Business VPN & Zero Trust Access
NCP Secure Enterprise
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by NCP engineering GmbH · www.ncp-e.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
NCP Secure Enterprise at a glance
- Vendor
- NCP engineering GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates NCP Secure Enterprise 3/5, the mean of 6 judges. NCP Secure Enterprise is a centrally managed, software-based IPsec VPN with a zero trust layer from NCP engineering GmbH of Nuremberg, documented to run fully on-premises, with cloud and hybrid options also described. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
NCP Secure Enterprise is a centrally managed, software-based IPsec VPN with a zero trust layer from NCP engineering GmbH of Nuremberg, documented to run fully on-premises, with cloud and hybrid options also described. The bench scored it strongest on sovereignty, 7-8, crediting German contracting and development and an on-premises mode that keeps management, gateways and zero trust access — even air-gapped — on the customer's own servers. Access and connectivity, 6-7, covers IPsec clients for Windows, macOS, Linux, iOS and Android; identity and policy, 6-7, adds SAML and OAuth2 single sign-on, multi-factor authentication and automatic blocking of leavers; architecture and assurance, 5-6, rests on BSI and VS-NfD approvals, FIPS 140-2 certified clients and public statements on TunnelCrack and Tunnelvision. Deployment and administration held a uniform 6. The weakest area is visibility and audit, 3-4: beyond real-time monitoring, dashboards and OpenTelemetry, the judges found no public information on connection logs, an admin audit trail, retention or SIEM export. Scores never spread more than a point on any criterion. Pricing transparency scored 1-2; no price figures appear on the captured pages, only purchase routes.
Speaks for it
- Software IPsec clients for Windows, macOS and Linux, plus documented iOS and Android clients, connecting to self-run gateways on Windows Server, Linux or virtual machines
- Single sign-on via SAML and OAuth2 with Microsoft Active Directory and Entra ID, multi-factor authentication, automatic provisioning and automatic blocking of a leaver's access
- BSI and VS-NfD approvals, ISO 27001:2022 certification and public statements on the TunnelCrack and Tunnelvision vulnerabilities
- Central management with scoped administrator rights, an automated licence pool and multi-tenancy, with service providers named as a target group
- German contracting entity — NCP engineering GmbH of Nuremberg, HRB 7786, Amtsgericht Nürnberg — development in Germany, and a documented on-premises mode including zero trust in air-gapped environments
Held against it
- Visibility and audit scored 3-4, with no public information on connection logs, an admin audit trail, retention periods or SIEM export
- We found no public information on a documented REST API, configuration as code, Terraform or MDM-based client rollout
- We found no public information on clientless browser access or connectors for AWS, Azure or Google Cloud
- We found no public information on SCIM provisioning, just-in-time access approval or device posture from named EDR or MDM tools
- The captured pages give different figures for supported domain groups, 256 and 1,024
Best for
- You must keep management, gateways, identities and logs on your own servers — including zero trust in air-gapped environments — under a German contracting and development chain
- You run fleets of Windows, macOS, Linux and mobile clients and want directory-driven provisioning with automatic blocking of a leaver's access
- You are a service provider or multi-tenant administrator who needs scoped admin rights and an automated licence pool across several organisations
- You operate under NIS2 or public-sector classifications and give weight to BSI and VS-NfD approvals and ISO 27001:2022
Avoid if
- You must prove who accessed which system and when — visibility and audit scored 3-4 and the judges found no public information on connection or admin audit logs
- Your rollout depends on MDM-based client deployment, a documented REST API or configuration as code
- Your access model needs clientless browser access or connectors for AWS, Azure or Kubernetes
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 3 of 5 |
| Logs, audit trail & incident response | 2 of 5 |
| Deployment, API & administration | 3 of 5 |
| Architecture, reliability & security assurance | 3 of 5 |
| European sovereignty | 3.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
