Business VPN & Zero Trust Access
NordLayer
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Nord Security Inc. · nordlayer.com
Compare with Tailscale → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
NordLayer at a glance
- Vendor
- Nord Security Inc.
- Headquarters
- Incorporated in United States source, captured 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates NordLayer 2.5/5, the mean of 6 judges. NordLayer, a business VPN and zero trust access service from Nord Security Inc., scored highest on identity and policy, 6 to 7, and access and connectivity, 6 to 7. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
NordLayer, a business VPN and zero trust access service from Nord Security Inc., scored highest on identity and policy, 6 to 7, and access and connectivity, 6 to 7. Judges credited single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, SCIM provisioning, centrally enforced MFA and device posture checks that block non-compliant devices, alongside clients for Windows, macOS, Linux, iOS and Android, a browser extension, and site-to-site links to AWS, Google Cloud and IBM Cloud. Weakest is sovereignty, flat at 3: the contracting entity and controller is Nord Security Inc. of New York, nordsec B.V. in Amsterdam appears only as an EEA data-protection representative, and we found no public information on where the control plane, logs or identities are hosted. Architecture and assurance ranged 4 to 5, the range reflecting how much weight the judges gave to ISO 27001 and SOC 2 statements whose reports are offered on request; pricing transparency ranged 5 to 6, with Core and Lite prices not shown. Scores cluster within a point, and no disagreement was flagged between judges.
Speaks for it
- Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, plus SCIM provisioning that adds and removes members automatically.
- Device posture checks for approved OS, updates, jailbreak or root and unknown devices automatically block non-compliant accounts.
- Clients for Windows, macOS, Linux, iOS and Android plus a browser extension, with dedicated fixed IPs and site-to-site links to AWS, Google Cloud and IBM Cloud.
- Six activity views are filterable, exportable as CSV and kept for 60 days, with control-panel and network-connection logs forwarding to CrowdStrike Falcon.
- Deployment is advertised in under ten minutes, Windows rollout is documented for Intune with silent install flags, and 24/7 live chat averages a response under a minute.
Held against it
- Sovereignty is the weakest result at 3: the contracting entity and controller is Nord Security Inc. of New York, nordsec B.V. appears only as an EEA data-protection representative, and we found no public information on where the control plane, logs or identities are hosted.
- Audit artifacts — the ISO 27001 certificate, SOC 2 report, penetration-test report and subprocessor list — are offered on request rather than published.
- Activity data is retained 60 days regardless of plan, can lag up to 24 hours, and documented log forwarding is to CrowdStrike Falcon only.
- We found no public information on a documented REST API, Terraform or configuration as code, a multi-tenant console, or a self-hosted edition.
- The Core and Lite per-user prices and the price of a dedicated IP are not shown on the captured pages, so the lower tiers cannot be costed without contacting the vendor.
Best for
- You need business VPN access governed by single sign-on, SCIM provisioning and device posture checks that automatically block non-compliant devices.
- Your team rolls out Windows clients through Intune and wants a set-up advertised in under ten minutes with 24/7 live chat.
- You link offices or plants into AWS, Google Cloud or IBM Cloud over site-to-site VPN with dedicated fixed IPs.
- You already run CrowdStrike Falcon and can work within 60-day activity retention.
Avoid if
- You require a European contracting and hosting chain — the contracting entity and controller is Nord Security Inc. of New York, and the captured pages state no location for hosting of the control plane, identities or logs.
- Your team manages access infrastructure as code — ask the vendor: the public pages we read do not show it
- You need audit evidence older than 60 days or near-real-time logs — activity data is kept 60 days regardless of plan and can lag up to 24 hours.
