Cloudflare Zero Trust vs ConnectaSec: which ZTNA solution fits your business?
Cloudflare Zero Trust is one of the most complete Zero Trust platforms on the market, and its Free plan lets you start at no cost for up to 50 users. ConnectaSec is a much more focused ZTNA platform, built for SMBs and MSPs that want to replace their VPN without designing and running their own architecture. The two solutions answer different priorities. This article compares them honestly, using data verified against Cloudflare's official documentation (September 2026), so technical teams can decide with confidence.
The idea behind ConnectaSec is simple: Zero Trust without having to build your own Zero Trust.
Two different models, not a big one and a small one
Cloudflare Zero Trust (part of Cloudflare One) is an SSE/SASE platform: Access (ZTNA), Gateway (Secure Web Gateway and DNS filtering), DLP, Browser Isolation, CASB, a global network and a huge API and automation ecosystem. Its flexibility is its great strength; that same breadth can also mean a steeper learning curve for some teams.
ConnectaSec focuses on one specific problem: giving secure access to a company's internal resources (servers, NAS, ERP, remote desktops) by applying Zero Trust in a linear way:
create customer → gateway → resources → users/groups → policy → endpoint → connect
It then adds what an SMB or MSP usually needs around it: device posture with automatic quarantine, EDR integrations, one year of logs, dedicated public IP and a multi-tenant portal.
What Cloudflare Zero Trust Free offers (verified)
- Up to 50 users at no cost. Beyond that, Pay-as-you-go or Contract plans (official pricing).
- Cloudflare Tunnel (
cloudflared): outbound connector, no open ports. - Cloudflare One Client (formerly WARP) for Windows, macOS, Linux, iOS, Android and ChromeOS, with private network routing.
- Access and Gateway, including DNS filtering and network rules.
- Device posture: first-party checks (OS version, disk encryption, firewall, domain joined, etc.) and integrations with CrowdStrike, SentinelOne, Microsoft Endpoint Manager (Intune), Kolide, Tanium, Uptycs and Workspace ONE (docs).
- Clientless access to SSH, VNC and RDP from the browser in certain scenarios (browser-based RDP generally available since September 2025).
- Very mature API and Terraform provider.
- Log retention on Free: 24 hours for Access, DNS, network and HTTP logs; 30 days for device posture logs; 18 months for admin logs. Standard: 30 days; Enterprise: up to 180 days depending on log type (official table).
- Logpush (export to SIEM/storage) and dedicated egress IPs are tied to higher plans; check current terms with Cloudflare.
What ConnectaSec offers
- Gateway on the customer's network with outbound connections: no inbound ports need to be published. Each customer has its own environment and gateway, and two gateways can run in high availability with automatic failover.
- Microsegmentation by user, group, IP, network, port and service. Example: user A only reaches
192.168.1.20:3389and user B only192.168.1.30:445, without seeing the rest of the LAN. Groups such as Finance, Technicians, Suppliers or Management. - TCP and UDP traffic: RDP, SMB, SSH, HTTP/HTTPS, SQL, business applications and other services.
- Identity: Microsoft 365 / Entra ID integration; admin portal with MFA; device enrolment with a one-time token generated in the portal, and automatic cryptographic rotation.
- Configurable device posture: Windows update and patch level, antivirus, firewall, BitLocker/encryption, domain membership, disk space and other conditions, combinable into policies.
- Working EDR integrations: SentinelOne, Microsoft Defender and CrowdStrike.
- Risk detections such as port scanning and signals related to lateral movement, based on the defined policy. It is not a full IDS or EDR.
- Split tunnel and full tunnel: only selected resources go through ConnectaSec, or all of the user's internet traffic.
- DNS filtering able to block malicious and phishing content.
- Platforms: Windows, macOS, Linux, iOS, Android, QNAP and Synology.
- 365 days of logs (allow/deny, user, device, source IP, resource, port, posture and applied rule) plus audit-oriented reports.
- Alerts in the portal and by email.
- Access expiry: a supplier can have access until a given date and lose it automatically.
