NordLayer Review 2026: $8 Seats, a Required $40 Dedicated IP and a 5-User Floor

Verdict at a glance

NordLayer is a solid, polished choice for a small business that wants a managed VPN with fixed IPs, central policy and basic threat protection without running its own gateway. The apps cover every major platform, the client protocols are modern (NordLynx and OpenVPN), and Premium bundles a real cloud firewall, device posture checks and site-to-site connectivity.

The catch is cost structure, not quality. A 5-person team on Core pays $95 a month billed yearly once the required dedicated IP is added, which works out to $19 per seat rather than the $11 on the price card. There is no free trial on the network plans, the refund window is 14 days on the first purchase only, and activity reports only reach back 60 days.

• Plans: Lite $8, Core $11, Premium $14 per user per month billed yearly ($10, $14 and $18 billed monthly).
• Minimums: 5 users on Lite, Core and Premium; 200 users on Enterprise (from $6 per user with Lite features).
• Required extra: dedicated-IP server on Core and Premium at +$40 per month yearly, +$50 per month on monthly billing.
• Devices: 6 per licence on every plan.
• Refund: 14 days, initial purchase only. No free trial on the network plans.

NordLayer pricing in 2026: the real monthly bill

The pricing page defaults to yearly billing, so the numbers you see first are the discounted ones: Lite at $8, Core at $11 (marked Top choice) and Premium at $14 per user per month. Switch to monthly billing and they become $10, $14 and $18. Every plan says 5 users minimum, and NordLayer charges in USD with VAT, sales tax or other mandatory tax calculated on top. If you pay in another currency, your card issuer may add exchange fees.

The line that changes the maths is under Core and Premium: Server with Dedicated IP +$40/month required on yearly billing, +$50/month on monthly billing. Lite does not require one - and cannot add one, because dedicated servers are only orderable on Core, Premium or Custom subscriptions.

Worked examples (before tax)

• 5 users on Lite, yearly: 5 x $8 = $40 per month, $480 per year. Monthly billing: $50 per month.
• 5 users on Core, yearly: 5 x $11 + $40 = $95 per month, about $1,140 per year - an effective $19 per seat. Monthly billing: 5 x $14 + $50 = $120 per month.
• 5 users on Premium, yearly: 5 x $14 + $40 = $110 per month, $1,320 per year - an effective $22 per seat. Monthly billing: 5 x $18 + $50 = $140 per month.
• 20 users on Core, yearly: 20 x $11 + $40 = $260 per month - an effective $13 per seat, so the server fee matters less as the team grows.

Extra licences added mid-term are prorated. NordLayer accepts Visa, Mastercard, American Express and Discover. Buying 30 or more licences on Core or Premium gets you a dedicated account manager. Enterprise starts at $6 per user for Lite-level features with a 200-user minimum; higher features on Enterprise are quoted by sales.

Paid add-ons

• CrowdStrike Falcon Go: $2 per device per month.
• CrowdStrike Falcon Enterprise: $9 per device per month.

What Lite, Core and Premium actually unlock

All three plans share the basics: shared gateways in 40+ countries, Web Protection and the newer Download Protection, Always On VPN and auto-connect, MFA, and SSO with Okta, Entra ID, OneLogin, Google and JumpCloud. Support is 24/7 on Lite and Core and priority on Premium.

Lite ($8 yearly)

Lite is a managed shared-gateway VPN with threat protection. It has no dedicated IP, no IP allowlisting, no DNS filtering by category, no application blocker and no split tunneling. It suits a team that mainly wants encrypted connections on public Wi-Fi and central user management.

Core ($11 yearly)

Core is where NordLayer becomes a business network tool. It adds Virtual Private Gateways with a dedicated IP (the required +$40 server), IP allowlisting, DNS filtering across 50+ website categories, custom DNS, an application blocker covering 400+ applications, split tunneling, biometrics and device posture monitoring. Cloud Firewall on Core is talk to sales, and Device Posture Security is an add-on.

Premium ($14 yearly)

Premium includes everything in Core plus Cloud Firewall (FWaaS), Device Posture Security, user provisioning, the Site-to-Site connector, Cloud LAN and the browser extension. If you need to join an office network or cloud VPC to your remote users, or enforce firewall rules per gateway, Premium is the only self-serve plan that does it.