- You must compute a full annual cost before contacting the vendor — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3 of 5 |
| Identity, access policy & device posture | 3.5 of 5 |
| Logs, audit trail & incident response | 3 of 5 |
| Deployment, API & administration | 2.5 of 5 |
| Architecture, reliability & security assurance | 2 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 2.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
Clients exist for Windows, macOS, Linux, iOS and Android, with split tunnelling, dedicated fixed IPs that stay the same on a private gateway, site-to-site VPN into AWS, Google Cloud and IBM Cloud, custom DNS, always-on and more than forty service locations — that covers my two plants and the supplier portal's fixed IP. ZTNA-style layer-7 segmentation and resource-level permissions are also described, but we found no public information naming the tunnel protocol itself, clientless browser access for contractors, peer-to-peer connections with relays, or connectors for Kubernetes, so it sits above the basics but short of the full distributed-company model. 2 3 4 13 14 21 22
The DevOps Engineer
There are clients for Windows, macOS, Linux, iOS and Android plus a browser extension, shared and dedicated gateways across 40+ service locations, split tunnelling, custom DNS, always-on with a kill switch, and site-to-site links reaching AWS, Google Cloud and IBM Cloud. It is a gateway VPN rather than a mesh, though: the security help page states that no port-forwarding is provided and no incoming connections can go through, I found no public information on connectors running as containers, and the tunnel protocol is not documented — only AES-256 or ChaCha20 ciphers are named. 2 3 4 13 21 22
The MSP Technician
Clients exist for Windows, macOS, Linux, iOS and Android plus a browser extension, with shared and private gateways in 40-plus locations, split tunnelling, custom DNS, dedicated IPs, and site-to-site links to AWS, Google Cloud and IBM Cloud; always-on with a kill switch is documented and segmentation is claimed up to the application layer. We found no public information naming the tunnel protocol itself (only AES-256 and ChaCha20 ciphers), on peer-to-peer connections with relay fallback, or on clientless browser access for contractors, so this is a well-rounded gateway VPN rather than the full per-resource access model. 3 4 13 21 22
The Operations Manager
Clients for Windows, macOS, Linux, iOS and Android plus a browser extension, split tunnelling, dedicated IPs, custom DNS, site-to-site links to AWS, Google Cloud and IBM Cloud, always-on and 40-plus service locations cover what my travelling staff and freelancers need, and the help centre states the service provides no port forwarding so no incoming connections pass through. What holds it back: the pages never name the VPN protocol itself, the locations stay a count rather than a named list, and I found no public information on clientless browser access for contractors or peer-to-peer connections with relays. 2 3 4 13 21 22
The Information Security Officer
Clients for every major desktop and mobile platform plus a browser extension, gateways across 40+ service locations, site-to-site links to AWS, Google Cloud and IBM Cloud, dedicated IPs, split tunnelling, custom DNS and no inbound port forwarding give us the branch-to-cloud reach we need, with always-on protection and a kill switch on top. Access to specific resources is claimed through app-level segmentation, but we found no public information on named gateway regions, the underlying VPN protocol itself rather than the AES-256 or ChaCha20 ciphers, or clientless access for contractors without a managed device. 3 4 13 14 21 22
The Skeptic
Clients cover Windows, macOS, Linux, iOS, Android and a browser extension, with gateway-based access, dedicated and fixed IPs, split tunnelling, Custom DNS, always-on VPN with kill switch, and site-to-site links to AWS, Google Cloud and IBM Cloud. Service locations are given as a count (40+) rather than named regions, there is no port forwarding or inbound connection path at all, and we found no public information on peer-to-peer connections, clientless access for contractors, or gateway failover. 3 4 13 21 22
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Sign-in with Microsoft Entra is documented alongside Google, Okta, OneLogin and JumpCloud, SCIM provisioning adds and removes members automatically so a leaver loses access the same day, and two-factor runs by SMS or authenticator at central or personal level. Device posture covers approved OS, OS and app updates, jailbreak and unknown-device detection with automatic blocking, CrowdStrike, SentinelOne and Jamf feed the checks, and session timers force logout and re-authentication — we found no public information on just-in-time access with approval or policies kept as code. 2 5 6 7 15 16 22
The DevOps Engineer
Single sign-on with Entra ID, Google, Okta, OneLogin and JumpCloud, SCIM provisioning that adds and removes members automatically, MFA by SMS or TOTP configurable centrally, and device posture checks feeding off CrowdStrike, SentinelOne and Jamf that block non-compliant devices and invalidate active sessions on an alert, plus a session duration timer with forced logout. I found no public information on just-in-time access with approval, or on policies kept in Git and applied with Terraform, which is what I need to review access rules as code. 2 5 6 7 15 16 22
The MSP Technician
