Mesh VPNs and private networks
Tailscale privacy rating
Our pick
Mesh VPN built on WireGuard that connects devices into a private network using a hosted coordination server for key exchange and access control, with open-source clients.
Summary
Tailscale scores 50 out of 100 (grade D) on the mesh VPNs and private networks criteria. It meets 1 of 7 criteria: keys stay on devices. It partly meets open source, no ads or data sales, independent audit, self-hosted coordination server and no connection logs by default. It does not meet no trackers or telemetry. It is based in Canada: Five Eyes member.
Score 50 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The client daemon is BSD-3-Clause, but the Windows, macOS and iOS GUIs and the hosted coordination server are closed source.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website uses third-party analytics and advertising cookies, and client logging is on by default with an opt-out.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans with no ads in the product, though the website shares cookie data with ad partners for Tailscale's own marketing.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Latacora conducts regular security audits, but the reports are only available on request.
-
Yes
Keys stay on devices Weight 3 of 3
Is traffic encrypted between devices with private keys created on each device, so the coordination server and relays cannot read it?
Each device creates its own WireGuard key pair. The private key never leaves the device, and DERP relays only forward encrypted packets.
-
Partial
Self-hosted coordination server Weight 2 of 3
Can the coordination or control server be self-hosted with open-source software?
Tailscale's coordination server is closed source. The clients can use the open-source, community-maintained Headscale server instead.
-
Partial
No connection logs by default Weight 2 of 3
Are connection logs and client diagnostic logs kept off the vendor's servers unless a user or admin turns them on?
Clients send logs to Tailscale by default, including connection open and close events. The --no-logs-no-support flag or TS_NO_LOGS_NO_SUPPORT turns this off.