Enterprise (from $6, 200+ seats)

Enterprise is a negotiated contract for teams over 200 seats. The From $6 price is Lite features at volume; dedicated IPs, firewall and posture security are custom, and Virtual Private Gateways can be placed in up to 60 countries.

Gateways, dedicated IPs and server locations

NordLayer has two kinds of gateway. Shared gateways are pooled exit points in 40+ countries that every customer can use. Virtual Private Gateways are yours alone, come with a fixed dedicated IP, and are what you allowlist on a SaaS admin panel, a database firewall or a client's VPN. Admins can switch shared gateways off entirely so staff only ever exit through the company's own IPs.

NordLayer does not publish a server count. Its help-centre list of dedicated-server locations covers roughly 45 countries by our count, and Enterprise contracts quote up to 60.

Cloud Firewall, threat protection and device posture

Cloud Firewall lets Premium admins set rules on a gateway that control which traffic is allowed through, which is how you restrict who can reach a database or an internal app behind a dedicated IP. It only applies to NordLayer's desktop and mobile apps; it is not compatible with the browser extension.

Web Protection blocks known malicious sites, and Download Protection scans downloaded files for malware. Both are on every plan. Download Protection only works in the Windows app 3.4.1 and later and the macOS app 3.10.0 and later, and NordLayer itself warns that customers with a signed HIPAA agreement should be cautious, since enabling it may disclose sensitive information.

Device posture monitoring shows admins the state of the devices connecting; Device Posture Security goes further and acts on it, keeping non-compliant devices off the network. Monitoring is included on Core and Premium (an add-on on Lite), while Device Posture Security is included on Premium and an add-on on Core.

Apps, protocols and Always On VPN

There are apps for Windows, macOS, iOS, Android and Linux, plus a browser extension for Chrome, Firefox, Edge and Brave. Each licence covers 6 devices. Client protocols are NordLynx (Nord's WireGuard-based protocol), OpenVPN UDP and OpenVPN TCP.

IKEv2 is gone from the client side: NordLayer apps dropped it on 1 June 2024, and manual IKEv2/IPSec connections stopped working on 28 June 2025. IKEv2 now survives only for site-to-site configurations. The browser extension is more limited still - it connects only to Virtual Private Gateways and only over TLS.

Always On VPN, which blocks traffic unless the tunnel is up, is supported only on Linux, Windows and the macOS build downloaded from NordLayer's website - not on iOS, Android or the Mac App Store version. If you need enforced always-on tunnels on phones, check that gap before you buy.

Logging, privacy and compliance

NordLayer is a business tool, and it does not make a no-logs claim. Its privacy policy lists device information (device name, IP address, OS, advertising ID), application diagnostics, connection timestamps and the server each user connected to. Admins see user and device names, IP addresses, connection timestamps and server information, and end-user data is retained according to the customer's instructions.

The activity log is capped at 60 days on every plan, and data can take up to 24 hours to appear. If you need longer retention for audits, forward logs out: Control Panel actions and network connection logs can be sent automatically to CrowdStrike Falcon Next-Gen SIEM, and SentinelOne is also listed among integrations.

NordLayer states it is certified to ISO/IEC 27001:2022 and validated by a SOC 2 Type 2 audit. For HIPAA it uses aligned language, and a Business Associate Agreement is only available on an annual or longer subscription - monthly customers are not eligible. GDPR, CCPA, PCI-DSS and NIS2 appear as compliance it supports rather than certifications it holds.

The contracting entity is Nord Security Inc. in New York, and the Terms of Service are governed by the laws of England and Wales, with disputes going to the courts in London.

New in 2026: NordLayer Browser and AI Scout

Two launches this year sit alongside the VPN plans and are priced separately. Do not confuse them with the Premium plan's browser extension.

NordLayer Browser (launched 1 April 2026)

An enterprise browser with its own admin dashboard and routing policies. Its Premium tier is $4 per user per month billed yearly ($5 monthly), again with a required +$40 per month dedicated-IP server and a 5-user minimum; a Custom tier needs 50 users. NordLayer's setup guide says you must be an existing NordLayer customer and contact sales to use it.

