Tailscale
Tailscale US Inc. (Delaware) for contracts from 2024-09-03, before that Tailscale Inc. (Toronto) ·tailscale.com· As of: 2026-07-30
Our verdict
Identity-bound access does not sell a single product. No customer buys because a clean network runs in the background. Without this layer, however, a pile of debt grows out of VPN accounts, jump hosts and shared keys that nobody fully knows any more. That debt comes due the moment a larger customer sends a security questionnaire or a buyer asks to see who can reach what. The tool prevents a fall back, it does not create an edge.
Who it fits
Solo
suitable
The free tier covers up to 6 users, unlimited user devices and 50 tagged resources. For one person with a handful of servers that means no cost at all.
Mid-market
suitable
Eight US dollars per user per month is predictable, and user devices are not counted. The real ceiling is not the price but the limit of 10 access groups on the Standard plan.
Enterprise
suitable with caveats
The vendor holds SOC 2 Type II but no ISO 27001 of its own and offers no choice of an EU storage location. Anyone who needs processing confined to the EEA, or an ISO certificate held by the vendor itself, will not find that promised publicly.
Buy, switch or build
Off-the-shelf
Classic VPN with a concentrator and jump hosts
One central appliance or instance that all traffic passes through, with jump hosts behind it for the sensitive systems. That is proven, auditable and in many companies already paid for. The price is the topology: everything runs through a single point that is both bottleneck and failure point, and rights attach to a network segment rather than to a person. Removing someone means cleaning up in several places.
AI-native
No AI-native replacement, but a serious neighbour
There is nothing AI-native in this category, and none is to be expected, because the job is cryptography and rule sets, not language understanding. Anyone looking for alternatives will find them not among AI vendors but among the identity-aware access services of the large network providers and the access servers from the developer world. Those neighbours put a broker in the data path instead of connecting devices directly, which buys more control and more logging at the cost of latency and one more place that can see the traffic.
Build it yourself
WireGuard by hand or running Headscale yourself
The foundation is open source, so this can be rebuilt. Hand-managed WireGuard keys work across ten devices and turn into bookkeeping nobody volunteers for across a hundred. The serious build-it-yourself route is Headscale, an open-source reimplementation of the coordination server that keeps the official clients working. That leaves the control plane in your own house, which can be the only viable path under hard sovereignty requirements. The project explicitly describes its own scope as aimed at self-hosters and small organisations, though, and directory integration, account provisioning and being on call then land on you.
Our advice
- Solo: Take the free tier and retire the jump hosts.
- Mid-market: Buy. Count your servers and containers first, not your staff.
- Enterprise: Buy, but settle storage location, log retention and certificates in writing before signing.
Who is behind it
Staying power: Funded
Backed by a large venture round and a meaningful customer count, but with no public figures on revenue or profitability. That is a funded position, not demonstrated self-sufficiency.
- Funding: USD 160 million Series C led by Accel, announced on 08.04.2025 · Source · As of 2026-07-30
- Customer count per vendor: 10,000 customers, a figure given in the vendor's own funding announcement · Source · As of 2026-07-30
- Certification: SOC 2 Type II; no ISO 27001 and no business associate agreement under US health law, because by the vendor's own account only metadata are stored · Source · As of 2026-07-30
- Change of contracting entity: Accounts opened from 03.09.2024 contract with Tailscale US Inc., Delaware; older accounts continue with Tailscale Inc., Toronto · Source · As of 2026-07-30
- Maintenance of the subprocessor list: Public list of eight named subprocessors, last changed on 02.09.2025 · Source · As of 2026-07-30
Cost of leaving: Moderate
There is no content to export, because the vendor cannot see the traffic and holds only configuration and connection metadata. The client is open source, the protocol is WireGuard, and Headscale exists as an open-source reimplementation of the coordination server, which the vendor itself names as an independent community project. The expense is not moving data but two other things: the access rules have to be rewritten, and Headscale describes itself as aimed at self-hosters and small organisations, so it is not an equivalent substitute for a managed service.