The key difference: posture + response
In both platforms, device posture can gate access. In Cloudflare, Access and Gateway policies deny access while the device doesn't meet the requirements. ConnectaSec treats it as a complete, reversible response:
Posture check → non-compliance detected → quarantine → remediation → compliance restored → access restored
Quarantine is rule-based. When the device complies again (for example, the firewall is re-enabled or the missing patch is installed), it leaves quarantine automatically and regains the access it's entitled to, with portal and email alerts along the way.
MSPs: deploying Zero Trust again and again
This is where ConnectaSec is most specialised. An MSP gets a multi-tenant portal to manage its customers, each with its own environment and gateway, and can onboard a new customer self-service, without manual intervention from ConnectaSec:
- Create the customer
- Deploy the gateway
- Create or import users
- Create groups
- Define resources
- Create policies
- Deploy endpoints
- Put the customer into production
Cloudflare also offers capabilities for partners and service providers (partner programme and Tenant API); its model leans towards more programmatic integrations. For an MSP that prefers a guided, repeatable process from a portal, ConnectaSec reduces the design work per customer. More in the MSP programme.
Internet egress with dedicated IP and location
ConnectaSec can route internet traffic through egress gateways with a dedicated public IP. The usual initial gateway is in Barcelona, and the infrastructure allows gateways to be deployed in around 30 locations (Europe, United States, South America, Japan, South Africa and other regions). Each dedicated IP currently maps to a dedicated egress node.
Typical cases: an employee abroad who needs to exit through Spain, an ERP or SaaS with an IP allowlist, services that only accept corporate IPs, or suppliers requiring a known public IP. On Cloudflare, dedicated egress IPs are available on higher plans; confirm terms and cost with their sales team.
Comparison table
| Feature | ConnectaSec | Cloudflare Zero Trust Free |
|---|---|---|
| ZTNA | Yes | Yes (Access) |
| Outbound connector, no open ports | Yes (gateway) | Yes (Cloudflare Tunnel) |
| Microsegmentation by IP/port/service | Yes | Yes (Access + Gateway rules) |
| Groups | Yes | Yes |
| Entra ID / Microsoft 365 | Yes | Yes (and many other IdPs) |
| Device posture | Yes | Yes |
| Windows patch level | Yes | Yes (OS version) |
| Firewall | Yes | Yes |
| Disk encryption | Yes | Yes |
| Domain joined | Yes | Yes |
| SentinelOne | Yes | Yes |
| Microsoft Defender | Yes | Via Microsoft Endpoint Manager (Intune) |
| CrowdStrike | Yes | Yes (requires Falcon Enterprise or above) |
| Automatic quarantine with recovery | Yes | Policy denies access while non-compliant |
| Lateral movement detection | Yes, per policy | Through policies and network rules |
| Alerts | Portal and email | Yes, depending on product and setup |
| Full tunnel / Split tunnel | Yes / Yes | Yes / Yes |
| TCP / UDP | Yes / Yes | Yes / Yes |
| Windows, macOS, Linux, iOS, Android | Yes | Yes (also ChromeOS) |
| QNAP / Synology | Yes | No native client; cloudflared can run as a connector |
| Clientless (browser) access | No | Yes, in certain cases |
| Customer gateway HA | Yes (2 gateways) | Multiple cloudflared replicas and global network |
| Automatic failover | Yes | Yes |
| Dedicated egress IP | Yes | Higher plans |
| Geographic egress | Yes | Higher plans |
| DNS filtering | Yes | Yes (Gateway) |
| Log retention | 365 days | 24 h (Access/DNS/network/HTTP) |
| Audit evidence | Yes | Dashboard logs and reports |
| Multi-tenant MSP portal | Yes | Partner programme / Tenant API |
| Self-service MSP onboarding | Yes | Via partner integrations |
| Public API | Not yet | Yes |
| Terraform | No | Yes |
| Generic SIEM export | In development | Logpush on higher plans |
| Access expiry | Yes | Yes (session durations and policies) |
| Recurring time windows | Coming soon | Check documentation |
| Price, 5 users | €65/month | €0 |
| Price, 20 users | €140/month | €0 |
| Price, 50 users | €290/month | €0 |
There is no overall "winner": the table shows two products with different scopes.
Pricing: free vs flat rate with service
Cloudflare Zero Trust Free costs €0 for up to 50 users. It's a real argument and there's no point hiding it.
