Twingate Review 2026: Free for 5 Users, $5 Seats and the Fine Print

Quick verdict

• Best for: small and mid-sized technical teams that want to retire a legacy VPN and grant access per app, server or database instead of per network.
• Price: Starter is free for up to 5 users. Teams is $5 per user per month, Business is $10 per user per month, Home is a flat $15 per month for non-commercial use, and Enterprise is quoted by sales.
• Architecture: end-to-end encrypted, peer-to-peer first with Relays as fallback, and a hosted Controller that never touches your data flow.
• Not for: anyone shopping for a consumer privacy VPN. Twingate is split-tunnel by default and does not hide your IP for general browsing.
• Watch out for: 24-hour logs on the free plan and 7-day logs on Teams, no refunds on paid terms, a pricing page that contradicts itself on yearly prices, and a May 28, 2026 authorization outage.

How Twingate works

Twingate is built from four components: the Controller, Clients, Connectors and Relays. The Controller is a Twingate-hosted, multi-tenant service that holds your configuration and decides who may reach what. According to Twingate's own architecture docs, it is "the only component that does not interact with any data flow".

Connectors are the piece you run. You deploy them inside each private network you want to expose (on Linux, in Docker or in a cloud account), and they sit in front of the Resources you define: a database, an internal dashboard, a Git server, an SSH host. Clients run on your users' devices and only ever see the Resources their policies allow.

When a user opens a Resource, "Twingate always attempts to establish a peer-to-peer connection between the Client and Connector", and Relays are used as a backup when a direct path cannot be made. The peer-to-peer transport uses QUIC, which supports only TLS 1.3 and later. Twingate says Relays "do not store any traffic or network-identifiable information" and that no data-carrying connection is terminated at a Relay.

Encryption is end to end between the Client and the Connector. The docs state that nothing in between, Relays included, can decrypt packets, because they are encrypted with a session key generated by the Client and shared with the Connector.

Split tunnel by default, full tunnel with Exit Networks

By default Twingate is split-tunnel: in the docs' words, "only traffic destined for Resources goes through Twingate". Everything else, including normal web browsing, leaves through the device's regular internet connection. That is the right design for remote access, and it also means Twingate is not a privacy VPN out of the box.

Exit Networks are the full-tunnel option. They route all of a device's internet traffic through an exit you choose, which is useful for a fixed egress IP, inspection or travel. They launched on October 30, 2024 as an Enterprise-only feature, and the docs now say they "are only available on certain plans (Home, Business, Enterprise)". Teams and Starter do not get them.

Relay coverage also depends on the plan. Starter, Home and Teams use 12 Global Relay Network locations at the Basic performance tier. Business gets 21 locations at Standard, and Enterprise gets 21 at Premium. Because Relays are only the fallback path, this matters most for users behind restrictive networks where peer-to-peer fails.

Twingate pricing and plans in 2026

Twingate's pricing page lists five plans. Here is what each one includes, with limits taken from the page's comparison table.

• Starter - Free: up to 5 users, 1 admin, 50 Resources and 10 Remote Networks. Includes peer-to-peer connections, split tunneling and conditional access controls. Logs are kept for 24 hours.
• Home - $15 per month flat: up to 7 users, 1 admin, 100 Resources and 20 Remote Networks. Adds Secure Service Accounts, Exit Networks, native device posture checks and MFA for bastion hosts and SSH. It is "Limited to non-commercial use", so it is a homelab plan, not a small-business plan.
• Teams - $5 per user per month: up to 100 users, 3 admins, 100 Resources and 20 Remote Networks. Adds SSO via Google Workspace, SaaS application gating, native device posture checks, MFA for SSH and automated least-privilege policies.
• Business - $10 per user per month (labelled Most Popular): up to 500 users, 10 admins, 300 Resources and 100 Remote Networks. Adds user provisioning through your IdP, SSO via Okta, Entra ID and others, endpoint integrations, secure service accounts, usage-based and just-in-time access policies, and Exit Networks. DNS filtering is a paid add-on.
• Enterprise - custom pricing: custom account sizes, custom MSA and SLAs, pay by invoice, geoblocking, Exit Networks, Privileged Access for Kubernetes, SSH, databases and web apps, and priority support. DNS filtering and static IPs are add-ons.

Every plan except Enterprise allows 5 devices per user. Home, Teams and Business each offer a 14-day trial.

One more caution: several answers in the pricing-page FAQ look like placeholder text (a billing question is answered with a line about setup taking 15 minutes). For billing and refunds, rely on the Terms of Service, covered below.