IPsec clients for Windows, macOS and Linux plus documented iOS and Android clients, a self-hosted software gateway with high availability, failsafe and load balancing, split tunnelling via VPN Bypass and a zero trust layer with policy-based access per resource would let me expose only the ERP and the file server instead of the whole network. We found no public information on cloud connectors, clientless browser access for contractors or a dedicated static IP option, which is what the supplier portal would need. 4 5 6 8
The DevOps Engineer
Clients are documented for Windows, macOS and Linux with Android and iOS datasheets, all speaking IPsec to a software gateway we would run ourselves on Windows Server, Linux or a virtual appliance; split tunnelling arrives via VPN Bypass and application-level multitunnels, and high availability is covered by HA services plus dedicated failsafe and load-balancing servers. We found no public information on connectors for AWS, Azure or Kubernetes, clientless browser access, or a peer-to-peer mesh with relays — this is a client-to-gateway IPsec product, a different shape from the mesh I want. 5 4 8 7 6
The MSP Technician
Software-based IPsec clients for Windows, macOS and Linux with named iOS and Android editions, self-run gateways on Windows Server, Linux or virtualised environments, split tunnelling via VPN Bypass, seamless roaming across LAN, WLAN and mobile, and policy-based per-application access under the zero trust module cover most of what my client fleets need. I found no public information on clientless browser access for contractors or connectors for AWS, Azure or Google Cloud, which I would want for some customers. 4 5 6 8
The Operations Manager
A software IPsec gateway with managed clients for Windows, macOS and Linux (plus iOS and Android client datasheets), VPN bypass for traffic that should stay out of the tunnel, Path Finder for difficult networks, and high-availability services across several gateways are all documented, and third-party IPsec clients are supported for freelancers on their own laptops. The zero-trust pages add policy-based, application-specific tunnelling. I found no public information on clientless browser access, connectors for the major clouds, or private and split DNS. 4 5 6 8
The Information Security Officer
Software IPsec clients cover Windows, macOS, Linux, iOS and Android, connecting through gateways we run ourselves on Windows Server, Linux or virtual machines, with tunnelling that can be bypassed per application, domain or target address, seamless roaming, Path Finder for restrictive networks and high-availability services for several gateways. Application-related multitunnelling and policy-based zero-trust steering point to access per application rather than whole networks. We found no public information on clientless browser access for contractors, cloud or Kubernetes connectors, or published throughput, so it sits below the top tier. 2 4 5 6 7
The Skeptic
An IPsec client-to-gateway VPN with clients for Windows, macOS, Linux, iOS and Android, split tunnelling through VPN Bypass, Path Finder technology for NAT traversal, and self-run software gateways backed by high-availability, failsafe and load-balancing servers, plus a policy-based zero trust layer claiming per-application access. We found no public information on cloud connectors, clientless browser access or named gateway regions, so it sits below the top band. 4 5 6 8
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on through Microsoft Entra ID, SAML and OAuth2 identity providers, multi-factor via certificates, one-time passwords or biometrics, and automatic blocking of a departed employee's VPN access straight out of the connected directory are all documented — that is the same-day leaver lockout I want without touching the firewall. Group-based policies with separate authentication, filter groups and endpoint policy checks with continuous enforcement are shown; we found no public information on SCIM provisioning, just-in-time access or device posture read from named EDR or MDM tools. 3 4 5 6 7
The DevOps Engineer
Identity hooks are solid: SAML single sign-on, OAuth2 identity providers, Active Directory and Entra ID integration, RADIUS and LDAP backends, multi-factor authentication with certificates, one-time passwords and biometrics, and automatic provisioning plus automatic blocking of VPN access when someone leaves. Endpoint policy checks and continuous enforcement at the management server are described, but we found no public information on SCIM, just-in-time access with approval, or policies kept as code — and for someone who wants policies in Git applied with Terraform, that gap decides the score. 7 6 3 4 5
The MSP Technician
Directory integration with Microsoft Active Directory and Entra ID, single sign-on via SAML, multi-factor authentication with certificates, one-time passwords and biometrics, and automatic blocking of a leaver's VPN access are exactly the controls I must enforce across thirty clients. Endpoint policy checks with continuous evaluation are named, but I found no public information on named EDR or MDM integrations, SCIM provisioning or just-in-time approval workflows. 3 5 6 7
