NordLayer vs Tailscale

NordLayer

Clients exist for Windows, macOS, Linux, iOS and Android, with split tunnelling, dedicated fixed IPs that stay the same on a private gateway, site-to-site VPN into AWS, Google Cloud and IBM Cloud, custom DNS, always-on and more than forty service locations — that covers my two plants and the supplier portal's fixed IP. ZTNA-style layer-7 segmentation and resource-level permissions are also described, but we found no public information naming the tunnel protocol itself, clientless browser access for contractors, peer-to-peer connections with relays, or connectors for Kubernetes, so it sits above the basics but short of the full distributed-company model.

Tailscale

WireGuard peer-to-peer connections with DERP relays as fallback, subnet routers for site-to-site between our two plants, split DNS and MagicDNS, and default-deny grants that expose named resources instead of a whole network, on clients documented for Windows, macOS, Linux, iOS and Android with no inbound firewall ports — that is the ERP-and-file-server access I need. I found no public information on always-on or auto-connect behaviour or on clientless browser access for contractors, and the relay fleet is described only as running in multiple regions, not named ones.

NordLayer

Sign-in with Microsoft Entra is documented alongside Google, Okta, OneLogin and JumpCloud, SCIM provisioning adds and removes members automatically so a leaver loses access the same day, and two-factor runs by SMS or authenticator at central or personal level. Device posture covers approved OS, OS and app updates, jailbreak and unknown-device detection with automatic blocking, CrowdStrike, SentinelOne and Jamf feed the checks, and session timers force logout and re-authentication — we found no public information on just-in-time access with approval or policies kept as code.

Tailscale

Sign-in goes through our own identity provider with MFA and context-aware settings inherited from it, Microsoft AD, Okta and Google named among the providers, and SCIM group sync keeps access tied to the account so a leaver disappears with their group. Grants are default-deny and directional down to users, groups, tags and hosts, the policy file can live in Git, users can be required to re-authenticate on a schedule, and device posture rules draw on operating system version plus synced EDR and MDM attributes with just-in-time access on top. I found no public information on hardware-bound device identity or a documented emergency revocation procedure.

NordLayer

The Activity view logs connections with times, devices and servers, admin actions filterable by action, date, member and source IP, failed logins, download protection and visited domains, kept for 60 days regardless of plan with CSV export, and control-panel actions and network connections forward automatically to CrowdStrike's SIEM. The help pages state themselves that data can lag up to 24 hours and is not real-time, and we found no public information on retention beyond 60 days, export to other SIEM tools, or a documented log schema.

Tailscale

Configuration audit logs on all plans record who changed what and when, are kept 90 days, cannot be extended in place, and export by API; network flow logs show which node talked to which resource but are a Premium and Enterprise feature. Streaming to Splunk, Datadog, Elasticsearch, Panther, Cribl and Axiom, or to a private endpoint on our own node, is documented, every connection is logged at both endpoints so tampering is detectable, and the pages state that packet contents and client operations are never logged. Retention of a year or more per plan is not something I found on these pages.

NordLayer

There is a step-by-step guide to push the Windows client through Intune with silent install flags and version rollback, plus three admin roles with multiple owners and team administrators, deployment in about ten minutes, an MSP resale model and 24/7 support with live chat under a minute. That is exactly the Intune path I want, but we found no public information on a documented REST API, Terraform or configuration as code, central client update management, or a self-hosted edition, which is what separates the convenient from the scalable.

Tailscale

Clients install and auto-update through MDM — Microsoft Intune and Jamf are named in the update methods — with system policies for preconfigured settings and selectable release tracks, which is the Intune-first rollout I want for 140 seats. The admin console with Owner, Admin, IT admin and Network admin roles, a REST API available on all plans, GitOps for the policy file, Terraform support, webhooks and multiple tailnets on request give my three-person team the levers it needs. I found no public information on a self-hosted or on-premises edition for production.

NordLayer

AES-256 and ChaCha20 encryption are named, the information security management system is certified to ISO 27001, SOC 2 Type 2 compliance is stated, and certificates plus a penetration-test report are available on request with a trust page listing 25 controls. We found no public information on a published architecture or security whitepaper, key handling, a public status page, an availability SLA, a bug bounty, or what happens to connections when the vendor's service is down, so the credentials are real but the build itself stays opaque.

Tailscale

The how-it-works page says plainly what the coordination server sees — public keys and connection metadata, never private keys or traffic — and the crypto is documented down to Noise IK with X25519, WireGuard on the data plane and a TLS 1.2 minimum, with node and relay code open source, DERP regions failing over independently, and existing connections surviving a coordination-server outage. SOC 2 Type II and Latacora audits are stated, but the reports come on request rather than published, the security page states there is no bounty program, and I found no public information on a status page, an availability SLA or an incident history.

NordLayer

The contracting entity and data controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA data-protection representative, and where the control plane, logs and identities are hosted is not stated. A privacy policy and a data processing agreement are published, transfers rely on EU adequacy decisions or standard contractual clauses, and subprocessors appear only as categories with the actual list available on request — the standard non-EU-vendor baseline rather than a European chain.

Tailscale

The contracting entity for new accounts is Tailscale US Inc., a Delaware corporation, the terms set exclusive venue in New York County, and processing is stated to occur in Canada, Germany, the United States and the United Kingdom — a mixed chain, even though an Article 27 GDPR representative, EDPO, is appointed and a published DPA relies on standard contractual clauses. A subprocessor page with ten days' change notice is referenced and personal data is returned or destroyed within thirty days of termination, but the captured pages do not show which subprocessors are used or where, and no EU hosting option is proven here.

NordLayer

The Premium plan is public at $14 per user per month, the dedicated server for site-to-site at $40 per month, the Enterprise offer from $6 per user per month over 200 seats, VAT charged on top, monthly or annual billing with the annual plan cheaper, prorated additions and a 14-day refund. But we found no public per-user price for the Core plan, no price for the dedicated IP itself beyond which plans support it, and no numeric annual rate, so the real annual total for my 140 people is not computable from the captured pages.

Tailscale

Standard is $8 per user, per month, Premium is $18 per user, per month, the Personal plan is $0, and tagged resources such as exit nodes cost $1 per month beyond the first fifty included — with plan-change proration, overage timing, excluded taxes and USD invoices all stated, so the per-user basis survives a budget round. Enterprise is custom-priced through sales, extra ephemeral minutes are sales-priced, minimum seats and minimum term are not stated, the terms say the fees are specified at checkout, and log streaming and network flow logs need Premium or Enterprise.