NordLayer review
by Nord Security Inc.Zero-trust access and business VPN
A business VPN with shared gateways in 40+ countries and a dedicated-IP server for private access, from $8 per user a month billed yearly (5-user minimum).
- Paid only
- Self-serve
- Per seat
- Public prices
What you're paying for
- Built-in reach (main value)
- Compliance included
A business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan.
NordLayer gives each user an app (NordLynx, built on WireGuard, or OpenVPN) that connects to shared gateways in 40+ countries, or to a dedicated server with your own IP, which Core and Premium require. Admins assign Teams to each gateway and set DNS filtering by category; port and protocol rules (Cloud Firewall) are included on Premium and through sales on Core. SSO with Okta, Entra ID, OneLogin, Google and JumpCloud is on every plan, and the compliance file includes SOC 2 Type 2, ISO 27001 and a BAA for yearly subscribers.
- Shared and dedicated gatewaysShared gateways in 40+ countries are on every plan; Virtual Private Gateways on a dedicated IP server start on Core, at $40 a month billed yearly.Evidence: Pricing page (2026-10-16)
- BAA for yearly subscribersThe HIPAA help article offers a BAA to customers with a yearly or longer subscription, on request; SOC 2 Type 2 and ISO 27001:2022 documents are requested through the trust center.Evidence: HIPAA BAA and security compliance help articles (2026-10-16)
- SSO on every planSSO with Okta, Entra ID, OneLogin, Google and JumpCloud covers both the apps and the Control Panel, from Lite.Evidence: Pricing page and MFA and SSO help article (2026-10-16)
- Logs kept 60 days on every planActivity reports for connections and admin actions are kept for the past 60 days regardless of plan, with CSV download.Evidence: Activity information help article (2026-10-16)
- Best for
- Teams that want a managed business VPN with a fixed egress IP and internet filtering, plus private access to servers through dedicated gateways.
- Good to know
- Core and Premium require a dedicated server at $40 a month billed yearly ($50 monthly) on top of the per-user price, and there is no free plan.
How NordLayer compares
Against 3 other products we reviewed in Zero-trust access and business VPN: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | NordLayer | Cloudflare Zero Trust | Twingate | Tailscale |
|---|---|---|---|---|
| What you're paying for | Built-in reachA business VPN with gateways in 40+ countries, a dedicated IP for your team, and SSO, DNS filtering and posture monitoring on one per-user plan. | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. |
| Overall score | 6.2 | 8.2Best | 7.3 | 6.8 |
| Free option | Paid only | Free plan | Free plan | Free plan |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $8/user/mo | $7/user/mo | $5/user/mo | $8/user/mo |
| Pricing model | Per seat | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium | Per user who authenticates; no device count published | Per user per month, counting admins, pending and disabled users and service accounts | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each |
| Free option | No free plan; 14-day money-back guarantee on the first purchase | Free plan for up to 50 users, business use allowed; no trial | Starter: free for 5 users; 14-day trial of paid plans | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains |
| Reference scenario (25 users) | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed | $0/mo on Free (25 of 50 users), computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $200/mo on Standard ($8 × 25), $8 per user, computed |
| Annual vs monthly price | Core $11 yearly or $14 monthly; server $40 or $50 | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Teams $5 yearly or $6 monthly; Business $10 or $12 | One price per plan with no billing term; annual plans through sales |
| Devices per user | 6 simultaneous connections | Not stated | 5 on every plan; custom on Enterprise | Unlimited on every plan |
| Okta / Entra ID sign-in | Every plan | Every plan (any SAML or OIDC provider) | Business and up; Google Workspace on every plan | Every plan (OIDC) |
| SCIM | Premium; unpriced add-on on Lite and Core | SAML and OIDC providers; no plan restriction stated | Business and up (Okta SCIM) | Standard and up (Okta, Entra ID, Google Workspace) |
| Device posture | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan | Built-in checks and EDR or MDM integrations on every plan | Native checks on every plan; MDM and EDR integrations from Business | Built-in checks on every plan; MDM and EDR integrations from Standard |
| Network flow logs | Every plan, 60 days | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Premium and up, 30 days |
| SIEM streaming | CrowdStrike Falcon Next-Gen SIEM; plan not stated | Logpush on Contract per the plans page; the docs say all customers | Business and up per the docs; the plan table also ticks Home | Premium and up |
| Self-hosted parts | None | cloudflared connector (open source) | Connectors (always customer-run) | DERP relays and peer relays |
| SOC 2 / ISO 27001 | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type II (on request); ISO 27001 not stated |
