# NordLayer — Business VPN & Zero Trust Access

NordLayer by Nord Security Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: 1 of 6 dimensions proven.

- Vendor: Nord Security Inc. (https://nordlayer.com)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/nordlayer
- Alternatives: https://whats-best.ai/software/business-vpn/nordlayer/alternatives ([markdown](https://whats-best.ai/software/business-vpn/nordlayer/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Nord Security Inc.
- Headquarters: Incorporated in United States [S11]
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

NordLayer, a business VPN and zero trust access service from Nord Security Inc., scored highest on identity and policy, 6 to 7, and access and connectivity, 6 to 7. Judges credited single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, SCIM provisioning, centrally enforced MFA and device posture checks that block non-compliant devices, alongside clients for Windows, macOS, Linux, iOS and Android, a browser extension, and site-to-site links to AWS, Google Cloud and IBM Cloud. Weakest is sovereignty, flat at 3: the contracting entity and controller is Nord Security Inc. of New York, nordsec B.V. in Amsterdam appears only as an EEA data-protection representative, and we found no public information on where the control plane, logs or identities are hosted. Architecture and assurance ranged 4 to 5, the range reflecting how much weight the judges gave to ISO 27001 and SOC 2 statements whose reports are offered on request; pricing transparency ranged 5 to 6, with Core and Lite prices not shown. Scores cluster within a point, and no disagreement was flagged between judges.

**Speaks for it:**
- Single sign-on with Entra ID, Google, Okta, JumpCloud and OneLogin, plus SCIM provisioning that adds and removes members automatically.
- Device posture checks for approved OS, updates, jailbreak or root and unknown devices automatically block non-compliant accounts.
- Clients for Windows, macOS, Linux, iOS and Android plus a browser extension, with dedicated fixed IPs and site-to-site links to AWS, Google Cloud and IBM Cloud.
- Six activity views are filterable, exportable as CSV and kept for 60 days, with control-panel and network-connection logs forwarding to CrowdStrike Falcon.
- Deployment is advertised in under ten minutes, Windows rollout is documented for Intune with silent install flags, and 24/7 live chat averages a response under a minute.

**Held against it:**
- Sovereignty is the weakest result at 3: the contracting entity and controller is Nord Security Inc. of New York, nordsec B.V. appears only as an EEA data-protection representative, and we found no public information on where the control plane, logs or identities are hosted.
- Audit artifacts — the ISO 27001 certificate, SOC 2 report, penetration-test report and subprocessor list — are offered on request rather than published.
- Activity data is retained 60 days regardless of plan, can lag up to 24 hours, and documented log forwarding is to CrowdStrike Falcon only.
- We found no public information on a documented REST API, Terraform or configuration as code, a multi-tenant console, or a self-hosted edition.
- The Core and Lite per-user prices and the price of a dedicated IP are not shown on the captured pages, so the lower tiers cannot be costed without contacting the vendor.

**Best for:**
- You need business VPN access governed by single sign-on, SCIM provisioning and device posture checks that automatically block non-compliant devices.
- Your team rolls out Windows clients through Intune and wants a set-up advertised in under ten minutes with 24/7 live chat.
- You link offices or plants into AWS, Google Cloud or IBM Cloud over site-to-site VPN with dedicated fixed IPs.
- You already run CrowdStrike Falcon and can work within 60-day activity retention.

