NordLayer

NordLayer is a business VPN solution built by the company behind NordVPN, the popular consumer VPN. On paper, it sounds like a near-perfect solution for remote teams, hybrid workforces, and growing businesses needing secure access to sensitive data.

What is NordLayer used for? NordLayer implements ZTNA principles, so only authenticated users can access specific resources. This can reduce the average cost of data breaches by 35%. (Apgate, 2021)^1. In addition to Zero Trust Network Access, NordLayer functions as a Secure Web Gateway (SWG) and includes a cloud-based firewall. This allows businesses to monitor, filter, and control web traffic for enhanced protection. NordLayer promises enterprise-grade security, simple team management, and fast performance across global servers.

This business VPN delivers much of what it promises, but there are some trade-offs. While it’s an excellent choice for many companies, it may not be the perfect fit for everyone. In this review, I’ll explain what NordLayer does well, where it falls short, and who should consider it.

Try NordLayer Risk-Free

[features-overview-table]

Speed — The NordLynx Protocol Can Lead to Fast Speeds

NordLayer can potentially offer minimal slowdowns while protecting your business. Its proprietary NordLynx protocol is a WireGuard-based tunneling method optimized for speed and efficiency.​ In our tests, it consistently ranks among the fastest VPN protocols.

Additionally, the Premium option provides access to servers with up to 1Gbps bandwidth, and custom Enterprise options can offer servers with speeds up to 10Gbps. Other protocols offered by NordLayer are OpenVPN UDP and OpenVPN TCP, which show varying degrees of speed reduction. OpenVPN TCP is the slowest due to its emphasis on security over speed.

Overall, NordLayer claims to offer robust and consistent performance, particularly if you’re connecting to nearby servers using the NordLynx protocol. Just be aware that there are always speed reductions when connecting to distant servers or using slower and more secure protocols. Alternatively, check out this list to find the fastest VPNs for commercial use.

Server Network — Covers Major Business Hubs

NordLayer covers over 60 countries worldwide, including the US, UK, Germany, Australia, and Japan. While its global reach is decent for a business-focused VPN, it doesn’t have the same vast coverage as consumer VPNs with servers in hundreds of countries.

[imageEditor template_id=”6028″]

The network is designed to avoid overcrowding by offering shared gateways and private gateways. Shared gateways are the default, serving multiple clients with consistently good speeds and stability. If your organization needs guaranteed resources, NordLayer offers private gateways through dedicated IP addresses and enhanced control features like team segmentation and Zero Trust Network Access (ZTNA).

The VPN primarily rents its servers, which isn’t great for privacy. However, it adheres to strong encryption standards and a no-logs policy, so that shouldn’t be an issue. I also appreciate that its servers are physically located in the listed countries, not virtual. This enables better performance and transparency.

Does NordLayer Work in China? No

Customer support confirmed that NordLayer is unlikely to function correctly in China. I wasn’t surprised, as the VPN lacks any specialized features for going around strong firewalls or VPN blocks, like obfuscation or stealth mode. While the website is accessible within the country, meaning you can download the apps from China, you won’t be able to connect or use the service.

[imageEditor template_id=”6029″]

I also asked about Turkey, Saudi Arabia, the UAE, Iran, and Russia. The agent told me that NordLayer can’t be used in Iran and Russia, as these are sanctioned countries. They also don’t guarantee service availability in Turkey, Saudi Arabia, and the UAE, but say you can use the VPN with certain internet providers there.

If you plan to travel to or live in one of those countries, consider a VPN offering stealth technology or obfuscated servers. Choose a VPN with a proven track record of working reliably in countries like China.

It’s worth noting that while VPNs are technically banned in China, there have been no publicly reported cases of the government prosecuting individuals for using them. However, it’s important to research and understand the local laws and regulations before using a VPN in these countries. We do not encourage or support using VPNs that violate local laws.

Security — A Decent Suite of Security Features for Businesses

NordLayer is one of the more secure business VPN solutions on the market. It uses military-grade AES-256 and ChaCha20 encryption alongside secure protocols like OpenVPN and NordLynx (a WireGuard-based protocol) to protect data in transit. Plus, it comes with a kill switch, which blocks the internet connection if the VPN suddenly disconnects.

How does NordLayer work? With a strong focus on business needs, NordLayer integrates advanced security tools like Zero Trust Network Access (ZTNA) and Multi-Factor Authentication (MFA) to allow only authorized users to gain access to critical resources. Research indicates that implementing MFA can reduce the risk of account compromise by 99.22% across all users and 98.56% in cases involving leaked credentials. (Arxiv, 2023)²

Cloud LAN

NordLayer uses encrypted tunnels to enable remote employees to safely access company systems from anywhere. It advertises its connections as stable, with many customers corroborating, even on public WiFi. This is great for teams working remotely or traveling.

Zero Trust Network Access (ZTNA)

With ZTNA, users must verify identity and device posture before gaining access. You can choose to restrict access by role or device. This drastically reduces the risk of unauthorized lateral movement within the network. From an admin’s perspective, enforcing least-privilege access via the control panel is pretty straightforward.