Single sign-on with Entra ID, Google, Okta, OneLogin and JumpCloud, SCIM-based provisioning, centrally enforced MFA via SMS or TOTP, and device posture checks for approved OS, updates, jailbroken or rooted and unknown devices are all documented, with CrowdStrike, SentinelOne and Jamf integrations that can auto-disconnect a user when a security tool raises an alert. Session timers with forced re-authentication and invalidation of active sessions are stated; we found no public information on just-in-time or time-limited access with approval, or on policies kept as code. 5 6 15 16
The Operations Manager
Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, provisioning that automatically adds and removes members, MFA, and device posture checks feeding in from CrowdStrike, SentinelOne and Jamf mean a freelancer's access can end with the contract and a jailbroken laptop gets blocked, with per-resource permissions to keep each contractor on their one project system. I found no public information on just-in-time or time-limited access with approval, least-privilege defaults, or policies kept as code. 2 5 7 13 15 16 17
The Information Security Officer
Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, SCIM-based provisioning so a leaver loses access, centrally enforced multi-factor, and device posture checks — approved operating system, update status, jailbreak or root detection, unknown device detection — that block non-compliant endpoints rather than merely alerting: this is the verify-before-connect model I have to defend to our auditor. Session duration timers with automatic logout, forced re-authentication and biometric prompts before private gateways add depth; we found no public information on just-in-time access with approval or least-privilege defaults for policies. 2 5 15 16 22
The Skeptic
Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, SCIM-based onboarding and offboarding, 2FA via SMS or TOTP set centrally or personally, and device posture checks (approved OS, OS and app updates, jailbreak or root detection, unknown devices) with automatic blocking of non-compliant accounts. Automated integration actions apply to individual users only — the vendor states group targeting is not supported — and we found no public information on just-in-time approval or policies kept as code. 2 5 6 13 15 16 22
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
The Activity view logs connections with times, devices and servers, admin actions filterable by action, date, member and source IP, failed logins, download protection and visited domains, kept for 60 days regardless of plan with CSV export, and control-panel actions and network connections forward automatically to CrowdStrike's SIEM. The help pages state themselves that data can lag up to 24 hours and is not real-time, and we found no public information on retention beyond 60 days, export to other SIEM tools, or a documented log schema. 4 6 17 18
The DevOps Engineer
The Activity section records connection sessions with devices and servers, admin actions, failed logins, download protection and visited domains, filterable and exportable as CSV, with a stated position that the panel does not track website visits or detailed in-client actions, and a CrowdStrike Falcon next-gen SIEM integration forwards control-panel actions and network connections. Retention is 60 days on every plan with up to 24 hours of delay, and I found no public information on year-plus retention, a documented log schema, or a control to end a live session from the console. 11 17 18
The MSP Technician
The activity view covers connections, admin actions, failed logins, download protection, visited domains and browser extensions, filterable by member, device and date, with a searchable admin action audit log, CSV export and forwarding of control-panel and network-connection logs to CrowdStrike Falcon SIEM; the vendor also states what it does not track, such as website visits and in-client actions. Retention is only 60 days regardless of plan, data can lag up to 24 hours, and we found no public information on longer retention tiers or a documented log schema, which limits how long I could show a client evidence after an incident. 11 17 18
The Operations Manager
The Control Panel shows six activity types including connection sessions with times, devices and servers, an admin action log, failed logins and download-protection events, held 60 days regardless of plan with CSV download, and Control Panel and connection logs can be forwarded to CrowdStrike's SIEM — enough for my external provider to answer who touched what. The catches that matter: the log can lag up to 24 hours and is not real-time, retention is capped at 60 days rather than a year, and I found no public information on flow logs per resource or a documented log schema. 11 17 18
The Information Security Officer
Six activity views — connections, admin actions, failed logins, download protection, visited domains and browser extensions — with an admin action log filterable by member and source IP, CSV export, and automatic forwarding of actions and network connection logs to CrowdStrike Falcon gets the trail into a SIEM, which is my baseline requirement. Retention is 60 days regardless of plan and data can lag up to 24 hours, so a who-reached-the-control-systems question about last year cannot be answered from the console alone; we found no public information on longer retention tiers, a documented log schema, or tamper-evidence. 6 17 18
The Skeptic