The Operations Manager
Single sign-on via SAML and OAuth2 with Active Directory and Entra ID, multi-factor with certificates, one-time passwords and biometrics, and endpoint policy checks that keep inadequately protected devices out are all stated. Decisive for me: when someone leaves, their VPN access is blocked automatically and new users get templated configurations, so a freelancer's access ends with the contract without me chasing anyone. I found no public information on SCIM provisioning, just-in-time approvals, or posture checks from EDR or MDM tools. 3 5 6 7
The Information Security Officer
Access follows identity: single sign-on via SAML and OAuth2 with Microsoft Active Directory and Entra ID, multi-factor authentication with certificates, one-time passwords and biometrics, automatic provisioning from the directory and automatic blocking when an employee leaves. Endpoint policy checks stop inadequately protected devices before access, with continuous evaluation at the management and a documented policy decision and enforcement architecture. We found no public information on SCIM provisioning, posture checks from named EDR or MDM tools, or just-in-time approval with expiry. 3 4 5 6 7
The Skeptic
Single sign-on via SAML and OAuth2 with Microsoft Entra ID, Active Directory, RADIUS and LDAP backends, multi-factor authentication using certificates, one-time passwords and biometrics, group-based policies per domain group, automated onboarding and automatic blocking when an employee leaves, and endpoint policy checks at the gateway. We found no public information on SCIM provisioning, device posture sourced from EDR or MDM tools, or just-in-time access with approval. 3 4 5 6
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Real-time monitoring with dashboards, OpenTelemetry support and support for documenting NIS-2-relevant processes give my two colleagues something to watch and a hook for our auditors. We found no public information on how long connection logs are kept, export to a SIEM, alerts on unusual access, or a statement of what traffic data the product records and does not record. 2 6
The DevOps Engineer
What the pages document is real-time monitoring with dashboards, OpenTelemetry support and the claim that NIS-2-relevant processes are documented, plus a support assistant that gathers information from the client. We found no public information on per-connection access logs, an admin audit trail, retention periods for product logs, SIEM export destinations, or a view to end active sessions. 6 2 7
The MSP Technician
Real-time monitoring, dashboards, OpenTelemetry support and the stated documentation of NIS-2-relevant processes are all that is visible to me. I found no public information on per-user connection logs, an admin audit trail, retention periods for access data, or export and streaming to a SIEM, so I could not show a client a connection history after an incident from what is published. 2 6
The Operations Manager
Real-time monitoring with dashboards, enforcement driven by continuous endpoint evaluation, OpenTelemetry support, and documentation of NIS-2-relevant events are described. I found no public information on per-user access logs, an admin audit trail, retention periods for the product's own logs, or a statement of what traffic data is and is not logged — with an hourly IT provider I need to see exactly who reached what, and the captured pages do not show it. 2 6 7
The Information Security Officer
The captured pages show dashboards, real-time monitoring with enforcement, OpenTelemetry support and a statement that NIS2-relevant processes can be documented centrally. We found no public information on connection or administrator audit logs, how long product logs are kept, or streaming to a named SIEM. My auditor's question — who reached the control systems last year — cannot be answered from these pages. 2 6
The Skeptic
The pages show real-time monitoring with dashboards, OpenTelemetry support, a support assistant that gathers client-system information, and a claim that NIS-2-relevant processes can be documented. We found no public information on access-log retention, an admin audit trail, SIEM streaming, a view of active sessions, or a statement of what traffic data is and is not recorded. 2 6 7
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
Central management of users, configurations, security policies, licence pools and automated software, configuration and certificate updates, admin rights scoped to assigned areas, multi-tenancy up to 1,024 domain groups, and deployment on-premises on Windows Server or Linux or as a hardened virtual appliance are all documented. We found no public information on pushing the client through Intune or another MDM with preconfigured settings, a documented REST API or configuration as code, and support response times per plan are not stated, so the rollout effort for 140 seats stays guesswork. 2 3 4 6 7
