As of 6 Nov 2026, the panel rates NordLayer 2.5/5 and Tailscale 3.5/5 in Business VPN & Zero Trust Access. Weighted by what each judge cares about, 0 of the 6 judges pick NordLayer and 6 pick Tailscale. Tailscale scores higher on 7 of 7 criteria (Architecture, reliability & security assurance, Deployment, API & administration, Access model & connectivity, plus 4 more). Provenance — NordLayer: Rest of world, United States; Tailscale: Rest of world. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The leans run one way: NordLayer draws 0 leans on each of seven criteria, while Tailscale draws 6 against 0 on identity and policy (8.0 vs 6.8), visibility and audit (7.2 vs 6.0), deployment and administration (7.2 vs 5.0) and architecture and assurance (7.0 vs 4.3), and 5 against 0 with 1 tie on access and connectivity (7.8 vs 6.3) and pricing transparency (6.5 vs 5.2). NordLayer's best mean, 6.8 on identity and policy, comes from credits for SCIM provisioning, enforced MFA and device posture checks. Sovereignty splits most: 4 judges lean Tailscale, 2 tie (3.8 vs 3.0). Both verdicts name sovereignty weakest — NordLayer: Nord Security Inc. of New York as contracting entity and controller; Tailscale: a US contracting chain, processing stated in Canada, Germany, the United States and the United Kingdom, against a published DPA and standard contractual clauses. Weighted totals run 4.9-5.6 for NordLayer versus 6.5-7.3 for Tailscale.
Choose NordLayer if
You need centrally enforced MFA with device posture checks that block non-compliant devices — the identity and policy credits judges gave NordLayer.
Your identity provider is Okta, JumpCloud or OneLogin and you need single sign-on plus SCIM provisioning.
You need site-to-site links to AWS, Google Cloud and IBM Cloud.
Your fleet spans Windows, macOS, Linux, iOS and Android and you also want a browser extension client.
You want your contracting entity and controller in the United States — Nord Security Inc. of New York.
Choose Tailscale if
You need default-deny grants with MFA inherited from your own identity provider and SCIM group sync.
You need published cryptography detail and SOC 2 Type II.
You need subnet routers and an API included on each plan.
You need tamper-detectable double logging and can live with a fixed 90-day configuration-log cap.
You need to compare prices before contacting sales: Personal $0, Standard $8 per user per month and Premium $18 per user per month.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The MSP Technician
Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
NordLayer
Tailscale
This judge's pick
Criterion by criterion
Access model & connectivity
NordLayer
Clients exist for Windows, macOS, Linux, iOS and Android plus a browser extension, with shared and private gateways in 40-plus locations, split tunnelling, custom DNS, dedicated IPs, and site-to-site links to AWS, Google Cloud and IBM Cloud; always-on with a kill switch is documented and segmentation is claimed up to the application layer. We found no public information naming the tunnel protocol itself (only AES-256 and ChaCha20 ciphers), on peer-to-peer connections with relay fallback, or on clientless browser access for contractors, so this is a well-rounded gateway VPN rather than the full per-resource access model.
Tailscale
A WireGuard mesh with peer-to-peer links and relay fallback, NAT traversal over STUN and ICE with no inbound firewall rules, subnet routers doing site-to-site between offices and cloud environments, split DNS with MagicDNS, a Kubernetes operator and app connectors, and clients for Windows, macOS, Linux, iOS, Android, ChromeOS and even Apple TV. High-availability subnet router failover is documented and the protocol and cipher choices are published in real detail. The relays are described only as running in "multiple regions" rather than named ones, and we found no public information on always-on auto-connect, published throughput figures, or clientless browser access for contractors.
Identity, access policy & device posture
NordLayer
Single sign-on with Entra ID, Google, Okta, OneLogin and JumpCloud, SCIM-based provisioning, centrally enforced MFA via SMS or TOTP, and device posture checks for approved OS, updates, jailbroken or rooted and unknown devices are all documented, with CrowdStrike, SentinelOne and Jamf integrations that can auto-disconnect a user when a security tool raises an alert. Session timers with forced re-authentication and invalidation of active sessions are stated; we found no public information on just-in-time or time-limited access with approval, or on policies kept as code.
Tailscale
Access hangs off our own identity provider rather than shared keys: SSO with any SAML or OIDC provider including Google, Microsoft, Okta and GitHub, MFA inherited from that provider, SCIM user and group sync so a leaver drops out, default-deny grants and ACLs, device posture from operating system version, custom attributes and EDR/MDM tools like CrowdStrike, just-in-time access tied to posture, and policy as code through GitOps or the API. Machine certificates are described as keys belonging semi-permanently to the device rather than hardware-bound, and we found no public information on emergency revocation procedures.
Logs, audit trail & incident response
NordLayer
The activity view covers connections, admin actions, failed logins, download protection, visited domains and browser extensions, filterable by member, device and date, with a searchable admin action audit log, CSV export and forwarding of control-panel and network-connection logs to CrowdStrike Falcon SIEM; the vendor also states what it does not track, such as website visits and in-client actions. Retention is only 60 days regardless of plan, data can lag up to 24 hours, and we found no public information on longer retention tiers or a documented log schema, which limits how long I could show a client evidence after an incident.