The Control Panel shows six activity types — connections, admin actions, failed logins, Download Protection, visited domains and browser extensions — filterable and exportable as CSV, plus session-invalidation and automatic disconnect on threat alerts. Retention is 60 days regardless of plan, the vendor states data can lag by up to 24 hours, and log forwarding is documented to CrowdStrike Falcon SIEM only; we found no public information on longer retention tiers, per-resource flow logs, or a documented log schema. 5 6 17 18
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
There is a step-by-step guide to push the Windows client through Intune with silent install flags and version rollback, plus three admin roles with multiple owners and team administrators, deployment in about ten minutes, an MSP resale model and 24/7 support with live chat under a minute. That is exactly the Intune path I want, but we found no public information on a documented REST API, Terraform or configuration as code, central client update management, or a self-hosted edition, which is what separates the convenient from the scalable. 2 3 9 10 19 20
The DevOps Engineer
Setup is advertised at under ten minutes, the Control Panel is central, roles run Owner, Team Administrator and Member with teams and sites in one account, Windows deployment through Intune is documented with the.msi package, silent flags and.intunewin packaging, and support is 24/7 chat with an average response under a minute. I found no public information on a documented REST API, a Terraform provider or configuration as code, a self-hosted edition, or gateways deployable as containers — for a team that wants its access infrastructure in code, that is the gap. 2 9 19 20
The MSP Technician
Setup in under ten minutes, a central Control Panel with Owner, Team Administrator and Member roles and per-team gateways, documented Windows deployment via Intune with silent MSI flags and version rollback, plus 24/7 live chat with sub-minute average response give a small team what it needs for one organisation. The terms describe an MSP model with partner purchases and NordLayer providing only second-level support, but we found no public information on a documented administration API, a multi-tenant console with a tenant per client, or Terraform and configuration as code — which is exactly what would stop me running thirty clients in one login. 2 10 19 20
The Operations Manager
Set-up in under ten minutes, a three-step gateway creation, 24/7 live chat with average response under a minute, three admin roles with team scoping, and a documented Intune deployment with silent install flags for Windows are what a company with no IT department can actually run. I found no public information on a documented REST API or a Terraform provider, the MDM guidance I could see covers Windows only so my Mac freelancers install by hand, and the MSP material describes a support split rather than a multi-tenant console. 2 9 13 19 20
The Information Security Officer
A central Control Panel with owner, team administrator and member roles, silent Windows deployment through Intune with a scripted install command and version rollback, plus 24/7 support with live chat and an average response under a minute make this operable by a small team. We found no public information on a documented REST API, configuration as code or a self-hosted edition, so policy changes remain manual console work, and multi-tenant operation appears only as a support split with managed service providers rather than a described console. 2 10 19 20
The Skeptic
A central Control Panel with Owner, Team Administrator and Member roles, Windows deployment through Intune with silent.msi install flags and version rollback for testing, webhook-based integrations, and 24/7 live chat with an average response time under a minute are documented. The MSP relationship in the terms defines first- and second-level support but we found no public information on a documented administrative REST API, Terraform or configuration-as-code, multi-tenant console for providers, or a self-hosted edition. 2 6 10 19 20
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
AES-256 and ChaCha20 encryption are named, the information security management system is certified to ISO 27001, SOC 2 Type 2 compliance is stated, and certificates plus a penetration-test report are available on request with a trust page listing 25 controls. We found no public information on a published architecture or security whitepaper, key handling, a public status page, an availability SLA, a bug bounty, or what happens to connections when the vendor's service is down, so the credentials are real but the build itself stays opaque. 2 9 12 13
The DevOps Engineer
ISO 27001 certification and SOC 2 Type I and II are stated, external audits are claimed, the trust page offers the ISO certificate, SOC 2 report and penetration test report on request, AES-256 or ChaCha20 encryption is named, and the help pages give useful mechanics on gateway IPs and shared bandwidth. I found no public information on a published architecture describing what the vendor's gateways and relays can see, a status page, an availability SLA, a bug bounty, or control-plane failover — and audit artifacts behind a request form are not verifiable from public pages. 9 11 12 13 21
The MSP Technician