The DevOps Engineer
Central management with a graphical console, per-user client configuration, automated license assignment from a pool, scoped administrator rights and multi-tenancy up to 1,024 domain groups — and the whole stack runs on-premises on Windows Server, Linux or as a virtual appliance, which suits our estate. We found no public information on a REST API, Terraform, MDM-based client rollout or webhooks, and without an API the multi-tenancy is only half as useful to me. 3 4 6 8
The MSP Technician
A central management server with multi-tenancy for several companies, scoped administrator rights, a licence pool with automated assignment and return, central client updates, and on-premises, hybrid or cloud deployment read like a service provider product, and service providers are explicitly named as a target group. I found no public information on a REST API, Terraform or configuration as code, MDM-based client rollout, or support response times per plan, which limits how much of this I can automate. 2 3 4 6 7
The Operations Manager
A database-backed management server with a graphical console, scoped administrator rights, multi-tenancy for hundreds of domain groups with service providers named as a target group, central updates, a license pool with automated assignment and reclaim, and a fully on-premises path are all documented, with a proof of concept supported by in-house engineers and an academy for training. For a team with no IT department that combination is workable. I found no public information on a REST API, client rollout through MDM, configuration as code, or support response times. 2 3 4 8
The Information Security Officer
Administration is a database-backed management server with a graphical console: client configurations preset per user, central software, configuration, certificate and licence updates with an automated licence pool, scoped administrator rights, and multi-tenant capability for several organisations or service providers, though the captured pages give different figures for the number of domain groups. Deployment on our own servers or as a hardened virtual appliance is exactly the self-run model we need. We found no public information on a documented REST API, configuration as code, or client rollout through MDM. 3 4 5 6
The Skeptic
A database-backed management server with central client, configuration, certificate, licence-pool and update management, scoped administrator rights, multi-tenancy aimed at service providers — the captured pages give different figures for supported domain groups, 256 and 1,024 — and deployment on Windows Server, Linux or virtualised environments including a hardened virtual appliance. We found no public information on a documented REST API, MDM-based client rollout, or support response times per plan. 3 4 6
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The component picture — clients, IPsec gateway and a database-backed management server with policy decision and enforcement points — is public, the clients are FIPS 140-2 certified, and the vendor states BSI approvals for VS-NfD, EU and NATO RESTRICTED classifications, ISO 27001:2022 and public statements on the TunnelCrack and Tunnelvision vulnerabilities. We found no public information on a security whitepaper describing what the vendor can see, published audit reports, a bug bounty, a status page or an SLA. 1 2 4 5 8 11
The DevOps Engineer
The component architecture is published — clients, management server, gateway — with IPsec, FIPS 140-2 certification on Windows and macOS, PKI enrollment, and since we run the gateways ourselves the traffic path is ours; assurance leans on BSI and VS-NfD approvals up to NATO RESTRICTED, ISO 27001:2022 and public statements on TunnelCrack and Tunnelvision. We found no public information on a status page, an SLA, a bug bounty, or the behaviour of sessions when a component fails. 2 5 3 1 11 8 4
The MSP Technician
The three-component architecture of clients, VPN gateway and management server is described, encryption is IPsec with FIPS 140-2 certified clients, high availability services for multiple gateways are documented, and BSI and VS-NfD approvals plus ISO 27001:2022 give government-grade assurance signals, with published statements on TunnelCrack and Tunnelvision. I found no public information on independent penetration test reports, a bug bounty, a public status page or an availability SLA. 2 4 5 8 11
The Operations Manager
