Twingate

What Twingate actually is

Twingate is zero trust network access (ZTNA) software, not a hosting provider — you buy it to replace a corporate VPN, not to rent servers. It sits in our private-networking category because it is the layer that decides who on your team can reach which internal resource. The company was founded in 2019 in Redwood City, California by Tony Huie, Alex Marshall and Lior Rozner (ex-Dropbox, Quartzy, Rakuten), raised a $17 million Series A at launch and a $42 million Series B in 2022, and is an established Series B vendor rather than a side project.

The architecture is the interesting part. Four components: a hosted Controller (the control plane), desktop and mobile Clients, lightweight Connectors you deploy inside each network, and a global Relay network for brokering connections. Connectors make only outbound connections, so you never open an inbound port or publish a bastion host. Users are authorized per Resource — a DNS name, private IP, or CIDR range you declare explicitly — rather than per network. Once authenticated, the client and connector negotiate a direct peer-to-peer path where possible, and every authorization decision is verified at the connector on every connection, not just at login.

One correction worth making because the internet repeats it constantly: Twingate does not use WireGuard. Their FAQ states the data transport is TLS v1.2 with standard ciphers, and that they are merely "monitoring" WireGuard for possible future adoption. Tailscale is the WireGuard-based one; Twingate runs its own stack on top of TLS. If your evaluation criteria include protocol choice, get this right before you compare.

Policy controls are granular and, in our view, the product's real strength. Access rules combine authentication requirements (re-auth frequency, MFA including WebAuthn), device posture (disk encryption, minimum OS version, MDM/EDR integrations), location allowlists and denylists (Enterprise), and time-bound or usage-based access, including just-in-time access requests. Provisioning and deprovisioning flows through your identity provider — Okta, Entra ID, JumpCloud, Google Workspace, Keycloak and OneLogin are supported with SCIM on the higher tiers — so when someone leaves the company, their access dies with the IdP account instead of lingering in a VPN config.

Pricing: what you really pay

Twingate's published plans are per-user, and there is a genuinely free tier: Starter costs $0 for up to 5 users, with 10 Remote Networks, 50 Resources, peer-to-peer connections, split tunneling and conditional access controls. For a small startup or a homelab this is enough to run production-grade access control at no cost, and it is not a trial.

Above that, Home is $15 per month flat for up to 7 users — non-commercial use only, aimed at homelab projects, with service accounts, exit networks and device posture checks. Teams is $5 per user per month billed yearly (the compare table lists $12 per user per month under monthly billing) and lifts the account to 100 users, 20 Remote Networks and 100 Resources, adding Google Workspace SSO, SaaS application gating, device posture and automated least-privilege policies. Business is $10 per user per month billed yearly (again $12 per user per month monthly in the compare table), caps at 500 users and 100 Remote Networks / 300 Resources, and adds IdP-driven user provisioning, Okta and Entra ID SSO with SCIM, endpoint integrations, secure service accounts, usage-based and just-in-time access policies, exit networks and DNS filtering. Enterprise is quoted: custom account sizes, custom MSA and SLAs, geoblocking, static IPs, privileged access for Kubernetes, SSH and databases, and priority support.

Read the caps, not just the per-seat price. A 20-person engineering team on Business at $10 per user per month billed yearly pays $200 per month — but if that team organizes work into more than 100 Remote Networks or exposes more than 300 Resources, the plan limits are the binding constraint, not the budget. The yearly-vs-monthly gap (a 15 percent annual discount, with the compare table showing $12 per user per month billed monthly on both Teams and Business) is wide enough that we would commit yearly once the evaluation is over. Fourteen-day trials exist on all paid plans; no credit card is needed for Starter.

What you do not pay for is infrastructure. Relays, the control plane, and the management console are included in every tier. Add-ons exist at the top end (DNS filtering and static IPs are flagged as add-ons on Enterprise), so treat Enterprise quotes as negotiable bundles.

Performance & infrastructure

Connections are peer-to-peer by default: once the client and connector find each other, traffic takes the direct route and does not hairpin through Twingate's network. Relays are the fallback when NAT traversal fails, and Twingate publishes the design: relay clusters run on Google Cloud, each location holds multiple relays for redundancy, and a failed cluster fails over to the next nearest one. The compare table lists 12 global relay locations on the lower tiers and 21 on the Premium relay tier that Business and Enterprise get. The status page breaks the network into Americas, EMEA and APAC relays, and it is public and component-level — data plane, DNS filtering, management plane, IdP sync and API tracked separately.