Private Gateways

Private gateways provide static IPs and dedicated servers for your organization, which are ideal for IP whitelisting and isolating traffic. Setting up a private gateway takes around 10 minutes, and the resulting stability and control over internal services (like staging servers) can significantly improve security.

Network Segmentation

Admins can create network segments (e.g., by department) to contain access privileges. This helps prevent breaches from spreading. For example, when you segment users into Marketing and Engineering groups, each only sees its own resources, confirming it works well for compliance and internal security.

Identity & Access Management

NordLayer integrates with OneLogin, Jumpcloud, Entra ID, Google Workspace, and Okta for seamless authentication, including SSO and 2FA. Setting up with Google Workspace was simple — once connected, user provisioning and role assignments sync automatically.

Web Protection

How does NordLayer protect businesses? It offers features like Web Protection that automatically block malicious domains, trackers, and ads at the DNS level. A staggering 79 million malicious domains are on the web (Akamai, 2022)³. Even worse, it’s reported that 77% of all websites utilize at least one third-party tracker (Emarketer, 2018)⁴. So, protection like this is essential when working with a large crew, and one mistake can cost you.

Site-to-Site VPN

Site-to-site VPN allows encrypted tunnel creation between remote networks, which is great for linking offices or cloud environments. For example, it’s possible to use an AWS EC2 instance and a home router running OpenWRT to receive a steady performance once connected.

AlwaysOn VPN

The feature automatically disconnects users from the network if a secure internet connection is lost, so no data is ever sent unprotected, no matter where the employee works.

Cloud Firewall

A centrally managed firewall hosted in the cloud filters and controls inbound and outbound network traffic across all endpoints. Cloud Firewalls enable consistent security policies across remote teams and prevent unauthorized access or risky traffic without needing on-premises hardware. Get Nordlayer Premium to access Cloud Firewall.

Download Protection

Blocks malicious files during downloads by scanning and inspecting content for threats before they reach the device; this reduces the risk of malware infections, ransomware, or other threats from compromised downloads.

DNS Filtering

This AI-powered solution filters internet traffic by blocking access to malicious, inappropriate, or non-compliant websites at the DNS level. This improves browsing security, enforces acceptable use policies, and minimizes exposure to phishing or malware domains. To benefit from DNS filtering, you need a Core NordLayer option.

Deep Packet Inspection (DPI)

Analyzes the data and metadata of each network packet to detect threats, enforce policies, and identify applications or services in use. This enables granular traffic control and enhances threat detection beyond basic IP or port filtering. You need NordLayer’s Core option to enable this feature.

Split tunneling

Split tunneling allows users to route specific apps or websites through the VPN while letting others access the Internet directly. Encrypting only necessary traffic while keeping critical data secure improves performance and reduces bandwidth usage. For IP-based Split Tunneling, upgrade to the Core option. If you also want URL-based Split Tunneling, then go for NordLayer Premium.

Privacy — Secure and Compliant, but Not Built for Total Anonymity

Unlike its consumer counterpart NordVPN, NordLayer doesn’t uphold a strict no-logs policy. It collects various user data such as IP addresses, device information, and access logs. However, this is necessary for a business VPN, so I’m not too concerned. It’s a business VPN focused on managing teams and securing remote access, not evading surveillance.

If you prioritize privacy, a VPN headquartered in a more privacy-friendly jurisdiction and offering a strict no-logs policy might be more suitable.

NordLayer is owned by Nord Security, a prominent cybersecurity company that also owns NordVPN, Surfshark, and AtlasVPN. The company has a history of transparency and has subjected its consumer VPN services to independent audits to verify its privacy practices.

Does NordLayer Keep Logs? Partially

NordLayer collects specific user and system data to facilitate administrative oversight and network security. This data collection aligns with standard practices for business VPNs ​and includes:

• Personal information. Full name, email address, phone number, and professional details.
• Access logs. IP address, operating system, browser information, and device details.
• Payment data. Billing information such as purchase date, IP address, billing address, credit card details, and account specifics.​

[imageEditor template_id=”6030″]

It’s important to note that NordLayer does not log users’ online activities, such as browsing history or content accessed, maintaining user privacy within the network. ​It also supports cryptocurrency payments, including Bitcoin, offering an additional layer of privacy. However, signing up requires personal and organizational information, which may limit complete anonymity. ​

Was NordLayer Audited? Yes

​NordLayer has undergone multiple independent security audits to validate its commitment to data protection and operational transparency. In 2022, Nord Security, the parent company of NordLayer, successfully completed a SOC 2 Type 1 audit, which assessed the design of its information security controls related to security, availability, processing integrity, confidentiality, and privacy.

Additionally, in 2024, NordLayer achieved SOC 2 Type 2 certification, which evaluates the operational effectiveness of these controls over time. NordLayer’s information security management systems are also certified according to ISO/IEC 27001:2022, an international standard that outlines best practices for managing sensitive company information.​

Based in the US

NordLayer is registered in the United States, a member of the Five Eyes intelligence alliance. This jurisdiction implies that the company may be subject to legal obligations requiring it to disclose user data to authorities. While the VPN commits to notifying customers of such requests when legally permissible, it retains the discretion to comply with lawful demands.​