Tailscale

Tailscale is a WireGuard-based mesh VPN that creates secure peer-to-peer connections between devices. Four-tier per-user pricing with a generous free Personal plan. Platform extensions (PAM, CI/CD, workload connectivity, edge/IoT) and Aperture (AI governance) sold separately via sales contact.

Plans

Personal ($0, free forever) — Up to 6 users, unlimited user devices, up to 50 tagged resources, 3 ACL groups, 1,000 mins/month ephemeral resources, access to nearly all features including SSH and Kubernetes.

Standard ($8/user/mo) — Unlimited users, SCIM provisioning, 10 ACL groups, 1,000 mins/month ephemeral resources, MDM configuration, device posture integrations (MDM, EDR, XDR), advanced user roles.

Premium ($18/user/mo) — Everything in Standard plus 300 ACL groups, 10,000 mins/month ephemeral resources, just-in-time access, advanced Tailscale SSH, network flow logs, log streaming, regional routing/traffic steering, priority support.

Enterprise (Custom) — Everything in Premium plus custom device quantities/limits, Solutions Engineer consultation, custom MSA/SLAs, premium support with dedicated professional services, invoice billing, custom pricing/bundling.

Notes

Tailscale's pricing is notable for its generous free tier -- Personal plan gives access to "nearly all" features for up to 6 users, which is unusually permissive for a security product. Platform extensions (PAM, CI/CD, workload, edge/IoT) are sold separately as add-ons via sales, not included in any self-serve tier. Aperture, their AI governance product for AI agents and LLM usage, is a separate product line. Mullvad VPN integration available as a $5/mo add-on (per 5 devices). Ephemeral resource minutes (for CI/CD runners, K8s pods) are the key usage-based limit that differentiates tiers. Available on AWS, Azure, and GCP marketplaces.