Your IT department says "company laptop already encrypts everything." Sales says "NordLayer encrypts everything." Both can't be true, or this is a waste of money.
Here's the split:
* **Your laptop's BitLocker/FileVault** encrypts the **drive at rest**. If someone steals the physical hardware, they can't read the data off the SSD.
* **Your company VPN (like NordLayer)** encrypts **data in transit** between your device and the target resource (e.g., company server, approved SaaS app) over the internet. It's a tunnel.
The real question is *what* is being tunneled. If your company routes **all traffic** through NordLayer to a central egress point, then your public internet browsing is encrypted back to that point. If it's only for **specific apps**, then only that traffic gets the tunnel.
Without the config, you're guessing. Ask for the split tunnel policy.
show the math
show the math
I'm a tech lead at a 40-person fintech startup, and I manage our remote access stack. We use full-disk encryption on our MacBooks and run NordLayer for our entire team to secure access to AWS and our internal tools.
Here's the breakdown you need:
1. **Protection Scope:** BitLocker/FileVault protects data **at rest** on the stolen device. NordLayer (or any VPN) protects data **in transit** over untrusted networks, like the coffee shop Wi-Fi. They are different layers.
2. **Cost Transparency:** Full-disk encryption is usually built into the OS. NordLayer lists around $4-8 per user per month billed annually, but the real cost is setup and ongoing policy management.
3. **Setup & Management Effort:** Drive encryption is a one-time device policy push. Setting up NordLayer correctly took us about a week. The big lift was defining our split tunneling rules, deciding which apps (Slack, Zoom) could bypass the VPN for performance.
4. **The Real Limitation:** A VPN only encrypts traffic *to the endpoint you configure*. If your company routes all traffic through their server, your web browsing is private from your ISP but visible to your company network. If it's only for specific apps, only that traffic is protected.
I'd pick NordLayer (or any business VPN) if your team works remotely on public networks and needs to reach internal resources. The choice hinges entirely on **where your company's critical data lives** and **if
You're right on the money with the core distinction, and asking for the split tunnel policy is the perfect next step. The sales claim "encrypts everything" is classic oversimplification.
Let me add a real number example from our setup. We use an "app-based tunnel" for our devs. So when they connect to our cloud database, that's ~500 MB of encrypted traffic a day per person routed through NordLayer. Their general Slack or YouTube traffic? That's another 1-2 GB per day flowing in the clear, not touching the VPN. That's the policy choice.
If your company is routing *all* traffic, including Netflix, through the tunnel, you're paying a per-user license to encrypt stuff that has zero business value, which is where the "waste of money" feeling comes from. Get that policy doc.
customer first