**Avoid if:**
- You require a European contracting and hosting chain — the contracting entity and controller is Nord Security Inc. of New York, and the captured pages state no location for hosting of the control plane, identities or logs.
- Your team manages access infrastructure as code — ask the vendor: the public pages we read do not show it
- You need audit evidence older than 60 days or near-real-time logs — activity data is kept 60 days regardless of plan and can lag up to 24 hours.
- You must compute a full annual cost before contacting the vendor — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| Identity, access policy & device posture | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Logs, audit trail & incident response | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Deployment, API & administration | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Architecture, reliability & security assurance | 2/5 | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| **Weighted verdict** | **2.5/5** | **3/5** | **2.5/5** | **3/5** | **2.5/5** | **2.5/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 6 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Incorporated in US | 0/2 | [S11] |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- CCPA: yes [S11]
- Control categories: Business Continuity & Incident Response · Data Governance & Privacy · Information Security & Infrastructure · People & Organizational Security [S12]
- Controls count: 25 [S12]
- Cross border safeguards: EU adequacy decision · EU standard contractual clauses [S11]
- Data centers certified: yes [S11]
- Documents available: on request · NordLayer AI Scout Subprocessors · NordLayer HIPAA Report · NordLayer ISO 27001 Certificate · NordLayer Nord Security - SOC 2 Type 2 · NordLayer Penetration Test Report · NordLayer Subprocessors [S12]
- Encryption: AES-256 and ChaCha20 encryption [S2]
- Encryption: AES-256 · ChaCha20 [S9]
- External audits: yes [S11]
- GDPR: yes [S2]
- GDPR: yes · EU SCCs and other international models [S11]
- HIPAA: yes [S2]
- HIPAA: yes [S9]
- HIPAA: yes [S12]
- ISO 27001: yes [S9]
- ISO 27001: yes [S2]
- ISO 27001: yes [S12]
- Opt out sale share: disabling third-party cookies via cookie banner / footer link · yes [S11]
- Page updated: 2026-11-03 [S12]
- Pci dss: yes [S2]
- Pentest report: yes [S12]
- Sanctions: Belarus · Cuba · Iran · North Korea · Russia · Syria · restricted regions of Ukraine [S10]
- Security measures: yes · yes [S11]
- SOC 2: yes [S9]
- SOC 2 type2: yes [S12]
- SOC 2 type 2: yes [S2]

**Data**
- Deletion on termination: commercially reasonable period · yes [S10]
- Deletion request: support@nordlayer.com · yes [S11]
- Minors age limit: 18 [S11]
- Retention controller: As controller, data retained only as long as necessary for purpose or legal requirements [S11]
- Retention end users: per Customer instructions [S11]

**Hosting**
- Locations: 40 [S4]

**Integrations**
- Builtin partners: Jamf Cloud · SentinelOne [S7]
- Cloud networks: AWS · Google Cloud · IBM Cloud · Entra ID Cloud [S7]
- Crowdstrike: CrowdStrike [S4]
- Crowdstrike bundle: CrowdStrike · network and endpoint protection bundle for SMBs [S3]
- Crowdstrike setup: Setup via toggling the integration in NordLayer Control Panel and pasting API URL and API Key [S17]
- Crowdstrike siem: CrowdStrike Falcon Next-Gen SIEM integration forwards Control Panel Actions and Network Connections logs to CrowdStrike [S17]
- Custom integrations capability: Automatically log out users and disconnect them from gateways when third-party security tools detect a threat [S7]
- Iam providers: Okta · Google Workspace · Jumpcloud · Entra ID · OneLogin [S7]
- Platform features: Custom DNS · dedicated IP · VPN Split Tunneling [S4]
- SSO and provisioning: yes · yes [S7]

**Legal**
- Authorized partners: yes · yes [S10]
- Class action waiver: yes [S10]
- Contracting entity: Nord Security Inc. · NordLayer [S10]
- Controller entity: Americas Towers, 1177 6th Avenue, 5th FLR, New York, NY 10036, United States of America · Nord Security Inc. [S11]
- Copyright: 2026 · Nord Security [S6]
- Copyright entity: 2026 · Nord Security [S3]
- Copyright holder: 2026 · Nord Security [S2]
- Copyright holder: 2026 · Nord Security [S5]
- Data processing agreement: yes [S4]
- Data processing agreement: yes [S7]
- DPA: yes [S6]
- DPA: yes [S9]
- DPA available: yes [S3]
- Dsa transparency report: yes [S10]
- Eea representative: Fred. Roeskestraat 115, 1076 EE Amsterdam, The Netherlands · nordsec B.V. [S11]
- Governing law: English · England and Wales, London, United Kingdom [S10]
- Last updated: 2026-08-20 [S10]
- Last updated: 2026-02-13 [S11]
- Liability cap: 12 months of fees paid · 50 [S10]
- Links: Privacy Policy and Terms of Service links available [S12]
- Termination cure period: 30 · 90 [S10]

