NordLayer

What Is NordLayer?

When you need remote employees to reach internal tools safely, “everyone install a consumer VPN” is the fast way to create a slow, unmanaged mess. You get no central control, no clean offboarding, and no way to enforce security basics (like MFA, device checks, or consistent routing) across the whole company.

NordLayer is built for that exact gap: centrally managed secure access for teams, with a Control Panel for admins and client apps for users. It positions itself as a business network security platform aligned to SASE and Zero Trust approaches, with a “business VPN” as one component alongside access control and threat-prevention features. (nordlayer.com)

It’s best understood as “business VPN plus policy and visibility.” You’re not just buying encrypted tunnels; you’re buying an administrative layer: teams, gateways, security configurations, and (depending on plan) private gateways with dedicated IPs, network segmentation, and additional controls. (nordlayer.com)

NordLayer Features and Performance

NordLayer’s core value is the combination of centrally managed VPN connectivity and business-grade access controls. On the VPN side, it supports OpenVPN (TCP), OpenVPN (UDP), and NordLynx (WireGuard-based). (VPNSpotter verified specs: OpenVPN UDP/TCP, NordLynx.) NordLayer’s own documentation describes NordLynx as built around WireGuard, with a design intended to avoid storing identifiable data on VPN servers using a double NAT approach.

Performance is where NordLynx typically matters. NordLayer markets “up to 1 Gbps” server performance and frames NordLynx as its faster protocol option. (nordlayer.com) In practice, your results will vary by gateway type (shared vs private), location, and routing policies—but the protocol lineup is modern enough for most business use cases where latency and throughput matter (video calls, large file transfers, cloud admin work).

Administration is the real differentiator versus a consumer VPN. NordLayer’s Control Panel is designed for managing users/teams and applying policies (for example: enabling Always On VPN, defining split tunneling behavior, and configuring gateway-level controls). The “Always On VPN” feature is explicitly described as restricting the device from internet access until the VPN reconnects if the tunnel drops—useful for traveling staff and unmanaged networks.

Split tunneling exists, and it’s not just a checkbox. NordLayer supports multiple split tunneling modes (include vs exclude) with configuration at the gateway level, and it notes that DNS requests are still resolved by the gateway and subject to DNS filtering and web protection policies even when some traffic bypasses the tunnel. The Control Panel changelog also describes “exclusive split tunneling” capabilities and preset exclusions for common conferencing tools (Zoom, Microsoft Teams, Google Meet) maintained by NordLayer.

Beyond VPN transport, NordLayer positions itself around Zero Trust and network segmentation: it describes role-based access and segmentation via teams/gateways, plus strong authentication (including MFA and SSO), and it emphasizes that users access company apps through an encrypted tunnel after authentication. (help.nordlayer.com) That’s the right model for hybrid teams: reduce implicit trust, reduce the blast radius, and keep offboarding clean.

One more “platform” angle: NordLayer is also pushing an “Enterprise Browser” (NordLayer Browser) as a separate control surface for web activity. The browser feature set and limitations are documented in the help center (for example: web protection supported, but device posture controls currently unavailable in the browser). If your biggest risk is browser-based SaaS data leakage and shadow IT, that might matter. If you just want VPN tunnels, it may be extra surface area you don’t need.

Pricing and Plans

NordLayer is paid, per-user, with plan tiers. On its pricing page, it lists four options: Lite, Core, Premium, and an Enterprise offer (for 200+ seats). It supports monthly or yearly billing, and it states a 5-user minimum for Lite/Core/Premium and a 200-user minimum for the Enterprise offer.

Confirmed yearly pricing (USD per user/month equivalents) shown on NordLayer’s pricing page: Lite at $8/user/month, Core at $11/user/month, and Premium at $14/user/month (when “Yearly” is selected). It also shows an Enterprise offer starting “from $6/user/month with Lite plan,” with pricing varying based on plan/features selected.

For monthly billing, NordLayer’s own “Get started” guide explicitly lists per-user monthly prices (and annual totals) for Lite/Core/Premium (e.g., Lite $10 billed monthly per user; Core $14 billed monthly per user; Premium $18 billed monthly per user). Because NordLayer’s pricing page emphasizes the yearly toggle and “save” language, treat that guide as the clearest source for the monthly amounts.

Add-ons and requirements matter. NordLayer’s pricing page states that for Core and Premium, a “Server with Dedicated IP +$40/month required” (i.e., private gateways/dedicated IP are tied to those plans as a required component). In other words: the headline per-user figure may not be your full cost if you need those capabilities.

Free trial and refunds: NordLayer’s terms state that a free trial may be offered in some cases, for a limited period specified in their communication, and can be limited or withdrawn at their discretion. (d7umqicpi7263.cloudfront.net) For refunds, the terms describe a 14-calendar-day refund window from the initial purchase date, with explicit exclusions (e.g., add-ons, renewals, partner purchases, certain payment methods). (d7umqicpi7263.cloudfront.net) This is tighter than the “30-day” norm you see in consumer VPNs—plan for it.

