Bowtie Private Access

Bowtie Private Access connects devices directly to private resources and adds policy-based web filtering and network segmentation. It suits organizations that want these controls together, especially those that need customer-held encryption keys and traffic that avoids Bowtie’s cloud. The free plan is tightly capped; Essentials is the practical starting point for a larger team.

Overview

Bowtie uses WireGuard to establish encrypted connections between devices and private resources without routing traffic through a middleman network. Access policies can grant authenticated access according to user or device characteristics. This makes it a fit for teams that need controlled private-resource access rather than a general-purpose consumer VPN.

Encryption keys are generated and stored in the customer’s environment, and traffic does not pass through Bowtie’s cloud. Bowtie also combines private access with on-device web filtering and policy-based network segmentation, so organizations can manage more than private-resource connections through one policy engine.

Key features

The Zero Trust policy engine governs access using user or device characteristics. Device posture policies are included with Enterprise, so teams requiring that control should account for the plan boundary.

Bowtie Internet Access applies web filtering on the device rather than at a centralized gateway. Its segmentation engine can unify overlapping networks and segment them through policy. TCP, UDP and ICMP are supported, giving it scope beyond web-only application access.

Essentials adds API access and a Terraform provider, useful for teams automating deployment or connecting Bowtie to existing tooling. Enterprise adds MDM deployment through providers such as Jamf and Kandji, SIEM event logging, and priority support with an SLA and shared Slack channel.

SSO options include Okta and Entra ID, with configurations also described for GitHub, GitLab, SAML, AWS Identity Center and Google IDP. Basic includes SSO authentication, but its narrow user and device caps limit its usefulness for broad deployment.

Pricing

Basic: free, billed Free forever. It allows up to 3 users, 2 devices per user and 2 controllers, with the Zero Trust Policy Engine, always-on agent, Smart DNS and SSO authentication. It is a no-cost way for a very small team to start, but the caps make it unsuitable for a growing rollout.

Essentials: $11 a month, billed per user / month. It supports up to 1000 users, 3 devices per user and 4 controllers, and includes Private Access and Internet Access, API access, a Terraform provider, email support and community support. This is the clearest fit for teams needing both private access and filtering with room to grow beyond Basic’s limits.

Enterprise: custom pricing, with unlimited users, devices and controllers. It adds priority support with an SLA, MDM deployment, device posture policies and SIEM integration. Organizations that need those enterprise controls should expect custom pricing rather than Essentials’ per-user rate.

Platforms

Bowtie lists iOS, Linux, macOS, web and Windows platforms. Client downloads are provided for Mac, Windows and Linux. Access uses an agent, and the deployment model is hybrid.

Who it's for

Bowtie is best suited to organizations that want private-resource access, web filtering and network segmentation governed together, and value keeping keys in their own environment. Essentials fits teams of up to 1000 users that need automation and both access products. Basic is for small deployments within its strict caps; Enterprise is for organizations requiring unlimited capacity, posture policies, managed deployment or SIEM logging. Teams needing those Enterprise features but unwilling to adopt custom pricing should look elsewhere.

Pros and cons

• Pros: Direct encrypted connections and customer-held keys keep traffic off Bowtie’s cloud.
• Pros: Private access, on-device web filtering and network segmentation share policy controls, reducing the need to treat them as separate functions.
• Pros: Essentials includes API access and Terraform support, while Enterprise adds MDM and SIEM integration for more complex deployments.
• Cons: Basic’s 3-user, 2-devices-per-user and 2-controller limits are restrictive for teams beyond a small pilot.
• Cons: Essentials caps users at 1000 and controllers at 4, and allows only 3 devices per user.
• Cons: Device posture policies and SIEM integration require Enterprise, whose price is custom.

Alternatives

For a wider comparison, browse Zero Trust Network Access Software.

Choose Cloudflare Access if a free plan for under 50 users or a $7 a month pay-as-you-go plan better suits your budget and team size.

Twingate is worth comparing if its free Starter plan’s allowance of up to 5 users and 50 resources fits your deployment.

Consider NetBird if a free allowance of up to 5 users and 100 machines, or its €6 per user / month Team plan, better matches your scale and budget.

Boundary is another freemium option, with a free Community Edition and HCP Boundary Standard on usage-based custom pricing.

Choose Cloudflare Gateway if its free plan for 50 users with up to 24 hours of standard log retention, or its $7 a month pay-as-you-go tier, suits your web-access needs.

Pomerium offers a free Personal plan for 10 users, 10 routes, 5 policies and 2 service accounts, or a Business plan at $7 a month.

Consider OpenVPN CloudConnexa if its Starter plan’s 5 included seats suit your needs; its Essential plan is $7 a month.

Sangfor EasyConnect is another paid option.

Verdict

Bowtie is a strong choice for organizations seeking private access, web filtering and segmentation under one policy engine, with keys held in their own environment and traffic kept off Bowtie’s cloud. Essentials is the sensible choice for teams that fit its user, device and controller caps and want automation. Choose another product if Basic’s limits are too small, or if you need Enterprise posture, MDM or SIEM capabilities without custom pricing.