We've been running NordLayer for just over 18 months to secure remote access for our regional support teams and third-party payment processor integrations. Our primary driver was needing a managed solution to offload the operational burden of our previous OpenVPN setup while meeting the strict access controls and auditing requirements for PCI DSS. The short answer is that it *can* work, but you must architect around its limitations, particularly for a distributed retail chain environment.
Here is a breakdown of our deployment and the concrete issues we've faced:
**What Works Well for Compliance & Retail:**
* **Centralized Policy & Gateway-Selective Routing:** This is NordLayer's strongest suit for PCI. You can define exactly which company resources (e.g., your payment processing subnet `10.10.20.0/24`) are accessible only through a VPN gateway, while letting general web traffic egress directly. This enforces a clear boundary for cardholder data flows. The policy management via the web portal is unambiguous.
```yaml
# Example of a typical split-tunnel policy for PCI-sensitive resource:
# Gateway: "pci-gateway-us-east"
# Routes: 10.10.20.0/24, 10.10.30.16/28 (POS backend)
# DNS: internal.corp.com
# All other traffic: bypass VPN (critical for local POS/printers)
```
* **Audit Logs:** The activity logs (connection/disconnection, user→gateway mapping) are sufficient for demonstrating controlled access to PCI environments. You can prove that only authorized identities from the NordLayer directory accessed your cardholder data environment (CDE) subnets.
* **Service Account & Machine Authentication:** The ability to deploy service tokens for POS systems or back-office servers is crucial. It allows you to treat systems as "always-on" members of the secure network without user intervention, which is a common pattern for nightly transaction batch uploads from stores.
**Significant Pitfalls & Considerations:**
* **Network Performance & Gateway Geography:** A retail chain with dozens of locations cannot have all traffic funneled through a single region. NordLayer's gateway selection is manual per team/device. If your store in Lisbon connects to a gateway in Frankfurt, and your CDE is in AWS London, latency adds up. You *must* deploy and manage multiple gateways (additional cost) and configure location-based policies, which adds complexity.
* **No Built-in Failover for Service Accounts:** If a gateway goes down, the NordLayer client on a server will simply disconnect. There is no automated, seamless failover to a secondary gateway IP. For critical POS data flows, we had to implement a hacky wrapper script to monitor the connection and restart it, which is an operational burden.
* **The "Black Box" of Internal Routing:** Once traffic hits a NordLayer gateway, your visibility ends. If there's packet loss between NordLayer's ingress point and your VPC/DC (over their backbone), your only tool is their support. For PCI environments, you need your own telemetry. We had to augment with packet capture probes *inside* our CDE to prove network issues were not on our end during two major outages.
* **Compliance Documentation:** While NordLayer provides a generic compliance package, you will still be responsible for documenting how *your specific* use of their service meets each relevant PCI requirement (like 1.2, 1.3, 1.4, 4.1, 8.3). They are a tool, not a compliance silver bullet.
**Final Verdict for Your Use Case:**
NordLayer is a viable, cloud-delivered secure access solution that can support PCI compliance for a retail chain, but treat it as a low-level network enforcement layer, not a holistic SASE platform. You will need additional investment in:
1. Gateway redundancy planning per region.
2. Enhanced internal monitoring (beyond NordLayer's logs).
3. Robust client configuration management for diverse store environments (some Windows PCs, some Linux servers).
If your chain is large (>100 locations), the per-user/month pricing combined with the need for multiple dedicated gateways may push you towards a more enterprise-focused SD-WAN or ZTNA provider. For mid-sized chains with a clear split between PCI and non-PCI traffic, it's a defensible choice that gets you 80% of the way there with minimal operational overhead for the security team.
I can share specific Terraform snippets we use to automate gateway and policy provisioning if there's interest. It's the only way to manage this at scale.
-- as
Hi Jenna, I've been in your shoes, managing infrastructure for a multi-region retail chain with about 70 stores. We're heavy on Shopify POS, Lightspeed, and third-party logistics, so PCI compliance and site-to-site connections are daily bread. We ran NordLayer for remote access and migrated to Twingate about a year ago for our core network.
Here's my breakdown for a retail chain, based on what we saw:
1. **Enterprise Feature Gap:** NordLayer sits in an awkward middle. It's priced like an enterprise tool (~$10-$14/user/month billed annually for the full feature set we needed), but its logging, automation, and centralized control plane felt built for SMBs or teams under 100 seats. We hit a wall trying to automate user onboarding/offboarding at scale across hundreds of seasonal hires.
2. **Site-to-Site Tunnel Limits:** This was our dealbreaker. NordLayer's site-to-site offering is a recent add-on and, in our testing, was brittle compared to dedicated solutions. For a retail chain, you need rock-solid, always-on tunnels between your stores/distribution centers and cloud VPCs. We saw intermittent latency spikes that disrupted inventory syncs, and the configuration lacked fine-grained control over failover.
3. **Third-Party Access Workflow:** For PCI, you need bulletproof access for auditors and vendors. NordLayer's "Verify" feature (requiring a second device approval) worked, but the process to provision temporary, scoped access for a third-party was clunky via the admin panel. We ended up creating manual user accounts, which was a compliance headache. Other platforms offer true just-in-time, audited guest access.
4. **Hidden Cost in Time:** The operational burden wasn't fully offloaded. While easier than raw OpenVPN, we still spent significant time managing gateway lists and troubleshooting client connectivity issues specific to the varied networks at our retail locations (some with very restrictive firewalls). The support was helpful for basic issues but escalated slowly for complex network topology problems.
My pick for a multi-location retail chain today is Twingate, specifically if your primary need is secure, zero-trust access to on-prem and cloud resources with less network re-architecting. If you are deeply committed to a full traffic VPN mesh between all your locations and are married to the traditional model, then look at a pure network player like Perimeter 81. To make a clean call, tell us how many physical store locations need site-to-site connections and what your internal team's comfort level is with modern identity-aware proxies versus traditional VPNs.
Less hype, more data.
Your point about gateway-selective routing is spot on for architecting PCI flows. We implemented a similar split-tunnel policy, but the operational complexity came from managing static IP assignments for those gateways. If you're integrating with third-party payment processors that whitelist IPs, any gateway recreation in NordLayer (like during a region migration) can break those firewall rules until you update the vendor. Did your team script the gateway provisioning to avoid this, or did you just accept the manual overhead?
sub-100ms or bust