NordLayer is a well-built, fast-to-deploy cloud-managed business VPN with zero-trust features bolted on, and for a small, mobile, Windows-and-Mac workforce that mainly needs secure remote access it does the job. For a European mid-market team that needs full SASE, though, two limits matter. It stays tunnel-centric and cannot secure agentless OT devices, and its business contracts run through a US Delaware entity, which pulls the whole service under the CLOUD Act. On the criteria that decide an EU mid-market build, converged architecture, OT coverage and data sovereignty, Jimber is the stronger fit.
Key takeaways
- NordLayer is a tunnel-centric SSE: security policies sit on top of an encrypted VPN tunnel, not in a single converged inspection path like a full SASE platform.
- It is client-dependent, so printers, IP cameras and OT systems that cannot run its agent fall outside its protection.
- Its advertised prices understate the bill: Core and Premium require a mandatory dedicated server at +$40/month, and identity and posture are paid add-ons on the lower tiers.
- European business customers contract with Nord Security Inc. in Delaware, which brings the service under the US CLOUD Act even when data sits in EU datacentres.
- Jimber converges ZTNA, SWG, FWaaS and SD-WAN in one EU-sovereign platform and secures agentless OT with the NIAC, which is what a mid-market SASE build actually needs.
Two different categories: tunnel-centric SSE versus converged SASE
NordLayer launched in 2019 as NordVPN Teams and was renamed in September 2021. It has grown from a business VPN into a broader security service edge with ZTNA controls, DNS filtering and a cloud firewall, over the WireGuard-based NordLynx protocol and OpenVPN. The architecture underneath is still tunnel-centric: once a user connects to a gateway they sit inside a secured network segment, and controls like device posture and web filtering are applied as separate policies on top of that tunnel.
A full SASE platform works differently. It uses a single-pass inspection path where routing (SD-WAN) and security (ZTNA, SWG, FWaaS, CASB) are processed at the same time as the packet crosses the cloud edge. That removes repeated encrypt-and-decrypt hops, lowers latency, and avoids blind spots in visibility. It also reaches beyond the mobile worker: a full SASE platform integrates physical network infrastructure and offers agentless isolation for the legacy and OT hardware a ZTNA-only tool leaves untouched.
NordLayer and Jimber side by side
| Criterion | NordLayer (tunnel-centric SSE) | Jimber (EU SASE) |
|---|---|---|
| Core architecture | Tunnel-based business VPN with SSE layers on virtual gateways | Converged single-pass inspection at the cloud edge; network and security processed together |
| ZTNA depth | Gatekeeper model; network segmentation at gateway level; no fine-grained per-application publishing | Fine-grained, identity- and context-based application publishing; resources invisible to the unauthorised |
| Secure Web Gateway | Category-level DNS filtering, download protection, DNS malware blocking | Full URL filtering, deep SSL/TLS decryption, DLP and inline sandbox analysis |
| Remote Browser Isolation | No native inline RBI for all web traffic; a separate NordLayer Browser is offered | Integrated cloud RBI; web code runs in disposable containers and is sent as an image stream |
| Agentless & OT | Client-dependent; browser extension covers only HTTP; no OT protection | Agentless web-app access plus inline hardware isolation for legacy and OT via the NIAC |
| Firewall-as-a-Service | Cloud Firewall capped at roughly 110 rules per gateway (Premium tier) | Centrally managed cloud firewall that replaces distributed on-premises firewalls |
| SD-WAN & sites | Basic site-to-site via a virtual gateway and dedicated IP | Native SD-WAN with dynamic path selection, failover and per-application QoS |
| Jurisdiction & sovereignty | Business contracts via Nord Security Inc. (Delaware, US); potential CLOUD Act exposure | EU-based entities and data storage; outside the reach of the US CLOUD Act |
Where NordLayer is genuinely good
Credit where it is due, because it shapes where each tool fits. Administrators consistently praise how fast NordLayer deploys: because it is fully cloud-based with no network hardware, you can spin up a gateway and onboard the first users within about ten minutes. The admin panel is clean and intuitive, so basic tasks like creating teams, assigning gateways and viewing access logs do not require deep menus. End users get a modern desktop and mobile app that runs quietly in the background, the NordLynx protocol keeps everyday latency low on a stable connection, and SSO with Google Workspace and Microsoft Entra ID gives a smooth login. If your need is straightforward secure remote access for a small mobile team, that simplicity is a real strength.
Where it stops for a full-SASE, mid-market build
The same reviews surface structural limits. Users on Reddit report connection instability, with the client dropping or hanging in a login loop, and complain that support often falls back to advising a full reinstall, which loads the internal helpdesk. Performance degrades on low-bandwidth links like train or plane Wi-Fi, where requests stall or fail while other connections still work. Because shared gateways pool IP addresses, many web servers flag those IPs as anonymous proxies, which produces a wave of CAPTCHAs and can get travelling staff blocked from cloud apps like Salesforce. Integration is thin for larger estates: there is no public API for custom management, and SIEM export is limited to a CrowdStrike Falcon connector since 2026, with Splunk and Microsoft Sentinel absent, leaving manual CSV exports for audits. And on the point that matters most for a factory floor or a distributed office, agentless printers, IP cameras and PLCs simply fall outside a client-dependent tool.