The component architecture, policy decision and enforcement points, IPsec with FIPS 140-2 certification on Windows and macOS, BSI and VS-NfD approvals up to EU and NATO RESTRICTED, ISO/IEC 27001:2022, and named failsafe and load-balancing servers are all published, and the vendor has public statements on the TunnelCrack and Tunnelvision vulnerabilities. That is stronger assurance than most. I found no public information on an independent audit report, a bug bounty, a status page or an SLA. 1 2 5 8 11
The Information Security Officer
The three-component architecture with policy decision and enforcement points is published, encryption is IPsec with FIPS 140-2 certified Windows and macOS clients, and high-availability, failsafe and load-balancing servers exist as documented products. BSI and VS-NfD approvals and ISO 27001:2022 certification amount to an independent, governmental evaluation rather than a marketing claim, which carries weight in my NIS2 environment. We found no public information on a public status page, an availability SLA, published audit reports, or a bug bounty. 1 2 4 5 6 8 11
The Skeptic
The architecture is described — clients, gateways, management server, and a policy decision point with enforcement points — encryption is IPsec with FIPS 140-2 certification on Windows and macOS, and the vendor holds BSI and VS-NfD approvals up to NATO RESTRICTED, ISO 27001:2022, and has published statements on the TunnelCrack and Tunnelvision vulnerabilities. We found no published audit or pentest summaries, bug bounty, status page, availability SLA, or a statement of what happens to existing tunnels if the management server fails. 1 2 4 5 8 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting party is NCP engineering GmbH of Nuremberg with development stated to happen in Germany, and the whole solution is documented to run on-premises — even zero trust in air-gapped environments — so identities, configuration and connection handling stay in our own chain on our own servers. Website subprocessors are named with their locations and ISO 27001:2022 is listed, but we found no public information on a published data processing agreement or on where the cloud-hosted option processes data. 2 4 6 11 12 13
The DevOps Engineer
NCP engineering GmbH is registered in Nuremberg with the commercial register at Amtsgericht Nürnberg and develops in Germany, and the product is documented to run fully on-premises — management server, gateway, and zero trust access in isolated environments without cloud — so identities, configuration and connections stay on our own servers. Website subprocessors are listed with locations (Evalanche in Starnberg, Matomo hosted locally in Germany, Google under the Data Privacy Framework), but we found no public information on a data processing agreement for the product itself. 12 6 2 4 13 11
The MSP Technician
The contracting entity is NCP engineering GmbH in Nuremberg with the register court Amtsgericht Nürnberg, development takes place in Germany, and the solution can run entirely on-premises, with zero trust even in sealed-off on-premises environments, so management and gateways sit on my clients' own European servers backed by ISO 27001:2022. The only subprocessors named relate to the vendor's website, and I found no public information on a published data processing agreement or subprocessors for the product itself. 2 6 11 12 13
The Operations Manager
NCP engineering GmbH is registered in Nuremberg with a German register court, development is stated to take place in Germany, and the product runs entirely on premises — zero trust even in air-gapped environments — so identities, configuration and logs can stay on our own servers, which is the chain I can defend to German clients. ISO certifications are published and the privacy policy lists subprocessors with locations, though those cover the website rather than the product. I found no public information on a data processing agreement for the product or the infrastructure behind the cloud deployment option. 2 6 11 12 13
The Information Security Officer
The contracting entity is a German company in Nuremberg with a commercial register number, development takes place in Germany, and the product runs on premises, so management, gateways and with them the identities and logs stay on our own servers — including zero-trust access in air-gapped environments, the strongest form of European data custody for us. The website privacy policy lists subprocessors with locations (Evalanche in Starnberg, Google in the USA under the Data Privacy Framework, Matomo hosted locally in Germany) and ISO 27001 is certified. We found no public information on a published data processing agreement. 2 6 11 12 13
The Skeptic