What changed in 2026

Twingate shipped steadily this year, and most of it pushes the product from network access toward privileged and audited access. From the public changelog:

• March 10: Authentication Audit Logs.
• May 5: Privileged Access for SSH.
• June 17: a waitlist opens for a native Windows Connector. Connectors still run on Linux, Docker and cloud platforms today.
• July 1-10: a Billing Admin role (July 1), a dedicated Twingate IP block announced July 2 and effective July 10, and Resource Exclusions (July 9).
• August: a Helpdesk role (August 13), Privileged Access for Web Apps over HTTP (August 14), and a move of all admin consoles to the regional shard us1 on August 29, with console URLs becoming <network>.us1.twingate.com.
• September 15: AI Usage Overview in DNS filtering, which shows which AI services your users reach.
• October: an Internet Security admin role (October 7) and HTTPS support for Privileged Access for Web Apps (October 15).

That builds on 2025, which brought Geoblocking (January 3), Privileged Access for Kubernetes and a generally available Kubernetes Operator (June 26), Multi-Account Support (September 1), JIT Access Requests (October 22) and Linux userspace networking (December 11).

AI-agent access is not shipped. The Identity Firewall docs mention "future support for database protocols and Model Context Protocol (MCP)", and database support is listed as early access on the pricing page. Treat MCP as roadmap, not a feature you can buy today.

Apps and platform support

Twingate has clients for macOS, Windows, Linux, iOS, Android and ChromeOS. The Windows and Linux clients can also run headless, which is how service accounts connect CI runners and servers without a logged-in user.

Two limits are worth planning around. Clients older than 12 months are not supported and will not connect, so managed fleets need a regular update cycle. And DNS filtering and DNS-over-HTTPS only work on the macOS, Windows and Linux clients, not on phones or Chromebooks.

On the connector side, there is still no native Windows Connector; it has been waitlist-only since June 17, 2026. Windows-only shops will need a small Linux VM or a Docker host to run one.

The iOS app was updated to version 2026.279 on October 15, 2026 and is rated 4.38 on the US App Store, though that average comes from only 34 ratings.

What Twingate logs and how it handles your data

Twingate does not store the contents of your traffic. Its customer-data page says "content data is not stored by Twingate" and that, because of end-to-end encryption, it has no visibility into the unencrypted contents.

It does keep network and connection activity logs, and how long depends on the plan. The pricing page lists the minimum log storage period as:

• Starter: 24 hours
• Home: 30 days
• Teams: 7 days
• Business: 30 days
• Enterprise: 12 months

Yes, the flat-rate Home plan keeps logs longer than the paid-per-seat Teams plan. That is what the page says. If you need a longer audit trail on Teams or Business, the comparison table also lists syncing logs to an S3 bucket and to a SIEM.

DNS filtering is the bigger data trade-off. When it is on, Twingate collects and logs the domain names users try to reach, along with the time, the user's identity and details about the device. That data is stored on US servers, some of them run by vendors such as Google Cloud. Separately, session recording in the Identity Firewall product, which runs on customer-deployed Gateways, lets a customer capture the contents of communications. That is a choice the admin makes, not a default.

Twingate's privacy policy (last updated September 28, 2026) covers its websites and service accounts. It lists device identifiers, browser and OS versions, IP address, ISP and carrier name and signal strength; usage data such as bandwidth and when and for how long you use the service; and location derived from IP address, GPS or other device sensors. It shares online identifiers, cookie and device identifiers and IP addresses with advertising partners for its websites and ads. Data is kept for as long as needed to provide the service or as long as you have an account.

Security and compliance

Twingate has a SOC 2 Type 2 report. Existing customers request it through trust.twingate.com, and access to the report expires after 30 days. We could not confirm other certifications because the trust centre only renders in a browser, and the HIPAA, PCI, GDPR and DORA pages in the docs are compliance guides, not certifications.

Security issues are reported by email to security [at] twingate.com, and Twingate says it aims to resolve critical issues within 5 business days of disclosure. We found no paid bug bounty and no public penetration-test report. We also found no reported security breach, acquisition or new funding in 2025 or 2026.

On the business side, Twingate announced a $42 million Series B led by BOND. The post is undated on its own blog; the third-party database Tracxn dates the round to April 14, 2022 and puts total funding at $67 million.

Billing, cancellation and refunds

Twingate's Terms of Service (version date April 22, 2024) are strict on money. The key clauses:

• Auto-renewal (section 3.1): subscriptions renew for the same term until you cancel on the billing page or give written notice at least 30 days before the renewal date.
• No refunds (section 3.2): "payment obligations are non-cancelable and Fees paid are not refundable (including for any unused portion of a Subscription Term)". The only exception is termination for Twingate's material breach, which refunds unused fees.
• Price changes (section 3.6): Twingate must give at least 30 days' written notice, and a new price applies no earlier than your next renewal.
• Free plans (section 4.1): Twingate may end a free subscription with or without notice, including for account inactivity.
• Liability (section 12.3): for free, trial and beta services, Twingate's liability is capped at US$100.

Reliability: the 2026 incident record

Twingate's status page shows two notable incidents this year, both in May.

On May 28, 2026, an incident marked critical: "Twingate experienced a degradation of its Authorization service that affected approximately 15% of active connections at peak impact." The postmortem gives the window as 10:00-12:30 UTC, while the status history runs from 09:24 to 17:27 UTC, a span that includes the monitoring period.