Tailscale
After an incident I can show a client who did what: configuration audit logs with action, actor, target and time on by default, filterable in the console; network flow logs that strictly exclude traffic contents; streaming to named SIEM tools including Splunk and Datadog; SSH session recording; and double logging on both endpoints that makes tampering detectable. The catch for incident response is that configuration logs are kept for only 90 days and that period cannot be configured in place, and we found no public information on alerting on unusual access.
Deployment, API & administration
NordLayer
Setup in under ten minutes, a central Control Panel with Owner, Team Administrator and Member roles and per-team gateways, documented Windows deployment via Intune with silent MSI flags and version rollback, plus 24/7 live chat with sub-minute average response give a small team what it needs for one organisation. The terms describe an MSP model with partner purchases and NordLayer providing only second-level support, but we found no public information on a documented administration API, a multi-tenant console with a tenant per client, or Terraform and configuration as code — which is exactly what would stop me running thirty clients in one login.
Tailscale
Rollout is genuinely fast: a central console, a REST API on all plans, Jamf deployment documented down to bundle IDs and profile scope, central auto-updates with stable, release candidate and unstable tracks, four administrator roles, GitOps policy, and support tiers with 24/7 coverage named at Gold and Platinum. Terraform support is only documented for privileged access resources, the multiple-tailnet option that would serve a provider's managed multi-tenancy is "contact sales" and framed for OEM, and we found no public information on a self-hosted edition or billing per tenant.
Architecture, reliability & security assurance
NordLayer
ISO 27001 and SOC 2 Type I & II are claimed, external audits and a penetration test are stated, and a trust page lists 25 controls across four categories, with certificates, the pentest report and a subprocessor list offered on request. The reports themselves are not published, and we found no public information on an architecture whitepaper with data flow, key handling, a vulnerability disclosure contact, a public status page, control-plane failover behaviour or an availability SLA.
Tailscale
The architecture is published in unusual depth: a coordination server that only exchanges public keys, end-to-end encrypted peer-to-peer traffic the vendor states it cannot read, open-source node and relay code, named ciphers with forward secrecy, SOC 2 Type II, and the network staying reachable when the coordination server is down. Independent Latacora audits exist but only on request rather than published, the vendor states plainly that it has no bounty program, and we found no public information on a status page, an availability SLA or incident post-mortems.
European sovereignty
NordLayer
The contracting entity and controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA data-protection representative, and GDPR claims rest on adequacy decisions and standard contractual clauses for transfers. A privacy policy and a data processing agreement link exist, but we found no public information on where the control plane, logs or identities are hosted, and subprocessors appear only as categories with the named list available on request — a US-governed chain I could not present to a German client as European.
Tailscale
This is an American chain: contracting with Tailscale US Inc., a Delaware corporation, exclusive venue for business customers in New York County, and processing locations named as Canada, Germany, the United States and the United Kingdom, and we found no public information on a European hosting option for the control plane and logs. The paperwork is solid for client contracts — a published data processing agreement with standard contractual clauses, EDPO as EU and UK GDPR representative, a subprocessor page with ten days' change notice, return or destruction within thirty days, SOC 2 Type II — but my Hamburg clients will ask where identities and logs sit, and the answer includes the United States.
Pricing transparency
NordLayer
Premium is published at $14 per user per month with a dedicated server at $40 per month for site-to-site, the Enterprise offer is from $6 per user per month for teams over 200 seats, billing is monthly or annual, licences transfer between employees, add-ons are prorated, and VAT is added on top in USD. Dedicated IPs are purchasable on Core and Premium but unpriced, and we found no public information on per-user prices for the Core and Lite plans or which tier carries SSO or provisioning, so I could not compute a full annual quote for a 40-user client without contacting the vendor.
Tailscale
I can quote most of a client bill straight from the public pages: $0 for the Personal plan free forever, $8 per user per month on Standard, $18 on Premium, 50 tagged resources included with more at $1 per month each, monthly or annual billing set at checkout, taxes excluded, the API on all plans, and network flow logs plus log streaming gated to Premium and Enterprise. Enterprise is custom pricing, extra ephemeral minutes and multiple tailnets are "contact sales", and we found no public information on support-tier prices, minimum seats or minimum term.
Sovereignty, side by side
Dimension
NordLayer
Tailscale
Legal entity
Incorporated in US
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 6 Nov 2026, the panel rates Tailscale higher: 3.5/5 against 2.5/5. Weighted by what each judge cares about, 0 of the 6 judges pick NordLayer and 6 pick Tailscale. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is NordLayer or Tailscale European?
NordLayer is not European by provenance (Rest of world, United States). Tailscale is not European by provenance (Rest of world). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do NordLayer and Tailscale have a free plan?
As of 6 Nov 2026, Tailscale’s own pages state a free plan; NordLayer’s pages as captured do not. Each product page links the pricing page it was read from.