Privacy and Security Assessment

First, context: NordLayer is not a consumer anonymity tool. It’s a business product designed to give an organization control over how its people access internet resources and company resources. NordLayer explicitly frames itself around visibility into network activity/user behavior for compliance support, plus centralized security configurations and access management. (help.nordlayer.com)

Jurisdiction: VPNSpotter’s verified spec says jurisdiction is the United States. (Note: NordLayer’s public materials also reference a “NordLayer Trust Center” and compliance documents, but jurisdiction and corporate structure details can be complex; for this review we’re using the provided verified jurisdiction value.)

Logging and data handling: If you’re expecting a classic “no logs” consumer VPN stance, NordLayer’s own Data Processing Agreement is a reality check. It lists categories of personal data processed in connection with providing services, including device information (including IP address), activity/authentication/security logs, application diagnostics, connection timestamps, server the user was connected to, and approximate location based on IP address. It also describes additional data tied to optional features (for example: “download protection feature data” and “browser observability feature data (e.g. visited URLs, installed extensions, timestamps)”). That’s not “bad” for a business security platform—but it’s absolutely not the same privacy posture as a minimal-logs personal VPN.

Compliance posture: NordLayer’s help center states you can request compliance/security documentation via the NordLayer Trust Center, including an ISO 27001 certificate and a SOC 2 Type 2 report (plus HIPAA report and penetration test report). (help.nordlayer.com) Separately, NordLayer’s marketing site claims ISO 27001, SOC 2, HIPAA, and PCI-DSS compliance. (nordlayer.com) The key point: there are concrete, requestable documents listed, but you may need to request access (and potentially sign an NDA) to see them. (help.nordlayer.com)

Known criticisms / issues: Independent testing can surface problems that marketing pages don’t mention. A Comparitech review updated September 24, 2026 reports that NordLayer “fails to tunnel all IPv6 traffic,” warning that IPv6 traffic can leak outside the VPN tunnel on Windows unless IPv6 is disabled, and it also references DNS/IPv6 leaks. (comparitech.com) If your environment uses IPv6 heavily (or you can’t enforce device-level IPv6 settings), treat this as a serious red flag and validate it in your own testing before rollout.

Open-source posture: NordLayer describes NordLynx as built around WireGuard, but NordLayer itself does not present itself as an open-source client/service in the materials reviewed here. If “fully open-source clients + reproducible builds” is a requirement, you’ll need to verify what is and isn’t open.

Strengths and Limitations

Strengths

• Business-first management layer. NordLayer is designed around a central Control Panel with organization/team policies, not just end-user apps. (help.nordlayer.com)
• Modern protocol options. NordLynx (WireGuard-based) plus OpenVPN TCP/UDP covers performance and compatibility needs.
• Always On VPN is explicit and enforceable. It’s described as blocking internet access if the tunnel drops, and admins can enforce it by team/org.
• Split tunneling with clear operational details. Include/exclude modes, gateway and browser extension support, DNS behavior explained, and newer “exclusive split tunneling” controls.
• Compliance documentation exists (requestable). The help center lists ISO 27001 certificate and SOC 2 Type 2 report among documents available via the Trust Center. (help.nordlayer.com)

Limitations / trade-offs

• Not a privacy-minimal “no logs” consumer VPN. The DPA describes collecting/processing connection timestamps, server connected to, IP address (device info), and various logs; browser observability can include visited URLs when enabled.
• Cost can be more than the headline per-user number. Core/Premium indicate a required $40/month “Server with Dedicated IP” component.
• Refund window is short. The terms specify 14 days from initial purchase for refund eligibility (with exclusions). (d7umqicpi7263.cloudfront.net)
• Third-party testing flags IPv6 leakage risk. Comparitech reports IPv6 traffic not fully tunneled (Windows) and recommends disabling IPv6 to prevent leaks. (comparitech.com)

Who Should Use NordLayer?

Good fit

1. SMBs with hybrid/remote staff that need centrally managed secure internet access plus enforceable policies (Always On, split tunneling policies, access controls) rather than “best-effort” employee VPN usage. (nordlayer.com)
2. Teams that rely on IP allowlisting/private access patterns (e.g., SaaS admin consoles, internal services) and need dedicated gateways/dedicated IPs with admin control. (nordlayer.com)
3. Organizations with compliance pressure that benefit from formal security/compliance artifacts (ISO 27001 certificate / SOC 2 Type 2 report available via Trust Center request) and centralized visibility. (help.nordlayer.com)

Not a great fit

1. Individuals seeking anonymity-first privacy. NordLayer is built for business oversight and explicitly processes operational/security data; it’s not positioned as a minimal-data personal VPN.
2. Teams that can’t tolerate IPv6 tunnel gaps (or can’t enforce endpoint configuration) until you verify the IPv6 leak findings are resolved for your platform mix. (comparitech.com)
3. Very small teams (under 5 users), since NordLayer lists a 5-user minimum for Lite/Core/Premium.