Twingate

Free allowance: Starter: 'Free per user / month', 'Up to 5 users'.
Verdict: fails: egressdata cannot be read back out at a usable rate or price
Cost: free tier
Identity: emailno card, no phone
Binding limit: request-rateThe only published meter is the 5-user cap, and the vocabulary has no token for an identity count; request-rate is the nearest. It is also moot: with no public ingress there is no 1 TiB/month to spend.
Evidence: documented2 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	Starter: 'Free per user / month', 'Up to 5 users'. unit users; metered on identity-count
Price	USD 0
Limits	request-rate (binding) The only published meter is the 5-user cap, and the vocabulary has no token for an identity count; request-rate is the nearest. It is also moot: with no public ingress there is no 1 TiB/month to spend. source
Identity	email a Twingate account at auth.twingate.com
Egress	No byte allowance is published; the plan is priced per user.; ingress: none free allowance: none published
Interface	cli the Twingate client on each device and the Connector in the private network
Tooling	Twingate client and Connector
Composes with	carries nothing on its own; it is a private access layer, so it composes with a public ingress rather than replacing one
Reliability	Relays carry traffic only when peer-to-peer fails, and the free plan is bounded by users rather than bytes
Notes	Fails the ingress test by design: every path needs a Twingate client and an ACL issued by the Controller. The Connector does proxy 'TCP and UDP traffic for protected Resources', which is why UDP appears in the product and still carries nothing to a public reader.
Evidence note	documented A live attempt to reach a Resource without the Twingate client would confirm the private-only claim.
Parsed numbers	has-free-tier 1 request-rate 1 TiB / month price USD 0

Evidence 2

date	source	what it proved
2026-10-23	www.twingate.com/pricing	Starter is 'Free per user / month' with 'Up to 5 users'
2026-10-23	www.twingate.com/docs/how-twingate-works	'The Connector is intended to be deployed behind the firewall of a private Remote network'; the client-to-connector path is a 'certificate-pinned TLS tunnel'

More fields 6

wg path	none
wg detail	No WireGuard. 'A user is responsible for establishing an encrypted tunnel with the appropriate Connector to access a protected Resource. This TLS tunnel is established based on the anonymous, unique Connector ID'. No .conf exists.
ingress	none
volume stated	No byte allowance is published; the plan is priced per user.
bytes transit	unknown
transit note	peer-to-peer between client and Connector where possible, with a Relay as backup

Unknown values 2