Earlier in May, a configuration error broke Relays on port 443 for about 2 hours and 10 minutes. The postmortem dates it May 9, 2026; the status history lists May 8, 08:44-10:55 UTC. Separately, Linux package downloads were down on July 8-9 (rated minor). The status page lists no incidents in September or October 2026, only scheduled maintenance.

The May 28 incident shows the trade-off of a hosted Controller: authorization runs through Twingate's service, so a problem there can affect connections even when your own Connectors are healthy. Custom SLAs are only offered on Enterprise.

Twingate vs Tailscale

Tailscale is the obvious alternative for small technical teams, and we cover it in our separate Tailscale review. On headline pricing:

• Free tier: Twingate Starter covers up to 5 users; Tailscale is "$0 for up to 6 users".
• Entry paid tier: Twingate Teams is $5 per user per month; Tailscale Standard is $8 per user per month.
• Upper paid tier: Twingate Business is $10 per user per month; Tailscale Premium is $18 per user per month.
• Trials: Twingate offers 14-day trials on Home, Teams and Business; Tailscale offers a 14-day Enterprise trial.

The tiers do not map one to one, so compare features, not just price. The bigger difference is the model. Tailscale builds a mesh between the devices you install it on. Twingate puts a Connector in front of each network and grants access per Resource, which suits teams that want to expose specific internal apps without installing an agent on every server. If you are also weighing a full SASE platform, our Perimeter 81 review covers that end of the market.

Who should use Twingate, and who shouldn't

Pros

• Generous free plan for up to 5 users and 50 Resources.
• Low per-seat prices: $5 on Teams and $10 on Business.
• End-to-end encryption, peer-to-peer by default, and a Controller that never touches data.
• Per-Resource access with device posture, MFA and JIT policies on paid plans.
• Fast-moving product: Privileged Access for SSH, Kubernetes and web apps, plus AI usage visibility.

Cons

• Short log retention on Starter (24 hours) and Teams (7 days).
• No refunds, including for unused time on an annual plan.
• Contradictory yearly pricing on the pricing page.
• No native Windows Connector yet.
• A critical authorization incident on May 28, 2026, and custom SLAs only on Enterprise.
• DNS filtering is a paid add-on and only works on desktop clients.

Twingate fits a startup or IT team that wants to replace a VPN with least-privilege access to internal tools, and a homelabber who is happy with the $15 Home plan's non-commercial limit. It is a poor fit if you need a consumer privacy VPN, long audit logs on a small budget, or a Windows-only infrastructure today.

Frequently asked questions

Is Twingate free?

Yes, the Starter plan is free for up to 5 users, 50 Resources and 10 Remote Networks with one admin. Logs are kept for only 24 hours, and Twingate's terms allow it to end free accounts, including for inactivity.

How much does Twingate cost per user?

Teams costs $5 per user per month and Business costs $10 per user per month. Home is a flat $15 per month for up to 7 users and non-commercial use only, and Enterprise is quoted by sales. The page advertises 15% off for yearly billing but shows a conflicting $12 yearly figure, so confirm the price at checkout.

Does Twingate hide my IP address like a normal VPN?

No, not by default. Twingate is split-tunnel, so only traffic to your Resources goes through it. Full-tunnel routing through Exit Networks is available on the Home, Business and Enterprise plans.

Can Twingate see my traffic?

No, it cannot read the contents. Traffic is encrypted end to end between the Client and your Connector. Twingate does log connection activity for between 24 hours and 12 months depending on plan, and DNS filtering logs the domains users visit along with user and device details.

Can I get a refund from Twingate?

Generally no. The terms say fees are not refundable, including any unused part of a subscription term, except when you terminate for Twingate's material breach. Cancel at least 30 days before your renewal date to avoid another term.

Does Twingate work on Windows?

The Windows client works, including in headless mode for service accounts. A native Windows Connector is not available yet and has had a waitlist since June 17, 2026, so Connectors run on Linux, Docker or cloud platforms.

Can a small business use the $15 Home plan?

No. The Home plan is limited to non-commercial use. A small business should start on Starter (up to 5 users) or Teams at $5 per user per month.

Key takeaways

• Twingate is a zero-trust remote-access product, not a consumer privacy VPN: it is split-tunnel by default, with full-tunnel Exit Networks on Home, Business and Enterprise.
• Starter is free for 5 users; Teams is $5 and Business $10 per user per month; Home is $15 per month for non-commercial use.
• Traffic is end-to-end encrypted and peer-to-peer first, but connection logs are kept from 24 hours (Starter) to 12 months (Enterprise), and DNS filtering logs domains per user.
• Fees are non-refundable, including unused annual time, and you must cancel at least 30 days before renewal.
• A May 28, 2026 authorization incident hit about 15% of active connections at peak; no incidents are listed for September or October.
• Confirm the yearly price at checkout: the pricing page's -15% badge and its $12 yearly cell do not agree.