NordLayer vs Tailscale

NordLayer

Clients for every major desktop and mobile platform plus a browser extension, gateways across 40+ service locations, site-to-site links to AWS, Google Cloud and IBM Cloud, dedicated IPs, split tunnelling, custom DNS and no inbound port forwarding give us the branch-to-cloud reach we need, with always-on protection and a kill switch on top. Access to specific resources is claimed through app-level segmentation, but we found no public information on named gateway regions, the underlying VPN protocol itself rather than the AES-256 or ChaCha20 ciphers, or clientless access for contractors without a managed device.

Tailscale

Peer-to-peer WireGuard connections with DERP relays as fallback, NAT traversal without inbound firewall ports, subnet routers for site-to-site links with split DNS and high availability, app connectors with a Kubernetes operator, and per-resource grants rather than whole-network access cover exactly the access model I want for control systems. The pages state relay servers run in multiple regions without naming the individual locations, and I found no public information on clientless browser access for contractors or always-on auto-connect behaviour.

NordLayer

Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, SCIM-based provisioning so a leaver loses access, centrally enforced multi-factor, and device posture checks — approved operating system, update status, jailbreak or root detection, unknown device detection — that block non-compliant endpoints rather than merely alerting: this is the verify-before-connect model I have to defend to our auditor. Session duration timers with automatic logout, forced re-authentication and biometric prompts before private gateways add depth; we found no public information on just-in-time access with approval or least-privilege defaults for policies.

Tailscale

Access follows identity and device state rather than the network: single sign-on with any SAML or OIDC provider with MFA inherited from it, SCIM group sync, default-deny grants scoped per resource, device posture from EDR and MDM tools including CrowdStrike, just-in-time access with approval and expiry, forced re-authentication periods, and policy as code through GitOps. That is the level I would accept for OT access, though I found no public information on hardware-bound device identity or a documented emergency revocation procedure.

NordLayer

Six activity views — connections, admin actions, failed logins, download protection, visited domains and browser extensions — with an admin action log filterable by member and source IP, CSV export, and automatic forwarding of actions and network connection logs to CrowdStrike Falcon gets the trail into a SIEM, which is my baseline requirement. Retention is 60 days regardless of plan and data can lag up to 24 hours, so a who-reached-the-control-systems question about last year cannot be answered from the console alone; we found no public information on longer retention tiers, a documented log schema, or tamper-evidence.

Tailscale

Configuration audit logs are always on and record actor, action and target, network flow logs show node-to-node access, both stream to named SIEM systems including Splunk, and every connection is logged twice on source and destination with real-time streaming so tampering is detectable — which answers my auditor's question of who reached what. Retention is fixed at 90 days and cannot be extended in the product, failed login attempts and support-initiated changes are not captured, and I found no public information on alerts for unusual access.

NordLayer

A central Control Panel with owner, team administrator and member roles, silent Windows deployment through Intune with a scripted install command and version rollback, plus 24/7 support with live chat and an average response under a minute make this operable by a small team. We found no public information on a documented REST API, configuration as code or a self-hosted edition, so policy changes remain manual console work, and multi-tenant operation appears only as a support split with managed service providers rather than a described console.

Tailscale

A documented API available on all plans, MDM deployment with Jamf configuration profiles plus update control via Intune or Jamf, granular admin roles, Terraform, webhooks, multiple tailnets under one organisation, and per-tier support with 24/7 severity-one coverage on the paid tiers make this runnable by a small team. I found no public information on a self-hosted production edition of the control plane.

NordLayer

ISO 27001 certification and SOC 2 Type 2 are stated, external audits are claimed, and a trust page cataloguing 25 controls offers the ISO certificate, the SOC 2 report, a penetration test report and a subprocessor list on request — enough to open my assurance file, though the reports are not published in full. We found no public information on control-plane high availability, what happens to existing connections during an outage, a public status page or incident history, an availability SLA, or a vulnerability disclosure or bug bounty programme.

Tailscale

The architecture is published in detail — the coordination server holds only public keys, private keys never leave the node, relays cannot decrypt traffic, existing connections survive a coordination-server outage and relay regions fail over — and independent audits by Latacora, SOC 2 Type II and periodic third-party penetration tests are all stated. The audit reports themselves are available only on request rather than published, there is no bug bounty, and I found no public information on a status page with incident history.

NordLayer

The contracting party and controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA representative, and we found no public information on where account data, user and device identities, connection logs or configuration are stored, or on any named subprocessors — the privacy policy lists only categories, and the subprocessor list is available on request. A privacy policy, GDPR transfer safeguards via adequacy decisions or standard contractual clauses, and a data processing agreement link exist, which is the minimum position I could take to a DPO, not the European chain of custody I want for a NIS2 environment.

Tailscale

The contracting entity is a US corporation in Delaware, transfers from the EU rely on standard contractual clauses, and information is processed in Canada, Germany, the United States and the United Kingdom with no statement that identities and logs stay in Europe — this is the dimension that fails my requirement. A data processing agreement exists, the European Data Protection Office acts as the EU GDPR representative and a subprocessor page is referenced with ten days' notice of changes, but the captured pages do not name the subprocessors or their locations.

NordLayer

Per-user prices are public — Premium from $14 per user per month plus a $40 monthly dedicated server, and an Enterprise offer from $6 per user per month with the Lite plan for teams over 200 seats — alongside monthly or annual billing, VAT charged additionally in USD, prorated additions, a 14-day money-back guarantee and named payment methods. We found no public information on the Core plan price or the cost of a dedicated IP purchased through the account, so the real annual total for our seat count and sites is not fully computable from the captured pages.

Tailscale

Three tiers are public — $0 free forever, $8 per user, per month and $18 per user, per month — with tagged resources beyond the 50 included at $1 per month for every tagged resource, ephemeral-minute allowances, SSH host limits and the plan requirements for log streaming and posture attributes all stated, and taxes expressly excluded from the fees. The Enterprise tier is custom-priced through sales, the ephemeral add-on is contact sales, and I found no public information on minimum seats or a minimum term.