| HIPAA BAA | Yearly subscriptions, on request | Enterprise-level customers handling PHI | Not stated; the HIPAA page says to ask by email | Not offered |
| EU data storage | Not stated | Data Localization Suite, Enterprise add-on | No; data stored in the US | Not guaranteed; coordination server in Frankfurt |
| Bottom line | From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider. | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. |
Evidence: NordLayer: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 7.0 / 10, Good
- scenario plan priced; can be bought online; annual and monthly prices published; pricing page says SOC 2 Type I, while the help center and SOC 2 page say Type 2; Enterprise card shows "From $10" monthly next to a note that the offer applies to yearly plans only; user provisioning and posture-blocking add-ons not priced, and Cloud Firewall on Core priced by sales
- Price for 25 users
- 6.2 / 10, Good
- $315/mo: Core at $11 × 25 users, billed annually; plus $40/mo for the required dedicated server with a dedicated IP; $12.60 per user per month; SSO with Okta or Entra ID, access to Virtual Private Gateways by Team, and the 60-day admin activity log are on Core (Lite has no Virtual Private Gateway for private servers); port and protocol rules (Cloud Firewall) are through sales on Core and included on Premium; assumes one dedicated server is enough to reach the 10 servers, with access granted by Team per gateway rather than per server
- Free plan and trial
- 1.0 / 10, Fair
- no free plan; no trial stated; 14-day money-back guarantee
- Access controls
- 8.7 / 10, Excellent
- Okta or Entra ID sign-in on the scenario plan; SCIM on a higher self-serve plan; group or port rules on the scenario plan; posture with MDM or EDR on the scenario plan; connectors or subnet routing on a higher self-serve plan; DNS filtering or web gateway on the scenario plan; group access is by Team per gateway on Core, with port and protocol rules (Cloud Firewall) through sales; posture monitoring on Core, with SentinelOne and CrowdStrike integrations on every plan; blocking on Premium or an unpriced Core add-on
- Visibility and exit
- 6.5 / 10, Good
- audit log on the scenario plan; flow logs on the scenario plan; flow logs kept 60 days on the scenario plan; SIEM streaming on the scenario plan; no admin API or Terraform; no policy export described; nothing self-hosted; SIEM forwarding to CrowdStrike Falcon Next-Gen SIEM only, no plan restriction stated
- Compliance and data
- 8.0 / 10, Excellent
- SOC 2 Type II, ISO 27001, HIPAA BAA on the scenario plan, self-serve DPA, EU data storage not listed, admin-console SSO on the scenario plan, subprocessor list on request only, BAA for yearly subscriptions, on request; the pricing page says SOC 2 Type I, other pages Type 2
Review
Review from public pages
Written from NordLayer's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read NordLayer's pricing page and plan cards, the terms of service, DPA, privacy policy and press area, and help center articles on plan migration, dedicated servers, device limits, SSO, device posture, site-to-site, DNS filtering, activity reports, SIEM forwarding, HIPAA, security compliance, refunds and cancellation on Oct 16, 2026. We did not sign up or buy a plan. The compliance details here come from the help center articles rather than the trust center.
Prices are clear: Lite, Core and Premium are $8, $11 and $14 per user a month billed yearly and $10, $14 and $18 monthly, with a 5-user minimum, and Core and Premium require a dedicated server with a dedicated IP at $40 a month yearly or $50 monthly. Enterprise starts at 200 users through sales.
Two statements need a question to NordLayer: the pricing page says NordLayer meets "SOC 2 Type I" requirements while the help center and SOC 2 page say Type 2, and the Enterprise card shows "From $10" monthly next to a note that the offer applies to yearly plans only. A help center summary also cites ISO 27001:2013 while the article cites ISO/IEC 27001:2022.
Strengths
- SSO with the main identity providers on every plan
Okta, Entra ID, OneLogin, Google and JumpCloud SSO are included from Lite, for the apps and the Control Panel.
vs Twingate: Twingate starts Okta and Entra ID sign-in on Business.
- A fixed IP and egress in 40+ countries
A dedicated server gives the team its own IP, and shared gateways cover 40+ countries on every plan.
vs Tailscale: Tailscale, Twingate and ZeroTier rely on exit nodes you run yourself for a fixed egress IP.
- Logs kept 60 days on every plan
Connection and admin activity reports are kept 60 days on every plan, with CSV download and forwarding to CrowdStrike Falcon Next-Gen SIEM.
vs Twingate: Cloudflare’s Free plan keeps network logs 24 hours and Twingate Teams 7 days.
- ISO 27001 and a BAA
The help center lists ISO/IEC 27001:2022 and SOC 2 Type 2, and a BAA for yearly subscribers.
Things to know
- A dedicated server is required from Core
Core and Premium need a dedicated server at $40 a month billed yearly ($50 monthly), and each dedicated server needs its own license.
- No free plan or published trial
There is no free plan; the "risk-free" offer is a 14-day money-back guarantee on the first purchase, requested by email.
Workaround: The pricing page says the Control Panel can be explored for free before buying.