ISO 27001 and SOC 2 Type I & II are claimed, external audits and a penetration test are stated, and a trust page lists 25 controls across four categories, with certificates, the pentest report and a subprocessor list offered on request. The reports themselves are not published, and we found no public information on an architecture whitepaper with data flow, key handling, a vulnerability disclosure contact, a public status page, control-plane failover behaviour or an availability SLA. 9 11 12 13
The Operations Manager
ISO 27001, SOC 2 Type 2 and a penetration test report exist but only on request, encryption is named as AES-256 or ChaCha20, and the trust page lists 25 controls — reasonable signs, though no report summaries are published. I found no public information on a status page, an availability SLA, a bug bounty or vulnerability disclosure programme, or what happens to connections when the vendor's own service is down, so I cannot verify the reliability claims. 9 11 12 21
The Information Security Officer
ISO 27001 certification and SOC 2 Type 2 are stated, external audits are claimed, and a trust page cataloguing 25 controls offers the ISO certificate, the SOC 2 report, a penetration test report and a subprocessor list on request — enough to open my assurance file, though the reports are not published in full. We found no public information on control-plane high availability, what happens to existing connections during an outage, a public status page or incident history, an availability SLA, or a vulnerability disclosure or bug bounty programme. 9 11 12
The Skeptic
ISO 27001 certification, SOC 2 Type I and II, and an external penetration test are stated, but the pentest report, SOC 2 report and subprocessor list are all 'on request' rather than published. Encryption ciphers AES-256 and ChaCha20 are named while the protocol and key handling are not, and we found no public information on an architecture document covering what the vendor can see, control-plane high availability, a status page, an SLA, a bug bounty, or what happens to existing connections if the vendor's service goes down. 9 11 12 21
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting entity and data controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA data-protection representative, and where the control plane, logs and identities are hosted is not stated. A privacy policy and a data processing agreement are published, transfers rely on EU adequacy decisions or standard contractual clauses, and subprocessors appear only as categories with the actual list available on request — the standard non-EU-vendor baseline rather than a European chain. 3 10 11 12
The DevOps Engineer
The contracting entity is Nord Security Inc. in New York, with nordsec B.V. in Amsterdam named only as the EEA data-protection representative; a privacy policy with SCC-based transfer safeguards exists, a data processing agreement link appears on the pricing and integrations pages, and subprocessors appear only as categories such as servers, support and analytics (Google Analytics, Hotjar, Appcues). The captured pages state no location for hosting of the control plane, identities or logs, so the chain is US-contracted with no evidenced EU processing. 7 9 10 11
The MSP Technician
The contracting entity and controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA data-protection representative, and GDPR claims rest on adequacy decisions and standard contractual clauses for transfers. A privacy policy and a data processing agreement link exist, but we found no public information on where the control plane, logs or identities are hosted, and subprocessors appear only as categories with the named list available on request — a US-governed chain I could not present to a German client as European. 10 11 12
The Operations Manager
The contracting entity and controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam named only as an EEA data-protection representative; where account data and logs are hosted is not stated, subprocessors appear as categories with the list available on request, and transfers rely on adequacy decisions or standard contractual clauses. A data processing agreement is linked on the vendor's own pages, which keeps this above the floor, but the chain remains a US company and I found no public information on EU hosting of the control plane or logs. 7 9 10 11
The Information Security Officer
The contracting party and controller is Nord Security Inc. of New York, with nordsec B.V. in Amsterdam acting only as the EEA representative, and we found no public information on where account data, user and device identities, connection logs or configuration are stored, or on any named subprocessors — the privacy policy lists only categories, and the subprocessor list is available on request. A privacy policy, GDPR transfer safeguards via adequacy decisions or standard contractual clauses, and a data processing agreement link exist, which is the minimum position I could take to a DPO, not the European chain of custody I want for a NIS2 environment. 7 10 11 12
The Skeptic
The contracting entity and controller is Nord Security Inc. of New York; nordsec B.V. in Amsterdam appears only as an EEA data-protection representative, not the contracting party. A privacy policy, a data processing agreement and SCC-based transfer safeguards exist, subprocessors are described by category with a named list available on request, but the captured pages do not state where the control plane, logs and identities are hosted. 7 9 10 11 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The Premium plan is public at $14 per user per month, the dedicated server for site-to-site at $40 per month, the Enterprise offer from $6 per user per month over 200 seats, VAT charged on top, monthly or annual billing with the annual plan cheaper, prorated additions and a 14-day refund. But we found no public per-user price for the Core plan, no price for the dedicated IP itself beyond which plans support it, and no numeric annual rate, so the real annual total for my 140 people is not computable from the captured pages. 3 4 5 9 10 14