**Pricing**
- Billing frequency: monthly · annual [S9]
- Billing model: automatic unless cancelled · yes [S10]
- Core plan ztna: ZTNA tools available · more sophisticated features [S3]
- Dedicated ip purchase: Core · Premium · NordLayer account [S14]
- Dedicated server price: USD · 14 · 40 [S4]
- Enterprise offer: Enterprise offer · 200 · 6 [S9]
- Free trial: yes · yes [S10]
- Introductory discount: initial period may be discounted [S10]
- License transfer: yes [S9]
- Money back guarantee: 14 [S4]
- Money back guarantee: 14 · yes [S7]
- Money back guarantee: 14 [S9]
- Money back guarantee days: 14 [S3]
- Payment methods: bank transfer · Visa · Mastercard · American Express · Discover [S9]
- Plan modifications prorated: yes [S10]
- Plan requirement: Core · Premium · Server with a dedicated IP [S13]
- Premium plan price: Premium · USD · 14 [S4]
- Prorated addons: yes [S9]
- Refund channel: support@nordlayer.com [S10]
- Refund exceptions: no · no · no · no [S10]
- Refund policy: 14 [S9]
- Refund window: 14 · initial purchase only [S10]
- Tax: USD · no [S9]
- Taxes exclusive: yes [S10]

**Product**
- 2FA methods: SMS · TOTP [S15]
- 2FA scope: central · personal [S15]
- Action scope: individual users · no [S6]
- Actions section: Admin action audit log, filterable/sortable/searchable by action, date, member name, or IP source address [S18]
- Activity log delay: no · 24 [S18]
- Activity retention: yes · 60 · yes [S18]
- Activity types: 6 · Connections · Actions · Failed logins · Download Protection · Visited domains · Browser extensions [S18]
- Affiliate cookies: yes [S11]
- Always on vpn: Always-On VPN & Kill switch [S6]
- Always on vpn: Ensures VPN connection is used for internet access; device restricted from internet if VPN drops until restored [S22]
- Analytics providers: Google Analytics · Hotjar · Appcues [S11]
- App connection controls: Control Panel security controls giving IT administrators greater control over application settings [S22]
- Application blocker: Application Blocker: block certain protocols and ports [S13]
- Audit history reports: yes [S5]
- Autodisconnect: Disconnects affected user and invalidates credentials on alert [S6]
- Automatic blocking and notification: yes · yes [S5]
- Availability: yes [S6]
- Avg deployment time: 10 [S3]
- Benefits: Secure perimeter: safe perimeter to protect and connect business information and authorized users/devices [S13]
- Biometric authentication: Face recognition and fingerprint scanning before connecting to private gateways [S2]
- Block noncompliant accounts: yes [S5]
- Browser extension capabilities: block uploads, downloads, copy-paste [S9]
- Browser extensions section: Browser extension installations, removals, and status changes [S18]
- Business only: Services developed for businesses and organizations; consumer protection laws disclaimed [S10]
- Call recording: yes · yes [S11]
- Central asset catalog: yes [S5]
- Cloud connectivity: AWS · Google Cloud · IBM Cloud [S4]
- Cloud firewall: Granular network segmentation for hybrid infrastructure [S2]
- Cloud firewall: Cloud Firewall with granular network rules [S6]
- Cloud lan: Interconnect distant devices for secure file sharing and remote control [S2]
- Cloud lan: Cloud LAN remote device access, cuttable on incident [S6]
- Cloud lan: Cloud LAN connects devices to access resources [S13]
- Compatibility: webhooks · JSON payloads [S6]
- Connections privacy limits: no [S18]
- Connections section: Connection sessions with filters by date and status, showing connection/disconnection times, devices, and servers [S18]
- Control panel: Control Panel interface for account oversight and security policy customization [S2]
- Control panel config: Device posture checks are defined in the Control Panel: approved OS, OS/app updates, jailbreak/root detection, unknown device detection [S5]
- Control panel demo: yes [S5]
- Control panel demo features: Custom DNS · dedicated IP · VPN split tunneling [S3]
- Custom dns: Custom DNS routing supported [S13]
- Custom integrations: Connect NordLayer with existing security tools to automate incident response [S6]
- Customer admin visibility: Organization admin can see connection timestamps, hostname, connected server, origin IP [S11]
- Customer count: 15000+ [S3]
- Dashboards: Network activity view: user connections, devices, server performance [S2]
- Data subject rights: Delete · Access · Rectify · Object · Portability · Restrict · Withdraw consent · Lodge a complaint [S11]
- Dedicated ip: IP allowlisting with a Dedicated IP [S6]
- Dedicated ip definition: A Dedicated IP is a unique IP address assigned exclusively to your company, unifying employee connections under a single trusted entry point [S14]
- Dedicated ip pricing page: Core · yes [S14]
- Dedicated ip server: Dedicated IP server for IP address management and allowlisting [S2]
- Deployment time: Deployment in less than ten minutes [S2]
- Device history tracking: yes [S5]
- Device posture: Device Posture Security sets compliance standards, checks each connecting device, and takes action against non-compliant devices [S5]
- Device posture blocking: yes [S5]
- Device posture download protection: Device Posture Security · Download Protection · yes [S11]