ConnectaSec costs €5 per user per month (minimum 5 users, up to 5 devices per user) plus €40/month gateway per customer, no lock-in, flat rate:
Monthly cost = €40 gateway + (€5 × users)
- 5 users: €65/month
- 10 users: €90/month
- 20 users: €140/month
- 50 users: €290/month
The question isn't just licence cost, but who designs, configures, maintains and audits the solution. With Free, that work falls on your internal team. With ConnectaSec, the price includes every feature described, 365 days of logs and local support; the gateway is billed separately. Details on pricing.
When Cloudflare Zero Trust may be the better choice
- Your company already uses Cloudflare extensively.
- You need a broad SSE/SASE platform: advanced Secure Web Gateway, DLP, Browser Isolation or CASB.
- You run global infrastructure at large scale.
- You want intensive automation via API or Terraform (Infrastructure as Code).
- You need clientless browser access, for example for contractors who can't install software.
- Your internal team already knows Cloudflare.
- You're a small organisation willing to configure and run the Free plan in-house.
When ConnectaSec may be the better fit
- You're an SMB that wants to replace its VPN without building a complex platform (business VPN alternative).
- You're an MSP managing many customers and need repeatable deployments.
- You need 365 days of logs for audits.
- You want posture-based automatic quarantine with automatic recovery.
- You need a dedicated public IP or geographic egress.
- You value local support in Spain, in your language.
- You prioritise simple operations over a huge SSE platform.
Compliance: evidence, not guarantees
ConnectaSec is already used in contexts related to ENS, ISO 27001 and NIS2. Its 365 days of records and reports provide evidence for audit and compliance processes, but no tool guarantees compliance with a standard on its own. More context on NIS2 and the Spanish National Security Framework (ENS).
What ConnectaSec doesn't do yet
For the comparison to be useful, these are the current limitations:
- No RDP/SSH access from the browser without an installed client.
- No public admin API and no Terraform provider.
- Generic log export to SIEM (syslog, API or connector) is in development.
- Recurring time-window restrictions are coming soon.
- Each dedicated egress IP maps to a dedicated node; high availability keeping the same IP isn't offered today.
A hands-on comparison in progress
We're preparing a deployment test with a reproducible scenario: 20 users, one RDP server and one SMB NAS, with access only to authorised resources and the rest of the LAN blocked. We'll measure time to first access, number of steps and components configured, time to add a second user and time to deploy a second MSP customer. We'll publish results once measured; until then, no numbers.
Frequently asked questions
Is Cloudflare Zero Trust free?
Yes, the Cloudflare Zero Trust Free plan is free for up to 50 users. Beyond that there are Pay-as-you-go and Contract plans. Some features, such as Logpush or dedicated egress IPs, are tied to higher plans.
How long does Cloudflare Zero Trust Free keep logs?
According to the official documentation, the Free plan keeps Access, DNS, network and HTTP logs for 24 hours, device posture logs for 30 days and admin logs for 18 months. ConnectaSec keeps 365 days of access logs.
Is ConnectaSec an alternative to Cloudflare Zero Trust?
For secure remote access to internal resources, yes. It doesn't replace Cloudflare's full SSE/SASE platform (DLP, Browser Isolation, CASB); it focuses on ZTNA with posture, automatic quarantine, one year of logs and multi-tenant management for SMBs and MSPs.
Does ConnectaSec offer clientless browser access?
No. ConnectaSec currently requires the client to be installed on the device. If you need clientless RDP or SSH access, Cloudflare may be a better fit.
How much does ConnectaSec cost?
€5 per user per month (minimum 5 users, up to 5 devices per user) plus €40/month gateway per customer, no lock-in. For example, 20 users cost €140/month.
Does ConnectaSec guarantee ENS, ISO 27001 or NIS2 compliance?
No. ConnectaSec provides evidence for audit and compliance processes, but compliance depends on each company's overall technical and organisational measures.
How long would it take you to replace your VPN with Zero Trust?
Test it with your own scenario. Request a ConnectaSec demo or trial and we'll look at it with your real resources. Learn more about secure remote access, ZTNA and cybersecurity for SMBs.
Are you an MSP? Discover how to deploy and manage Zero Trust for multiple customers from a single portal in the MSP programme.