connected.

3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.

5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.

8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.

10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.

Report an error

The DevOps Engineer

There is an admin audit log — API requests affecting networks, members and account settings, from both the dashboard and the public API — with retention stated per plan at 30 days, 90 days on Enterprise and custom on Quantum, plus webhooks on network, member and organization events. The vendor is admirably clear about what it cannot see: root relays cannot decrypt traffic and see only routing metadata, and there is no vendor monitoring dashboard — you build your own Prometheus and Grafana stack from ten documented per-node metrics. What I miss for incident response is a connection log of who reached which resource from which device; the audit trail covers configuration, and we found no public information on log export, SIEM streaming, or security alerting. 15 6 5 16 4

Report an error

Deployment, API & administration

How this is scored

How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.

0 — No central administration; every client is configured by hand with no console.

3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.

5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.

8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.

10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.

Report an error

The DevOps Engineer

This is where it clicks for my team: a Terraform provider managing networks, members, identities and flow rules as code against the Central API, with service-account tokens and a multicloud quickstart, so policies live in Git. Client rollout is covered by an Intune guide with silent MSI install and PowerShell auto-join, the agent and Central APIs are documented, webhooks exist, there is a self-hosted controller option and an air-gapped Enterprise edition, and support tiers with SLAs are stated per plan. The gaps are admin roles (admin seat counts and an owner-versus-administrator split rather than granular roles), no evidenced multi-tenant or MSP console, and the vendor itself notes some Central features are not yet in New Central. 18 5 17 6 16 15

Report an error

Architecture, reliability & security assurance

How this is scored

How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.

0 — Nothing is published about how the product works or is secured.

3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.

5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.

8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.

10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.

Report an error

The DevOps Engineer

The security page is the kind of disclosure I ask vendors for: Curve25519 device identities with private keys that never leave the device, end-to-end encryption, a published Trail of Bits review of the protocol and cryptographic design from March 2020, a SOC 2 Type II examination with the report available via a trust centre, CVE publication, a security contact, and an explicit statement that root servers cannot decrypt relayed traffic though they see addresses and timing. Client source is open on GitHub and the platform runs a distributed data plane. Working against a higher score: the docs state forward secrecy is not currently provided (the Quantum platform with ML-KEM and CNSA 2.0 is a separate product), the 2020 audit is dated, ISO 27001 and DORA are marked coming soon, and we found no public information on bug bounty scope, control-plane high availability, or what happens to live connections during a vendor outage. 4 13 6 2 3

Report an error

European sovereignty

How this is scored

Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.

0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.

5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.

8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.

10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.

Report an error

The DevOps Engineer

The contracting party is ZeroTier, Inc. of San Francisco as owner and data controller, with ZeroTier Europe B.V. in Utrecht acting as GDPR representative and the Dutch Data Protection Authority named for complaints; the DPA puts Dutch law on the standard contractual clauses. Subprocessors are listed at trust.zerotier.com with 14 days' notice of changes, data is encrypted at rest with AES-256, and return-or-delete terms are published at 60 days. But we found no public information on where the control plane, accounts, identities or logs are hosted, and the traffic path runs peer-to-peer through the vendor's US-run root servers, so the chain of custody for metadata stays American; the self-hosted controller and air-gapped Enterprise edition are the customer's own chain. 9 10 8 6

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.

0 — No public prices at all; every customer is a sales call or a partner quote.

3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.

5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".

8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.

10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.

Report an error

The DevOps Engineer

The pricing page names every tier with per-device scaling: Personal free with 10 devices and one network, Essential with 10 included devices then $2.00 each, Scale with 100 included devices then $1.80 each, admin counts and audit-log retention per tier, and Enterprise sized for 500+ devices self-hosted and air-gapped — though the Enterprise price itself is not published. Billing terms are explicit: USD, net 30 invoiced in advance, non-refundable, auto-renewal with cancellation at least three days before term, taxes borne by the customer. What keeps me from computing a full annual cost: single sign-on is gated behind paid tiers, no monthly-versus-annual split is given, and we found no public information on the price of the self-hosted or Quantum licence. 6 8 14

Report an error

European sovereignty — proven facts

0 of 6 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Hosting location Not determined — uncited Report an error
Hosting options Not determined ⚠ unverified — uncited Report an error
Open source Not determined — uncited Report an error
Data processing agreement Not determined ⚠ unverified — uncited Report an error
Transfer impact assessment Not determined — uncited Report an error

Questions about ZeroTier

Is ZeroTier European?

No. whats-best.ai classifies ZeroTier as Rest of world.

Where does ZeroTier store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

Does ZeroTier have a free plan?

Yes. ZeroTier has a free plan, per the vendor’s page captured 5 Nov 2026.

What are the best alternatives to ZeroTier?

As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: ZeroTier alternatives.

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about ZeroTier? Tell us Report an error on this page

Sources (19)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage www.zerotier.com Checked 5 Nov 2026 Details →
  2. 2 Features page (platform) www.zerotier.com Checked 5 Nov 2026 Details →
  3. 3 Documentation docs.zerotier.com Checked 5 Nov 2026 Details →
  4. 4 Documentation (security) docs.zerotier.com Checked 5 Nov 2026 Details →
  5. 5 API documentation docs.zerotier.com Checked 5 Nov 2026 Details →
  6. 6 Pricing page www.zerotier.com Checked 5 Nov 2026 Details →
  7. 7 About page www.zerotier.com Checked 5 Nov 2026 Details →
  8. 8 Terms of service www.zerotier.com Checked 5 Nov 2026 Details →
  9. 9 Privacy policy www.zerotier.com Checked 5 Nov 2026 Details →
  10. 10 Data processing agreement (dpa) www.zerotier.com Checked 5 Nov 2026 Details →
  11. 11 Security / trust page trust.zerotier.com Checked 5 Nov 2026 Details →
  12. 12 Access model & connectivity — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  13. 13 Access model & connectivity — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  14. 14 Identity, access policy & device posture — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  15. 15 Logs, audit trail & incident response — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  16. 16 Logs, audit trail & incident response — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  17. 17 Deployment, API & administration — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  18. 18 Deployment, API & administration — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →
  19. 19 Architecture, reliability & security assurance — found from sitemap docs.zerotier.com Checked 5 Nov 2026 Details →