The real cost: the advertised price is not the bill
NordLayer prices per user per month across three public tiers plus a custom Enterprise offer. The headline numbers are competitive, but mid-market totals climb through mandatory infrastructure and add-ons.
| Tier | Annual (per seat/month) | Minimum | Mandatory extras |
|---|---|---|---|
| Lite | $8 | 5 users | No dedicated server; identity link and device posture are paid add-ons |
| Core | $11 | 5 users | Mandatory dedicated server +$40/month; identity and posture are add-ons |
| Premium | $14 | 5 users | Mandatory dedicated server +$40/month; identity and posture included |
| Enterprise | from $6 to $7 | 50 to 200 users | Custom quote via sales |
Worked out, a 50-user Core deployment with the dedicated server, user provisioning and device posture add-ons lands around $690/month, or $8,280/year, an effective $13.80 per user per month against an advertised $11. A 100-user Premium deployment with the mandatory server runs about $1,440/month, or $17,280/year, an effective $14.40. Two other terms are worth noting: the 14-day money-back guarantee applies only to a first purchase and not to renewals, mid-term upgrades or add-ons, and billing is in USD, so EU buyers carry the currency spread. For how these add-on and currency traps play out across the market, see our SASE pricing models guide.
The sovereignty question EU buyers cannot skip
NordLayer presents as a European product, with operational teams in Vilnius, Lithuania. The contractual reality is different. Its Terms of Service state that business customers enter a binding contract with Nord Security Inc., a company registered in Delaware, United States. Because the contracting party is a US entity, the service falls under the US CLOUD Act, which can compel access to stored data regardless of whether it physically sits in a German or Dutch datacentre, without a European court’s involvement. Independent analysis of the ownership structure also reports holding companies in Cyprus and Panama, and Panama has no EU adequacy decision, which leaves a due-diligence gap for auditors trying to verify the ultimate beneficial owner against GDPR transparency duties.
This is not a technicality under NIS2. A SASE platform decrypts and inspects your outbound web traffic and internal authentication, so choosing a provider under foreign-surveillance law is a documented supply-chain risk that has to go in your risk register and can draw questions in a DORA concentration-risk review. Jimber removes that risk by construction: it is headquartered in Belgium with no US parent, and all security logs, access configurations and user traffic are processed inside the EU. Our European SASE alternatives piece sets out why that sovereignty shift matters.
Which one fits
Pick NordLayer if you want quick, cloud-managed secure remote access for a small, mobile, agent-friendly team and you are comfortable with a US contracting entity. Pick Jimber if you are building a full SASE for the EU mid-market: converged ZTNA, SWG, FWaaS and SD-WAN in one console, agentless isolation for OT via the NIAC, integrated Remote Browser Isolation, and EU data sovereignty that stands up to a NIS2 or DORA audit. For the same argument applied to a ZTNA-only tool, see our Twingate versus Jimber comparison, and for the platform-consolidation case, single-vendor versus multi-vendor SASE.
Frequently asked questions
Is NordLayer a true ZTNA solution or a VPN?
It is a hybrid built on network-tunnel technology, extended with zero-trust features. Unlike pure ZTNA, which publishes individual applications directly to specific users without granting network access, NordLayer creates an encrypted connection to a gateway, and once authenticated the user reaches the whole network segment behind it. In practice it is an advanced cloud-managed VPN with zero-trust switches.
Can NordLayer secure legacy or OT devices like printers and IP cameras?
No. NordLayer is client-dependent. Its browser extension covers only light web traffic, and its full features need the desktop or mobile app installed. Devices with no OS to run that client, such as printers, IoT sensors or industrial machines, fall outside its protection, which needs a SASE platform with inline network-isolation hardware.
What hidden costs apply to the Core and Premium tiers?
The advertised $11 (Core) and $14 (Premium) per user per month are not the whole cost. Using core features such as IP allowlisting and network segmentation requires a dedicated server with a fixed IP at a mandatory +$40/month. On the Lite and Core tiers, device posture checks and automatic user provisioning are extra, roughly $1 to $1.50 per user per month.
Does our network data fall under US law if we use NordLayer?
Yes, that is a real risk for European companies. Data may sit physically in European datacentres, but business customers sign with Nord Security Inc., registered in Delaware, so the whole service falls under the US CLOUD Act. US authorities can demand data from Nord Security Inc. by court order without approval from a Lithuanian or European court.
Does NordLayer offer full SD-WAN to connect multiple offices?
No. Its Premium tier offers a “Sites” feature for site-to-site IPsec tunnels between local networks and cloud environments, but that is a basic connector. It does not provide native SD-WAN capabilities like dynamic path selection over multiple internet lines, QoS for critical applications, or zero-touch provisioning of office routers.
How do NordLayer and Jimber compare on NIS2 and DORA?
Both provide technical controls that support compliance, and NordLayer is certified to ISO 27001 and SOC 2 Type II. The difference is jurisdiction: NordLayer’s US contracting entity and reported offshore holdings create supply-chain and concentration-risk questions for auditors, while Jimber’s EU-only structure and data processing avoid that exposure entirely.
Build for sovereignty, not just quick onboarding
NordLayer is a tidy way to give a small mobile team secure access. If your goal is a full, EU-sovereign SASE that also covers OT and stands up to a NIS2 audit, that is a different build. Book a Jimber demo to see the converged platform and the NIAC in action, or compare Jimber’s flat-rate pricing against a NordLayer quote with its server and add-ons.
