NordLayer vs Tailscale

NordLayer

There are clients for Windows, macOS, Linux, iOS and Android plus a browser extension, shared and dedicated gateways across 40+ service locations, split tunnelling, custom DNS, always-on with a kill switch, and site-to-site links reaching AWS, Google Cloud and IBM Cloud. It is a gateway VPN rather than a mesh, though: the security help page states that no port-forwarding is provided and no incoming connections can go through, I found no public information on connectors running as containers, and the tunnel protocol is not documented — only AES-256 or ChaCha20 ciphers are named.

Tailscale

This is the model I want for sixty servers and two clouds: WireGuard peer-to-peer mesh with STUN/ICE NAT traversal so nothing needs an inbound port, DERP relays only as fallback, and subnet routers bridging whole subnets including site-to-site between cloud networks. Clients are listed for Windows, macOS, Linux, iOS, Android, Chromebooks and more, MagicDNS and split DNS are documented, the Kubernetes Operator covers clusters, and high-availability subnet routers with failover are written up. We found no public information on always-on auto-connect, clientless browser access for contractors, or post-quantum key exchange, so it stops short of the top end.

NordLayer

Single sign-on with Entra ID, Google, Okta, OneLogin and JumpCloud, SCIM provisioning that adds and removes members automatically, MFA by SMS or TOTP configurable centrally, and device posture checks feeding off CrowdStrike, SentinelOne and Jamf that block non-compliant devices and invalidate active sessions on an alert, plus a session duration timer with forced logout. I found no public information on just-in-time access with approval, or on policies kept in Git and applied with Terraform, which is what I need to review access rules as code.

Tailscale

Authentication is outsourced to your own OAuth2/OIDC/SAML provider with MFA inherited from it, SCIM group sync keeps access current, and policies are default-deny grants in one tailnet policy file I can drive through GitOps with GitHub or GitLab and the API. Device posture pulls pre-populated host facts plus synced EDR and MDM attributes (CrowdStrike is the worked example), just-in-time access is policy-file driven, and Tailscale SSH authorizes by tailnet identity instead of SSH keys — the shared bastion key can finally die. Terraform shows up for managing PAM resources rather than the whole tailnet, which is the one gap I care about.

NordLayer

The Activity section records connection sessions with devices and servers, admin actions, failed logins, download protection and visited domains, filterable and exportable as CSV, with a stated position that the panel does not track website visits or detailed in-client actions, and a CrowdStrike Falcon next-gen SIEM integration forwards control-panel actions and network connections. Retention is 60 days on every plan with up to 24 hours of delay, and I found no public information on year-plus retention, a documented log schema, or a control to end a live session from the console.

Tailscale

Configuration audit logs are on by default with actor, action, target and time, filterable in the admin console and exportable via API, and network flow logs cover node-to-node traffic with an explicit statement they contain no traffic contents. Streaming to named SIEMs — Splunk HEC, Datadog, Elasticsearch, Panther among others — plus webhooks and SSH session recording is documented, and every connection being logged on both source and destination makes tampering detectable. Configuration log retention is fixed at ninety days and cannot be configured, and we found no public information on alerts for unusual access or a live session view.

NordLayer

Setup is advertised at under ten minutes, the Control Panel is central, roles run Owner, Team Administrator and Member with teams and sites in one account, Windows deployment through Intune is documented with the.msi package, silent flags and.intunewin packaging, and support is 24/7 chat with an average response under a minute. I found no public information on a documented REST API, a Terraform provider or configuration as code, a self-hosted edition, or gateways deployable as containers — for a team that wants its access infrastructure in code, that is the gap.

Tailscale

A documented REST API is on all plans with scoped tokens and trust credentials, admin roles split across Owner, Admin, IT admin and Network admin, MDM deployment written up in real detail for Jamf with preconfigured profiles, and centrally managed client updates across stable, release candidate and unstable tracks. The Kubernetes Operator deploys via Helm, multiple tailnets under one organization exist for OEM-style setups, and webhooks are listed. We found no public information on a self-hosted or on-premises edition documented for production, which is what holds this below the top level.

NordLayer

ISO 27001 certification and SOC 2 Type I and II are stated, external audits are claimed, the trust page offers the ISO certificate, SOC 2 report and penetration test report on request, AES-256 or ChaCha20 encryption is named, and the help pages give useful mechanics on gateway IPs and shared bandwidth. I found no public information on a published architecture describing what the vendor's gateways and relays can see, a status page, an availability SLA, a bug bounty, or control-plane failover — and audit artifacts behind a request form are not verifiable from public pages.

Tailscale

The how-it-works page is exactly what I ask vendors for: the coordination server is described as a shared drop box for public keys only, private keys never leave the node, and DERP relays blindly forward already-encrypted WireGuard packets and do not log — with the relay code open source so I can check. Encryption is documented down to Noise IK with X25519, TLS 1.2 minimum, AEAD cipher selection and Tailnet Lock signatures, the network stays reachable when the coordination server is down, and DERP regions fail over independently. Independent Latacora audits are stated but available only on request, the vendor states it has no bug bounty program, and we found no public information on a status page, incident history or an availability SLA.

NordLayer

The contracting entity is Nord Security Inc. in New York, with nordsec B.V. in Amsterdam named only as the EEA data-protection representative; a privacy policy with SCC-based transfer safeguards exists, a data processing agreement link appears on the pricing and integrations pages, and subprocessors appear only as categories such as servers, support and analytics (Google Analytics, Hotjar, Appcues). The captured pages state no location for hosting of the control plane, identities or logs, so the chain is US-contracted with no evidenced EU processing.

Tailscale

The contracting entity is a US corporation with exclusive venue in New York County, while the DPA is published with standard contractual clauses, an Article 27 GDPR representative (EDPO) appointed, and subprocessors listed with ten days' notice of changes. Information is stated to be maintained and processed in Canada, Germany, the United States and the United Kingdom — a mixed footprint rather than a documented EU-hosting option for the control plane and logs — and we found no public information on a self-hosted production edition that would keep records on our own servers.

NordLayer

The Premium plan starts at $14 per user per month with site-to-site requiring Premium plus $40 per month for a dedicated server, an Enterprise offer runs from $6 per user per month on the Lite plan with a 200-seat minimum, billing is monthly or annual with annual cheaper, taxes are added on top of USD pricing, licenses are transferable, and there is a 14-day money-back guarantee. The feature-to-tier mapping is partial — device posture needs Premium, a dedicated IP is available on Core or Premium — and I found no public information on a standalone Core or Lite price or the price of the dedicated IP itself, so a real annual total is not computable from these pages.

Tailscale

Published tiers are Personal at $0 forever, Standard at $8 per user, per month and Premium at $18 per user, per month, with tagged resources at $1 per month each beyond fifty included, per-plan ephemeral-minute allotments, taxes explicitly excluded, USD invoicing at thirty days, and plan gating documented for posture attributes and log streaming. Enterprise and additional ephemeral minutes are contact sales. Minimum seats, minimum term and an annual-versus-monthly price difference are the pieces we found no public information on.