Mesh VPNs and private networks
Twingate privacy rating
Hosted zero-trust remote access service that connects devices to private resources through connectors on the customer's network, managed from Twingate's cloud controller.
Summary
Twingate scores 24 out of 100 (grade F) on the mesh VPNs and private networks criteria. It meets 1 of 7 criteria: keys stay on devices. It partly meets no ads or data sales. It does not meet open source, no trackers or telemetry, self-hosted coordination server and no connection logs by default. Still needing evidence: independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.
Score 24 out of 100. How scoring works
Criteria
-
No
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The clients, connectors and controller are closed source.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website uses Google Analytics and advertising cookies.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans with no ads in the product, though website data is shared with ad partners for Twingate's own retargeting.
-
Unknown
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Needs evidence. Add it
-
Yes
Keys stay on devices Weight 3 of 3
Is traffic encrypted between devices with private keys created on each device, so the coordination server and relays cannot read it?
The client creates the session key and connectors create their own key pairs. Relays and the controller cannot decrypt traffic.
-
No
Self-hosted coordination server Weight 2 of 3
Can the coordination or control server be self-hosted with open-source software?
The controller is only offered as Twingate's hosted service.
-
No
No connection logs by default Weight 2 of 3
Are connection logs and client diagnostic logs kept off the vendor's servers unless a user or admin turns them on?
Network events for traffic through connectors are kept by Twingate for 24 hours to 12 months depending on the plan, with no documented way to turn them off.