Regulation and data
| Data processing agreement | in place, becomes part of the contract by referenceNo separately signed document is foreseen for self-serve customers. The addendum takes effect at the next payment period, at renewal, or with a new order form.Source · As of 2026-07-30 |
|---|---|
| Storage location | Canada, Germany, USA and United Kingdom, further countries reserved; no choice for the customerThe privacy policy names these countries explicitly and reserves further jurisdictions. Confinement to the EEA is nowhere promised.Source · As of 2026-07-30 |
| Subprocessors | eight named: AWS, DigitalOcean, Hetzner, Linode, Vultr, NetActuate, Snowflake, Jira Service ManagementThe list names purpose, data processed and region for each vendor. Changes are announced, with a ten-day objection window.Source · As of 2026-07-30 |
| Third-country transfer | transfers to the USA and other third countries, based on standard contractual clausesThe addendum makes the EU clauses part of the contract and applies module two or three as appropriate. A separate version covers the United Kingdom.Source · As of 2026-07-30 |
| Training on customer data | unclearNeither the privacy policy nor the security page states whether connection and configuration data are used to train models. The question is defused by the fact that the vendor cannot read traffic content, by its own account and plausibly so by design. It remains open for the metadata.no source given · As of 2026-07-30 |
| Retention and deletion | return or deletion on request within 30 days of contract end; retention during operation unclearThe privacy policy names no concrete period, only the principle of necessity. How long connection logs are kept during normal operation is not publicly documented.Source · As of 2026-07-30 |
| Certifications | SOC 2 Type II held by the vendor; no ISO 27001 and no business associate agreement under US health lawThe vendor justifies the absence of a healthcare agreement by storing only metadata rather than customer content. Certificates held by the data centres it uses are not the same as a certificate of its own.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | not applicable on our review, with no statement from the vendorThe tool is network infrastructure and contains no AI system in the sense of the regulation that would trigger the transparency duties under Article 50. We found no explicit vendor statement on this on the security, privacy or contract pages.no source given · As of 2026-07-30 |
| Audit logging | configuration audit log available; network flow logs and streaming to your own systems only on the Premium plan; retention period unclearThe pricing page assigns network flow logs and log streaming to the Premium plan. How long logs are retained, and whether that differs by plan, was not findable in the knowledge base.Source · As of 2026-07-30 |
What it really costs
Entry price
Free for up to 6 users with unlimited user devices, 50 tagged resources and 3 access groups. The Standard plan costs 8 US dollars per user per month, Premium 18 US dollars.
Source · As of2026-07-30
What gets expensive
Not on users, since laptops and phones are free and unlimited. The infrastructure is what costs: servers, subnet routers and app connectors count as tagged resources, 50 are included on every plan, and each further one costs 1 US dollar a month. Anyone running containers passes that line quickly. On top comes the minute pool for ephemeral resources such as build runners and Kubernetes pods: 1,000 minutes a month on Standard, 10,000 on Premium, and beyond that only by talking to sales. The second cost trap is the jump to Premium, which you make not for access itself but for 300 access groups instead of 10 and for the logs.
What it displaces
- VPN concentrator as a central gateway
- Jump hosts in front of sensitive systems
- Shared SSH keys and credentials
- Allowlists built on fixed IP addresses
Interfaces
- Connection to an identity directory with automatic account provisioning
- Access rules as a policy file you can keep under version control
- Admin API and command line interface
- Streaming the logs into your own analytics systems (Premium)
- Rollout through device management
At Convios: Not used by us
Not in use at Convios. This review rests entirely on publicly available vendor pages, not on our own operation.
Matching methods
Evidence
- 1.Plans, per-user prices, tagged resources, access groups and the minute pool · As of 2026-07-30
- 2.SOC 2 Type II, no access to traffic content, role of the coordination server · As of 2026-07-30
- 3.Change of contracting entity on 3 September 2024 per Schedule A, New York as governing law · As of 2026-07-30
- 4.Data processing addendum, standard contractual clauses, 72-hour breach notice, deletion within 30 days · As of 2026-07-30
- 5.Eight named subprocessors with purpose and region, as of 2 September 2025 · As of 2026-07-30
- 6.Processing in Canada, Germany, the United States and the United Kingdom, with no EEA-only commitment · As of 2026-07-30
- 7.Client open source, coordination server proprietary, Headscale an independent community project · As of 2026-07-30
- 8.Series C of 160 million US dollars led by Accel, 10,000 customers per the vendor · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.