**Subprocessors**
- Categories: IT · servers · marketing · customer support · data storage · website customization · website analytics · accounting · legal · agency [S11]

**Support**
- Availability: yes [S2]
- Cancellation method: https://help.nordlayer.com/docs/how-to-cancel-nordlayer-subscription · NordLayer Control Panel [S10]
- Chat: Live chat support available via 'Chat with support' at the bottom of the page [S17]
- Gartner rating: 2026-08-03 · 4.6 · Security Service Edge · 101 [S3]
- Help center: yes [S2]
- Intune live chat: live chat · yes [S19]
- Live chat: yes [S8]
- Live chat: live chat · yes [S15]
- Live chat: yes [S16]
- Live chat: live chat [S20]
- Live chat: yes [S18]
- Live chat: Live chat support contact [S21]
- Live chat: yes [S22]
- Msp model: MSP provides first-level support; NordLayer provides second-level support for MSP purchases [S10]
- Response time: Average response time under a minute [S2]
- Roles model: owner role manages billing, central security features, member lists, member permissions [S10]

106 more facts on the canonical page: https://whats-best.ai/software/business-vpn/nordlayer

## Questions

### Is NordLayer European?

No. whats-best.ai classifies NordLayer as Rest of world. Its vendor, Nord Security Inc., is incorporated in United States, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19235).

### Where does NordLayer store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does NordLayer have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to NordLayer?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [NordLayer alternatives](https://whats-best.ai/software/business-vpn/nordlayer/alternatives).

## Head-to-head

- [NordLayer vs Tailscale](https://whats-best.ai/compare/nordlayer-vs-tailscale.md)

## What this page leaves out

- 35 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor homepage: https://nordlayer.com/ (checked 2026-11-05)
- [S2] Features page: https://nordlayer.com/features/ (checked 2026-11-05)
- [S3] Features page (zero trust network access): https://nordlayer.com/zero-trust/network-access/ (checked 2026-11-05)
- [S4] Features page (site-to-site VPN): https://nordlayer.com/features/site-to-site-vpn/ (checked 2026-11-05)
- [S5] Features page (device posture): https://nordlayer.com/features/device-posture-security/ (checked 2026-11-05)
- [S6] Features page (log integrations): https://nordlayer.com/features/custom-integrations/ (checked 2026-11-05)
- [S7] Integrations page: https://nordlayer.com/integrations/ (checked 2026-11-05)
- [S8] Documentation: https://help.nordlayer.com/ (checked 2026-11-05)
- [S9] Pricing page: https://nordlayer.com/pricing/ (checked 2026-11-05)
- [S10] Terms of service (names the operating company): https://nordlayer.com/terms-of-service/ (checked 2026-11-05)
- [S11] Privacy policy: https://nordlayer.com/privacy-policy/ (checked 2026-11-05)
- [S12] Security / trust page: https://trust.nordlayer.com/ (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://nordlayer.com/features/vpn-gateway/ (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://nordlayer.com/features/dedicated-ip/ (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://help.nordlayer.com/docs/mfa-sso (checked 2026-11-05)
- [S16] Identity, access policy & device posture — found from sitemap: https://help.nordlayer.com/docs/single-sign-on-sso (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://help.nordlayer.com/docs/forwarding-nordlayer-logs-to-crowdstrike-via-siem (checked 2026-11-05)
- [S18] Logs, audit trail & incident response — found from sitemap: https://help.nordlayer.com/docs/activity-information (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://help.nordlayer.com/docs/centralized-distribution-microsoft-intune (checked 2026-11-05)
- [S20] Deployment, API & administration — found from sitemap: https://help.nordlayer.com/docs/what-are-the-owner-team-administrator-and-member-roles (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://help.nordlayer.com/docs/security (checked 2026-11-05)
- [S22] Architecture, reliability & security assurance — found from sitemap: https://help.nordlayer.com/docs/security-controls (checked 2026-11-05)

---

Cite as: whats-best.ai, "NordLayer — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/nordlayer

Corrections: https://whats-best.ai/correct/1596?target=page