The DevOps Engineer
The Premium plan starts at $14 per user per month with site-to-site requiring Premium plus $40 per month for a dedicated server, an Enterprise offer runs from $6 per user per month on the Lite plan with a 200-seat minimum, billing is monthly or annual with annual cheaper, taxes are added on top of USD pricing, licenses are transferable, and there is a 14-day money-back guarantee. The feature-to-tier mapping is partial — device posture needs Premium, a dedicated IP is available on Core or Premium — and I found no public information on a standalone Core or Lite price or the price of the dedicated IP itself, so a real annual total is not computable from these pages. 4 5 9 13 14
The MSP Technician
Premium is published at $14 per user per month with a dedicated server at $40 per month for site-to-site, the Enterprise offer is from $6 per user per month for teams over 200 seats, billing is monthly or annual, licences transfer between employees, add-ons are prorated, and VAT is added on top in USD. Dedicated IPs are purchasable on Core and Premium but unpriced, and we found no public information on per-user prices for the Core and Lite plans or which tier carries SSO or provisioning, so I could not compute a full annual quote for a 40-user client without contacting the vendor. 4 9 10 14
The Operations Manager
The Premium plan is public at $14 per user per month with a dedicated server at $40 per month for site-to-site, an Enterprise offer runs from $6 per user per month with the Lite plan for teams over 200 seats, and billing frequency, VAT treatment, a 14-day money-back guarantee and proration are all stated. The dedicated IP is purchasable through the account but never priced, the Core plan's per-user price is not shown, and the pages do not say which tier single sign-on requires, so I cannot compute a full annual cost from public pages alone. 4 5 9 10 13 14
The Information Security Officer
Per-user prices are public — Premium from $14 per user per month plus a $40 monthly dedicated server, and an Enterprise offer from $6 per user per month with the Lite plan for teams over 200 seats — alongside monthly or annual billing, VAT charged additionally in USD, prorated additions, a 14-day money-back guarantee and named payment methods. We found no public information on the Core plan price or the cost of a dedicated IP purchased through the account, so the real annual total for our seat count and sites is not fully computable from the captured pages. 4 9 10 14
The Skeptic
The Premium plan is public at $14 per user per month plus $40 per month for a dedicated server, with monthly versus annual billing, VAT charged additionally, prorated add-ons and a 14-day money-back guarantee stated. Prices for the Core and Lite plans and for the dedicated IP itself are not shown — the Enterprise offer is 'From $6 USER/ MONTH With Lite plan' only for teams over 200 seats — so a buyer cannot compute the cost of the lower tiers from these pages. 4 5 9 10 14
European sovereignty — proven facts
1 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in US ⚠ unverified | 0/2 pts | 11 Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about NordLayer
Is NordLayer European?
No. whats-best.ai classifies NordLayer as Rest of world. Its vendor, Nord Security Inc., is incorporated in United States, per the vendor’s page captured 5 Nov 2026.
Where does NordLayer store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does NordLayer have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to NordLayer?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: NordLayer alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Legal entity. The same policy names an EEA representative, nordsec B.V. (Amsterdam, The Netherlands), but that entity is only a data-protection representative, not the contracting legal entity.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 35 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage nordlayer.com Checked 5 Nov 2026 Details →
- 2 Features page nordlayer.com Checked 5 Nov 2026 Details →
- 3 Features page (zero trust network access) nordlayer.com Checked 5 Nov 2026 Details →
- 4 Features page (site-to-site VPN) nordlayer.com Checked 5 Nov 2026 Details →
- 5 Features page (device posture) nordlayer.com Checked 5 Nov 2026 Details →
- 6 Features page (log integrations) nordlayer.com Checked 5 Nov 2026 Details →
- 7 Integrations page nordlayer.com Checked 5 Nov 2026 Details →
- 8 Documentation help.nordlayer.com Checked 5 Nov 2026 Details →
- 9 Pricing page nordlayer.com Checked 5 Nov 2026 Details →
- 10 Terms of service (names the operating company) nordlayer.com Checked 5 Nov 2026 Details →
- 11 Privacy policy nordlayer.com Checked 5 Nov 2026 Details →
- 12 Security / trust page trust.nordlayer.com Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap nordlayer.com Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap nordlayer.com Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap help.nordlayer.com Checked 5 Nov 2026 Details →