- No admin API or Terraform provider
No general admin API or Terraform provider is documented; custom-integration webhooks can only log out a user or device, and the Service Management Portal API is for MSPs.
- Several controls are Premium or unpriced add-ons
SCIM, posture blocking and site-to-site are on Premium; on Core, SCIM and posture blocking are add-ons without a published price and Cloud Firewall is through sales.
Pricing reality
NordLayer bills per user a month with a 5-user minimum, plus a dedicated server on Core and Premium. For our scenario, 25 users on Core cost 25 × $11 + $40 = $315 a month billed yearly, or $12.60 per user (computed); month to month it is 25 × $14 + $50 = $400. One server is our assumption; each additional server is another $40 or $50. Premium ($14 yearly) adds SCIM, posture blocking, site-to-site and Cloud Firewall. CrowdStrike Falcon Go and Enterprise add-ons are $2 and $9 per device a month. Each user may connect 6 devices at once, browser extensions and manual configurations included. Lowering the license count goes through support, and renewals are not refunded.
Exit path
Members export as CSV and activity reports download as CSV; no export of gateways, firewall rules or policies is documented, and firewall rules are lost when a gateway is deleted. After cancelling, access lasts to the end of the period, then a 7-day grace period keeps the same gateways and private IPs if you resubscribe.
Compared with
- Pick NordLayer when
- You want a dedicated static IP and a HIPAA BAA on a self-serve yearly plan.
- Pick Cloudflare Zero Trust when
- You want a free plan for up to 50 users and an admin API with a Terraform provider.
- Pick NordLayer when
- You want Okta or Entra ID SSO on the entry plan and internet egress through managed gateways.
- Pick Twingate when
- You want per-resource access through your own connectors at $5 per user without a server fee.
- Pick NordLayer when
- You want vendor-run gateways and a fixed IP rather than exit nodes you run.
- Pick Tailscale when
- You want unlimited devices per user, policy as code and an admin API.
Choose it if
- You want a managed VPN with a dedicated IP for allowlisting.
- You sign in with Okta, Entra ID, OneLogin, Google or JumpCloud and want SSO on the entry plan.
- You need a HIPAA BAA on a self-serve yearly subscription.
Look elsewhere if
- You want a free plan, or a trial without paying first.
- You manage your network through an API or Terraform.
Bottom line
From its public pages, NordLayer is a managed business VPN with SSO on every plan, a fixed IP and a strong compliance file. The required server raises the per-user cost on Core, and there is no free plan, admin API or Terraform provider.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Billing unit | Per user per month, 5-user minimum, plus a dedicated server on Core and Premium |
| Free option | No free plan; 14-day money-back guarantee on the first purchase |
| Reference scenario (25 users) | $315/mo on Core ($11 × 25 + $40 server, yearly), $12.60 per user, computed |
| Annual vs monthly price | Core $11 yearly or $14 monthly; server $40 or $50 |
| Devices per user | 6 simultaneous connections |
| Okta / Entra ID sign-in | Every plan |
| SCIM | Premium; unpriced add-on on Lite and Core |
| Device posture | Monitoring on Core, blocking on Premium; SentinelOne and CrowdStrike integrations on every plan |
| Network flow logs | Every plan, 60 days |
| SIEM streaming | CrowdStrike Falcon Next-Gen SIEM; plan not stated |
| Self-hosted parts | None |
| SOC 2 / ISO 27001 | SOC 2 Type 2 (Type I on the pricing page); ISO/IEC 27001:2022 |
| HIPAA BAA | Yearly subscriptions, on request |
| EU data storage | Not stated |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for NordLayer yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for NordLayer yet.
NordLayer lists 4 plans. The cheapest paid plan, Lite (billed yearly), costs $8/user/mo.
- NordLayerLite$8/user/moBilled yearly; $10 month to month; 5 users minimum
- Shared gateways in 40+ countries
- SSO with Okta, Entra ID, OneLogin, Google and JumpCloud
- Activity reports kept 60 days
- No Virtual Private Gateway
- NordLayerCore$11/user/moBilled yearly; $14 month to month; plus a required dedicated server at $40/mo yearly ($50 monthly)
- Virtual Private Gateways on a dedicated IP
- Gateway access by Team
- DNS filtering by category and Application Blocker
- Device posture monitoring
- NordLayerPremium$14/user/moBilled yearly; $18 month to month; plus a required dedicated server
- User provisioning with Entra ID and Okta
- Device posture blocking
- Site-to-site and Cloud Firewall
- Priority support
- NordLayerEnterprise offerFrom $6/user/moYearly, starting with Lite capabilities; 200 users minimum; through sales
- Virtual Private Gateway locations in up to 60 countries
- Custom plan and features
- Premium support
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: nordlayer.com pricing page. Prices change; the observed date above is when our agent read them.