On raw speed, Twingate claims up to 86 percent faster than traditional VPN and 99.99 percent reliability. We treat vendor benchmarks as claims, not measurements — we have not run Twingate through our own tests, and we would point anyone comparing tunnels at our /benchmarks methodology rather than at marketing pages. What we can say architecturally: avoiding a central VPN gateway removes the chokepoint that makes legacy VPNs slow for distributed teams, and TLS-based transport with end-to-end encryption between client and connector means relay operators see only encrypted hops.

Data handling is documented, which we weigh heavily in this category. Relays do not store traffic or network-identifiable information; the controller never sees your traffic because connectors independently verify every authorization. The company maintains a trust center with SOC 2, GDPR, HIPAA, PCI and DORA compliance documentation, and a public post-mortem culture on incidents — the kind of operational honesty that is worth more than a uptime-percentage slide.

IPv4 and IPv6 are both supported in the data plane, which matters if your internal resources are IPv6-native.

Where it falls short

The control plane is a SaaS dependency. Your access policy lives on Twingate's servers; if their management plane is unreachable you cannot change policy or onboard users until it returns. Existing connections are designed to keep working — connectors verify authorization independently — but philosophically, you are trusting a third party with the root of your access control. Teams with hard requirements for fully self-hosted policy servers should look at open-source alternatives and accept the extra operational load that comes with them.

This is also not an internet VPN and not a perimeter product. Twingate protects named resources you declare; anything you forget to declare is unreachable, which is the point, but it means resource inventory discipline is on you. There is no blanket "give this user the whole subnet" experience on lower tiers in the way a traditional VPN offers, and clients expect per-resource authorization flows.

Costs scale per user, which punishes organizations with many contractors or seasonal staff relative to appliance-based licensing. And while the Starter tier is generous, its 50-Resource and 10-Network caps mean a growing team will land on Teams or Business quickly — $5 to $10 per user per month billed yearly is fair for what it replaces, but it is a real line item at 500 users.

Finally, some of the features security teams ask about most are paywalled high: geoblocking, static IPs and privileged access for Kubernetes, SSH and databases are Enterprise-only, and DNS filtering is an add-on even there. If those are day-one requirements, negotiate before you deploy.

Who should pick this

Our pick for engineering organizations retiring a legacy VPN: teams with cloud and on-prem resources, a real identity provider, and a workforce that expects remote access to just work. The deployment story is unusually good — Docker, Terraform and Helm are all first-class, the API is documented, and infrastructure-as-code providers exist for Terraform and Pulumi — so platform teams can manage access as code instead of as tickets. Homelab and small-team users should start on the free Starter plan and never look back; the $15 per month Home plan is a fair way to support the product once you outgrow it.

We would look elsewhere when you need a consumer-style internet VPN (this is not one), when policy must be fully self-hosted for compliance or philosophical reasons, or when your primary need is network-wide access rather than per-resource least privilege. Tailscale and Cloudflare Access are the usual comparison set, and the honest differences are protocol choice, resource-level policy granularity, and how much you want the vendor's control plane in your trust boundary.

Key takeaways

• ZTNA that replaces corporate VPNs: per-resource access with outbound-only connectors, no open inbound ports, peer-to-peer connections where NAT allows.
• Not WireGuard — Twingate's data plane is TLS v1.2 with standard ciphers; that rumor traces to comparisons with Tailscale.
• Starter is genuinely free for up to 5 users (10 networks, 50 Resources); Teams $5/user/mo and Business $10/user/mo billed yearly, with monthly billing listed at $12/user/mo.
• Policy depth is the standout: device posture, WebAuthn MFA, SCIM provisioning, just-in-time and usage-based access — with the sensitive features mostly on Business and Enterprise.
• Reliability work is visible: public component-level status page, relay redundancy on Google Cloud across Americas/EMEA/APAC, published incident write-ups; contractual SLAs are Enterprise-only.
• Trust boundary is the trade-off: policy lives on a SaaS control plane. Fine for most teams, disqualifying for fully self-hosted mandates — see related tooling in /category/private-networking.

Sources

• https://www.twingate.com/pricing
• https://www.twingate.com/docs/faq
• https://www.twingate.com/docs/architecture
• https://www.twingate.com/docs/understanding-relays
• https://www.twingate.com/product/ztna
• https://status.twingate.com/
• https://techcrunch.com/2020/10/28/twingate-series-a
• https://www.crunchbase.com/organization/twingate