AI Scout (launched 15 October 2026)

AI Scout gives admins visibility into the AI tools, agents and prompts employees are using - aimed at shadow AI and data leaking into unsanctioned chatbots. It is the one NordLayer product that advertises a free trial: 30 days, requested through the AI Scout page.

CrowdStrike add-ons

Falcon Go ($2 per device) and Falcon Enterprise ($9 per device) can be bought through NordLayer, which turns it into a light endpoint-security reseller as well as a network vendor.

Free trial, refunds and cancellation

There is no free trial on Lite, Core or Premium. The Terms of Service reserve the right to offer one at NordLayer's sole discretion, so it is worth asking sales, but do not plan on it.

The 14-day money-back guarantee covers the initial purchase only. It excludes add-ons, extra features and renewals bought during the subscription, purchases through an authorised partner, payments made with cryptocurrency, prepaid cards or gift cards, and anyone who has already had a refund. Requests go to [email protected].

Cancelling stops the next renewal; the plan runs to the end of the paid period with no refund for unused time. After expiry there is a 7-day grace period - resubscribe within it and you get the same gateways and private IPs back, which matters if partners have allowlisted them.

Who should buy NordLayer

• Buy Core if you need a fixed company IP for allowlisting, DNS filtering and app blocking, and have at least 10-20 users so the server fee is spread out.
• Buy Premium if you need firewall rules, enforced device posture, SCIM provisioning or site-to-site links to an office or cloud network.
• Lite is fine for a small team that only wants encrypted connections and threat protection on shared servers.
• Look elsewhere if you have fewer than 5 people, need more than 60 days of built-in logs, or need Always On VPN enforced on phones.

Against peers such as GoodAccess, Perimeter 81 or Cloudflare Zero Trust, NordLayer's strengths are polished apps, broad SSO support and a recognisable security brand; its weaknesses are the mandatory server fee on the useful plans and short native log retention.

Frequently asked questions

How much does NordLayer cost for a 5-person team?

$95 a month on Core billed yearly, before tax. That is 5 x $11 plus the required $40 dedicated-IP server. Lite is $40 a month with no server, and Premium is $110 a month.

Is the $40 dedicated IP really mandatory?

Yes, on Core and Premium. The pricing page lists Server with Dedicated IP +$40/month required on yearly billing and +$50/month on monthly billing. Lite does not need one and cannot order one.

Does NordLayer have a free trial?

No, not for the network plans. The only advertised trial is 30 days for AI Scout. Use the 14-day money-back guarantee on your first purchase instead.

Can I get a refund after 14 days or on renewal?

No. Refunds apply within 14 calendar days of the initial purchase only, and exclude renewals, add-ons, partner purchases and crypto, prepaid or gift-card payments. Cancelling just stops the next renewal.

Does NordLayer keep logs?

Yes. It records connection timestamps, IP addresses, device details and servers used, and shows them to your admins. Activity reports cover the past 60 days on every plan; forward them to a SIEM for longer retention.

Which VPN protocols does NordLayer support?

NordLynx, OpenVPN UDP and OpenVPN TCP in the apps. IKEv2 was removed from apps in June 2024 and from manual setups in June 2025, and is now only used for site-to-site connections.

How many devices does one NordLayer licence cover?

Six devices per user licence, on every plan.

Is NordLayer HIPAA compliant?

It describes itself as aligned with HIPAA and will sign a BAA, but only for annual or longer subscriptions. It is certified to ISO/IEC 27001:2022 and has a SOC 2 Type 2 report.

Key takeaways

• Lite $8, Core $11 and Premium $14 per user are yearly prices; monthly billing is $10, $14 and $18, all with a 5-user minimum and tax extra.
• Core and Premium require a dedicated-IP server at +$40 per month (yearly) or +$50 (monthly), so 5 users on Core really cost $95 a month.
• Premium is the only self-serve plan with Cloud Firewall, Device Posture Security, site-to-site and Cloud LAN.
• No free trial on the network plans; the 14-day refund covers the first purchase only.
• Activity logs stop at 60 days, Always On VPN is desktop-only, and IKEv2 is gone from the clients.
• NordLayer Browser and AI Scout are new in 2026 and priced separately from the VPN plans.