A German contracting entity and development (NCP engineering GmbH, Nuremberg, registered at Amtsgericht Nürnberg) with ISO 27001:2022, and a documented on-premises edition where management and gateways run on the customer's own Windows or Linux servers and zero trust access works without cloud — that is the customer's own chain; website subprocessors are listed with their locations, including Germany-hosted Matomo and US Google services under the Data Privacy Framework. We found no published data processing agreement and no statement of where a cloud-hosted deployment would store account data and logs. 2 6 11 12 13
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The buy page describes the routes — direct online purchase, an individual enterprise project, purchase through partners, and GovNet for authorities via the Kaufhaus des Bundes framework contract RV2208 — but no price per user, tier structure, minimum seats, or the cost of the high availability server, which the vendor says needs its own subscription licence, appears on the pages we read. I cannot defend a per-user number in the next budget round from public information alone. 2 4 9
The DevOps Engineer
The buy page names channels — direct online purchase, an individual enterprise project, or partners — and the GovNet variant is sold through the Kaufhaus des Bundes framework RV2208, but we found no public prices for any tier, client or server licence; the high-availability server needing its own subscription is stated without a figure. I could not begin to compute an annual cost from the public pages. 9 4 10
The MSP Technician
The buy page names routes — direct online purchase, an individual enterprise project, purchase through partners, and a federal framework contract for the GovNet solution — but no price per user, tier, seat minimum or add-on figure is published anywhere, and the high-availability server is only noted as requiring its own subscription licence. I cannot quote a client an annual cost from public pages and would have to contact the vendor first. 4 9 10
The Operations Manager
The buy page names the channels — direct online purchase, individual enterprise projects, partners, and the federal Kaufhaus des Bundes framework contract — and the licence terms for each client and server are published, but no price per user, tier or gateway appears anywhere on the captured pages. The note that the high-availability server needs its own subscription licence tells me cost exists there but not what it is. I cannot compute an annual cost from what is public; budgeting this means a conversation with sales. 4 9 10
The Information Security Officer
The captured pages describe purchase routes — direct online purchase, an individual enterprise project, partners, or the federal framework contract for the GovNet variant — and note that the HA server requires its own subscription licence, but they contain no price figures at all. Per-user or per-gateway cost, tier boundaries, support fees and term lengths cannot be computed from public pages; we found no public information on any of them. 4 9 10
The Skeptic
The buy page names channels — direct online purchase, an individual enterprise project, purchase through partners, and a public-sector framework contract via Kaufhaus des Bundes — and licence terms are published, but no price figures appear on any page we read; the only pricing-adjacent fact is that running the high-availability server requires its own subscription licence. A buyer cannot compute an annual cost from these pages. 4 9 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about NCP Secure Enterprise
Is NCP Secure Enterprise European?
Yes. whats-best.ai classifies NCP Secure Enterprise as EU-Made.
Where does NCP Secure Enterprise store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does NCP Secure Enterprise have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to NCP Secure Enterprise?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: NCP Secure Enterprise alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.ncp-e.com Checked 5 Nov 2026 Details →
- 2 Features page (managed enterprise VPN) www.ncp-e.com Checked 5 Nov 2026 Details →
- 3 Features page (central management) www.ncp-e.com Checked 5 Nov 2026 Details →
- 4 Features page (VPN gateway) www.ncp-e.com Checked 5 Nov 2026 Details →
- 5 Features page (managed clients) www.ncp-e.com Checked 5 Nov 2026 Details →
- 6 Features page (zero trust) www.ncp-e.com Checked 5 Nov 2026 Details →
- 7 Features page (feature list) www.ncp-e.com Checked 5 Nov 2026 Details →
- 8 Documentation www.ncp-e.com Checked 5 Nov 2026 Details →
- 9 Pricing page (routes to buy, partners and shop) www.ncp-e.com Checked 5 Nov 2026 Details →
- 10 Licence and maintenance terms www.ncp-e.com Checked 5 Nov 2026 Details →
- 11 Certifications page www.ncp-e.com Checked 5 Nov 2026 Details →
- 12 Legal notice www.ncp-e.com Checked 5 Nov 2026 Details →
- 13 Privacy policy www.ncp-e.com Checked 5 Nov 2026 Details →