# NCP Secure Enterprise — Business VPN & Zero Trust Access NCP Secure Enterprise by NCP engineering GmbH holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: EU-Made; sovereignty: not determined. - Vendor: NCP engineering GmbH (https://www.ncp-e.com/de/) - Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md) - Provenance (editorial classification): EU-Made - Canonical page: https://whats-best.ai/software/business-vpn/ncp-secure-enterprise - Alternatives: https://whats-best.ai/software/business-vpn/ncp-secure-enterprise/alternatives ([markdown](https://whats-best.ai/software/business-vpn/ncp-secure-enterprise/alternatives.md)) - Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: NCP engineering GmbH - Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026 - Free plan: Not stated on the vendor’s pages as of 5 Nov 2026 ## The panel's verdict NCP Secure Enterprise is a centrally managed, software-based IPsec VPN with a zero trust layer from NCP engineering GmbH of Nuremberg, documented to run fully on-premises, with cloud and hybrid options also described. The bench scored it strongest on sovereignty, 7-8, crediting German contracting and development and an on-premises mode that keeps management, gateways and zero trust access — even air-gapped — on the customer's own servers. Access and connectivity, 6-7, covers IPsec clients for Windows, macOS, Linux, iOS and Android; identity and policy, 6-7, adds SAML and OAuth2 single sign-on, multi-factor authentication and automatic blocking of leavers; architecture and assurance, 5-6, rests on BSI and VS-NfD approvals, FIPS 140-2 certified clients and public statements on TunnelCrack and Tunnelvision. Deployment and administration held a uniform 6. The weakest area is visibility and audit, 3-4: beyond real-time monitoring, dashboards and OpenTelemetry, the judges found no public information on connection logs, an admin audit trail, retention or SIEM export. Scores never spread more than a point on any criterion. Pricing transparency scored 1-2; no price figures appear on the captured pages, only purchase routes. **Speaks for it:** - Software IPsec clients for Windows, macOS and Linux, plus documented iOS and Android clients, connecting to self-run gateways on Windows Server, Linux or virtual machines - Single sign-on via SAML and OAuth2 with Microsoft Active Directory and Entra ID, multi-factor authentication, automatic provisioning and automatic blocking of a leaver's access - BSI and VS-NfD approvals, ISO 27001:2022 certification and public statements on the TunnelCrack and Tunnelvision vulnerabilities - Central management with scoped administrator rights, an automated licence pool and multi-tenancy, with service providers named as a target group - German contracting entity — NCP engineering GmbH of Nuremberg, HRB 7786, Amtsgericht Nürnberg — development in Germany, and a documented on-premises mode including zero trust in air-gapped environments **Held against it:** - Visibility and audit scored 3-4, with no public information on connection logs, an admin audit trail, retention periods or SIEM export - We found no public information on a documented REST API, configuration as code, Terraform or MDM-based client rollout - We found no public information on clientless browser access or connectors for AWS, Azure or Google Cloud - We found no public information on SCIM provisioning, just-in-time access approval or device posture from named EDR or MDM tools - The captured pages give different figures for supported domain groups, 256 and 1,024 **Best for:** - You must keep management, gateways, identities and logs on your own servers — including zero trust in air-gapped environments — under a German contracting and development chain - You run fleets of Windows, macOS, Linux and mobile clients and want directory-driven provisioning with automatic blocking of a leaver's access - You are a service provider or multi-tenant administrator who needs scoped admin rights and an automated licence pool across several organisations - You operate under NIS2 or public-sector classifications and give weight to BSI and VS-NfD approvals and ISO 27001:2022 **Avoid if:** - You must prove who accessed which system and when — visibility and audit scored 3-4 and the judges found no public information on connection or admin audit logs - Your rollout depends on MDM-based client deployment, a documented REST API or configuration as code - Your access model needs clientless browser access or connectors for AWS, Azure or Kubernetes ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Access model & connectivity | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 | | Identity, access policy & device posture | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | | Logs, audit trail & incident response | 2/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 2/5 | | Deployment, API & administration | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | | Architecture, reliability & security assurance | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | | European sovereignty | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | | Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r | | **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | ### The judges - **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round. - **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see. - **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first. - **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby. - **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed. - **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - BSI vsnd approvals: yes · Deutschland [S2] - Data subject rights: Auskunft · Berichtigung · Löschung · Einschränkung · Widerspruch · Datenübertragbarkeit · yes [S13] - ISO 27001: Informationssicherheitsmanagementsysteme · ISO/IEC 27001:2022 [S11] - ISO 9001: Qualitätsmanagementsysteme · ISO 9001:2015 [S11] - Nis2: Unterstützt Dokumentation NIS-2 relevanter Vorgänge [S2] - US transfer mechanism: EU-U.S. Data Privacy Framework · Google [S13] **Data** - Applicant data retention: Einwilligung für Bewerberpool · 4 [S13] - Retention default: abhängig von gesetzlichen Aufbewahrungspflichten · 10 [S13] - Tracking consent: yes [S1] - Usage data anonymization: IP-Kürzung auf Domain-Ebene · 7 [S13] **Hosting** - Company address: Dombühler Str. 2, 90449 Nürnberg · NCP engineering GmbH [S6] **Integrations** - Existing infrastructure: Integration mit bestehenden Authentisierungs-, Verzeichnis- und VPN-Infrastrukturen möglich [S2] - Gateway replacement: existing VPN gateway replacement [S5] **Legal** - Address: Dombühler Str. 2, 90449 Nürnberg · NCP engineering GmbH [S7] - Company: NCP engineering GmbH · Dombühler Str. 2, 90449 Nürnberg [S4] - Company: NCP engineering GmbH · Dombühler Str. 2, 90449 Nürnberg [S9] - Company address: Dombühler Str. 2, 90449 Nürnberg · NCP engineering GmbH [S8] - Controller: Dombühler Str. 2, 90449 Nürnberg · NCP engineering GmbH · Peter Söll [S13] - Entity: Nürnberg · NCP engineering GmbH · Dombühler Str. 2 [S3] - Entity: info@ncp-e.com · Dombühler Str. 2, 90449 Nürnberg · NCP engineering GmbH [S5] - Entity: 90449 · Nürnberg · NCP engineering GmbH · Dombühler Str. 2 [S1] - Entity: NCP engineering GmbH · Dombühler Str. 2, 90449 Nürnberg [S2] - Entity name: NCP engineering GmbH [S12] - Jurisdiction address: Nürnberg · Dombühler Straße 2, 90449 Nürnberg · Germany [S12] - Leadership: Patrick Oliver Graf [S1] - License terms documents: NCP Secure Entry Client und Academic Edition · NCP Secure Enterprise Client · NCP Secure Enterprise iOS Client · NCP Secure Enterprise Server · NCP Secure VPN Client (Premium) for Android · AGB [S10] - No automated decision making: no [S13] - Register court: Amtsgericht Nürnberg · HRB 7786 Nürnberg [S12] - VAT id: DE 133557619 [S12] - Website: www.ncp-e.com [S12] **Pricing** - Govnet kaufhaus des bundes: Kaufhaus des Bundes · RV2208 · BSI-Zulassung VS-NfD [S9] - Ha subscription required: yes [S4] **Product** - Administration: Zentral über das NCP Secure Enterprise Management [S2] - Agent architecture: Applikationsbezogene Multitunnel Client-Gateway-Anwendung [S6] - Agent platform: Windows [S6] - Architecture: datenbankbasiertes System aus Management Server und grafischer Management Konsole [S3] - Backend auth integration: RADIUS · LDAP · Microsoft Active Directory [S4] - Built in features: Routing · Firewall · Network Access Control [S4] - Buy channels: Direkter Online-Kauf, individuelles Enterprise-Projekt oder Bezug über Partner [S9] - Central config per user: Client-Konfigurationen können zentral pro Anwender vorgegeben werden [S7] - Central management: NCP Secure Enterprise Management · Webinterface [S4] - Central management: NCP Secure Enterprise Management [S5] - Client description: Windows · macOS · Linux · endpoint component of NCP Secure Enterprise Solution · software-based IPsec VPN client [S5] - Component overview: Overview of NCP components (English) available [S8] - Components: VPN-Clients · Remote Access-Management · VPN-Gateways [S1] - Components: NCP Secure Enterprise Clients · NCP Secure Enterprise Management · NCP Secure Enterprise Server [S2] - Connectivity features: Automatische Medienerkennung · Home Zone · Seamless Roaming · VPN Path Finder [S7] - Custom branding: yes [S5] - Datasheet android client volume: PDF · NCP Secure Android Client Volume Edition [S8] - Datasheet enterprise android client: PDF · NCP Secure Enterprise Android VPN Client [S8] - Datasheet enterprise failsafe: PDF · NCP Secure Enterprise Failsafe Server [S8] - Datasheet enterprise ios client: PDF · NCP Secure Enterprise iOS Client [S8] - Datasheet enterprise linux client: PDF · NCP Secure Enterprise Linux Client [S8] - Datasheet enterprise load balancing: PDF · NCP Secure Enterprise Load Balancing Server [S8] - Datasheet enterprise macos client: PDF · NCP Secure Enterprise macOS Client [S8] - Datasheet enterprise management: PDF · NCP Secure Enterprise Management [S8] - Datasheet enterprise vpn server: PDF · NCP Secure Enterprise VPN Server [S8] - Datasheet enterprise windows client: PDF · NCP Secure Enterprise Windows Client [S8] - Datasheet secure entry macos client: PDF · NCP Secure Entry macOS Client [S8] - Datasheet secure entry windows client: PDF · NCP Secure Entry Windows Client [S8] - Datasheet virtual enterprise vpn server: PDF · NCP Virtual Secure Enterprise VPN Server [S8] - Datasheet volume license server: PDF · NCP Volume License Server [S8] - Datasheet vs govnet connector: PDF · NCP VS GovNet Connector [S8] - Datasheet vs govnet server: PDF · NCP VS GovNet Server [S8] - Deployment: yes · yes [S3] - Deployment model: yes · yes [S2] - Deployment models: yes · yes · yes [S6] - Deployment segments: Defence · Public & Government · Enterprise · KMU / Einzelplätze [S1] - Dynamic configuration: yes [S6] - Economics features: Bring Your Own Device (BYOD) · Mandantenfähigkeit für mehrere Unternehmen · Minimierung der Administrationskosten · Minimierung der Kosten für Identitäts- und Zugangsmanagement · Minimierung der Supportkosten [S7] - Endpoint monitoring enforcement: yes · yes [S6] - Enterprise solution: NCP Secure Enterprise Solution – zentral verwalteter Remote Access für größere und verteilte Umgebungen [S9] - Entry clients: NCP Secure Entry Clients – VPN-Clients für Einzelarbeitsplätze und kleinere Installationen [S9] - Evaluation poc: yes [S4] - Experience: 35000 · 40 [S2] - Feature comparison entry vs enterprise: Feature comparison document between NCP Secure Entry Client and Enterprise Client available [S8] - Feature matrix: no · yes · yes · no · yes [S5] - Govnet vsnfd: NCP Secure GovNet Solution (VS-NfD) – VPN-Lösungen für Behörden und Organisationen mit besonderen Sicherheitsanforderungen [S9] - High availability: NCP High Availability Services für mehrere VPN Gateways [S4] - High availability: yes · yes [S3] - Identity provider integration: yes · Microsoft Active Directory · Microsoft Entra ID [S6] - Idp authentication: yes [S6] - License management: zentrale Verwaltung und automatisierte Zuweisung/Rücknahme von Lizenzen [S3] - Linux versions: Ubuntu Desktop 22.04 (GNOME) · Ubuntu Desktop 24.04 (GNOME) · Fedora 41 (KDE) · Fedora 42 (KDE) · yes [S5] - Local user management: yes [S4] - Macos features: yes · yes · yes [S5] - Macos keychain: Nutzung des macOS-Schlüsselbunds [S5] - Macos versions: macOS 26 Tahoe · macOS 15 Sequoia · macOS 14 Sonoma · macOS 13 Ventura · Apple Chip · Intel [S5] - Made in germany: yes · yes [S6] - Made in germany claim: 100% souverän und softwarebasiert [S1] - Managed components: NCP Secure Enterprise Clients, VPN Server und High Availability Server [S3] - Managed components: Zero Trust Agents · Zero Trust Gateways · Management Server [S6] - Management features: Automatische, netzabhängige Anpassung der Firewall-Regeln · High Availability · Integrierte, unlimitierte RADIUS-Server · Single Sign-On durch SAML · Virtualisierung · Zentrales Management [S7] - Management functions: Client Configuration · Client Firewall Configuration · Server Configuration · Network Access Control · PKI Enrollment · RADIUS [S3] - Management role: Zentrale Verwaltung von Benutzern, Konfigurationen, Sicherheitsrichtlinien und Updates mit Automatisierung [S2] - Management type: Zentrales, datenbankbasiertes Management-System [S6] - MFA: Zertifikate · One-Time Passwords · biometrische Verfahren · yes [S5] - MFA authenticator app: NCP Authenticator App · yes [S1] - Mobile support: 4G · 5G · yes [S5] - Multi certificate support: yes [S5] - Multi company admin rights: yes [S3] - Multi tenancy: 1024 [S4] - Multi tenancy config options: 1024 · Authentisierung · Filtergruppen · IP-Pools · Bandbreitenbegrenzungen [S4] - Multi tenant: Client / Gateway Konfiguration · Managementserver Konfiguration · Mandantenfähigkeit · yes [S6] - Network access control: yes [S5] - Newsletter double opt in: Abmeldelink in jedem Newsletter · yes [S13] - Newsletter signup: yes [S8] - Odbc database: yes [S3] - Oem aryaka: Aryaka · NCP Management · NCP Gateways · NCP Enterprise Clients [S9] - Oem hp sure station: HP Sure Station – VPN-Technologie für Remote Access im VS-NfD-Umfeld [S9] - Oem lancom: LANCOM · LANCOM Advanced VPN Windows Client · LANCOM Advanced VPN macOS Client [S9] - Oem telekom: Telekom · NCP Management · Gateway · NCP Enterprise Client · Telekom Secure Enterprise Client [S9] - Oem watchguard: WatchGuard · NCP Secure Windows Client WatchGuard · NCP Secure macOS Client WatchGuard [S9] - Offboarding automation: yes [S3] - Onboarding automation: yes [S3] - Opentelemetry support: yes [S6] - Os support: Windows · macOS · Linux [S2] - Overview: Zentral verwaltete Enterprise-VPN-Lösung für Secure Remote Access, modular aufgebaut [S2] **Subprocessors** - Evalanche newsletter: Evalanche · Newsletter-Versand · SC-Networks GmbH, Starnberg · no [S13] - Google ads conversion: Google Ads Conversion Tracking · Einwilligung [S13] - Google analytics: Google Analytics · Google LLC · _anonymizeIp() aktiviert [S13] - Google tag manager: Google Tag Manager · Tool-Integration und -Verwaltung · Google LLC [S13] - Matomo: Matomo · no · lokal auf Servern in Deutschland · yes [S13] **Support** - Academy: NCP Academy · yes [S1] - Documentation counts: 24 · 16 · 1 · 7 [S8] - Documentation download available: yes [S8] - Hotspot auto login guide: Guide for automatic hotspot login available [S8] - Info email: info@ncp-e.com [S9] - Personal consultation: yes [S6] - Personal engineers: Persönliche Unterstützung durch hauseigene System Engineers [S2] - Sales email: vertrieb@ncp-e.com [S4] - Sales email: info@ncp-e.com [S3] - Sales email: vertrieb@ncp-e.com [S6] - Sales email: vertrieb@ncp-e.com [S9] - Security statement tunnelcrack: Security statement available for TunnelCrack vulnerabilities (VU#563667) [S8] - Security statement tunnelvision: Security statement available for Tunnelvision CVE-2024-3661 [S8] - Vulnerability note encryption: Vulnerability Note VU#192371 document available [S8] - Whitepaper friendly net detection: PDF · Friendly Net Detection [S8] 43 more facts on the canonical page: https://whats-best.ai/software/business-vpn/ncp-secure-enterprise ## Questions ### Is NCP Secure Enterprise European? Yes. whats-best.ai classifies NCP Secure Enterprise as EU-Made. ### Where does NCP Secure Enterprise store data? Not stated on the vendor’s pages as of 5 Nov 2026. ### Does NCP Secure Enterprise have a free plan? Not stated on the vendor’s pages as of 5 Nov 2026. ### What are the best alternatives to NCP Secure Enterprise? As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [NCP Secure Enterprise alternatives](https://whats-best.ai/software/business-vpn/ncp-secure-enterprise/alternatives). ## What this page leaves out - 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. ## Sources - [S1] Vendor homepage: https://www.ncp-e.com/de/ (checked 2026-11-05) - [S2] Features page (managed enterprise VPN): https://www.ncp-e.com/de/produkte/zentral-gemanagte-vpn-loesung (checked 2026-11-05) - [S3] Features page (central management): https://www.ncp-e.com/de/produkte/zentral-gemanagte-vpn-loesung/management (checked 2026-11-05) - [S4] Features page (VPN gateway): https://www.ncp-e.com/de/produkte/zentral-gemanagte-vpn-loesung/gateway (checked 2026-11-05) - [S5] Features page (managed clients): https://www.ncp-e.com/de/produkte/zentral-gemanagte-vpn-loesung/managed-clients (checked 2026-11-05) - [S6] Features page (zero trust): https://www.ncp-e.com/de/produkte/zero-trust-loesung (checked 2026-11-05) - [S7] Features page (feature list): https://www.ncp-e.com/de/produkte/leistungsmerkmale (checked 2026-11-05) - [S8] Documentation: https://www.ncp-e.com/de/service/technische-dokumentation (checked 2026-11-05) - [S9] Pricing page (routes to buy, partners and shop): https://www.ncp-e.com/de/kaufen (checked 2026-11-05) - [S10] Licence and maintenance terms: https://www.ncp-e.com/de/service/lizenzbedingungen (checked 2026-11-05) - [S11] Certifications page: https://www.ncp-e.com/de/unternehmen/zertifizierungen-mitgliedschaften (checked 2026-11-05) - [S12] Legal notice: https://www.ncp-e.com/de/impressum (checked 2026-11-05) - [S13] Privacy policy: https://www.ncp-e.com/de/datenschutz (checked 2026-11-05) --- Cite as: whats-best.ai, "NCP Secure Enterprise — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/ncp-secure-enterprise Corrections: https://whats-best.ai/correct/1592?target=page