Cloudflare One vs Pangolin
Cloudflare One
cloudflare.comPangolin
pangolin.netSide by side
| Figure | Cloudflare One | Pangolin |
|---|---|---|
| Price from | $7/mo | $4/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | Yes |
| Android | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 3 | 5 |
| Spec score · Secure Access Service Edge Software | 8.7 (#4) | 8.9 (#1) |
| Client platforms | The Cloudflare One Client has stable releases for Windows, macOS, Linux, iOS, Android, and ChromeOS. | Pangolin lists clients for macOS, Windows, Linux, iOS, and Android; the downloads page specifies macOS Sonoma 14.0+, Windows 10+, iOS 17.0+, and Android 7.0+. |
| Identity integrations | Cloudflare One supports all SAML and OIDC identity providers and can integrate with the majority of OAuth providers. | Pangolin supports OAuth2/OIDC providers such as Authentik and Keycloak, plus Google and Microsoft Entra ID integrations on Cloud and Enterprise Edition. |
| Support | Free plans include community forums and Discord support, pay-as-you-go plans include chat and ticket support, and contract plans include phone, chat, and ticket support. | The FAQ says community users can ask for help in Slack or Discord, paid Cloud and Enterprise plans include vendor support, and Enterprise includes priority support and an SLA. |
Plans
Cloudflare One
- Free PlanFree
- Pay-as-you-go$7 a month
- Contract PlanPrice not published
Pangolin
- BasicFree
- Community EditionFree
- Team$4 a month
- Business$9 a month
- EnterprisePriced on request
In their own words
Cloudflare One
Cloudflare One is a SASE platform for connecting and protecting an organization's workforce, AI agents, and infrastructure. It brings together zero trust access, secure web gateway, CASB, network-as-a-service, firewall-as-a-service, remote browser isolation, DLP, email security, and digital experience monitoring. Internal application access uses identity-first controls and granular rules. DNS and HTTP filtering protects remote users and branch offices, while a private global backbone connects offices, clouds, and datacenters. AI controls provide visibility into generative AI usage, identify unsanctioned tools, secure MCP-server connections, and can assess prompt intent to block sensitive data leakage. Email protection addresses phishing, impersonation, malware, and business email compromise. Management is centralized through a dashboard, API, and Terraform provider. The free plan covers up to 50 users and up to 24 hours of standard log retention, with community forums and Discord support. Pay-as-you-go is $7/user/month, with no user limit and up to 30 days of standard log retention. Contract pricing is not listed.
Pangolin
Pangolin combines a WireGuard-based VPN, reverse proxy, privileged access management, and identity-aware AI Gateway in an open-source security and networking platform. Administrators use identity and resource-level policies to grant users access to specified apps, hosts, and network ranges. WireGuard tunnels and NAT traversal let connected sites keep inbound firewall ports closed. The AI Gateway routes provider-native API requests to cloud and self-hosted models, with identity controls, budgets, session history, and usage analytics. Listed integrations include OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Vertex AI, Microsoft Foundry, OpenRouter, Vercel AI Gateway, Ollama, and vLLM. Pangolin offers Cloud and self-hosted options, with clients for macOS, Windows, Linux, iOS, and Android. The free Basic plan supports up to 5 users, 5 sites, 5 domains, 15 public resources, 15 private resources, and 5 machine clients. Team costs $4/user/mo; Business costs $9/user/mo. A 10-day trial is listed.