Hey everyone. I'm still pretty new to a lot of this infrastructure and security stuff, but I was just evaluating NordLayer for a potential project.
Our security lead asked for connection logs to trace access patterns, especially for our dev environments. I was honestly surprised that NordLayer doesn't provide detailed logs like connection timestamps or source IPs for users. It seems like a basic feature for any business-focused tool? Makes auditing really difficult.
I really wanted to like it for its simplicity, but this feels like a big gap. Am I missing something here, or is this a known limitation? 😅
Yeah, that's their whole business model. If they logged connections with timestamps and source IPs, they'd have to store data. Storing data means they could be compelled to hand it over. Their marketing is built on "no logs, trust us."
So your security lead wants audit trails, and their security marketing wants "nothing to see here." Those two things are fundamentally at odds.
You're not missing anything, it's a known limitation they sell as a feature. For a business that actually needs oversight, you'll have to look elsewhere, probably something you can self-host.
FOSS advocate
Yep, that's the exact trade-off with them. Their no-logs policy is a feature, not a bug, from their perspective. It's just not aligned with corporate security requirements.
You'll need a different tool. For audit trails, you're looking at either a business VPN provider that specifically advertises logging, or running your own openvpn/wireguard setup. The self-hosted route gives you full control, but then you're managing infra and scaling it.
If you liked NordLayer's simplicity, check out Twingate or Tailscale for Teams. They're built more for zero-trust access with audit logs baked in, though the pricing model changes.
That's a great point about the zero-trust tools. I've seen teams run into this same wall and go the Twingate route. It usually solves the audit log requirement, but the licensing can get tricky if you have a lot of contractors or short-term external collaborators. Sometimes it forces a weird workaround with shared accounts, which defeats the whole purpose of the detailed logs you wanted in the first place.
The gap you found is the point. Their "no logs" policy means they can't provide audit trails, which most businesses need.
> a basic feature for any business-focused tool
It is basic, but NordLayer's primary customer base isn't businesses that require oversight. It's prioritizing user privacy over corporate auditability. You need a different category of tool.
Look at zero-trust access platforms or a self-hosted WireGuard setup with centralized logging.
Exactly. You've correctly identified that this is a target market mismatch, not a feature gap. It's the classic tension between individual privacy and organizational accountability.
The crucial follow-up question for any team is: where does your actual liability lie? For a corporation, the inability to demonstrate a chain of custody for access to, say, a PCI-DSS environment is a direct compliance failure. A provider's policy becomes your single point of failure for auditability.
While zero-trust platforms are the modern answer, I'd caution that a self-hosted WireGuard setup introduces its own logging overhead. You're now responsible for building, securing, and retaining those centralized logs yourself. That's a non-trivial SRE lift many teams underestimate until their log aggregation costs spike or they face a data retention subpoena. The tool choice dictates who manages the liability.
You're spot on about the liability shift. I've seen teams get burned when they underestimate the SRE lift for that self-hosted logging layer. It's not just the cost, it's making sure your log pipeline is as secure and compliant as the access system itself. That's a whole separate audit surface.
If you go the zero-trust platform route, you're trading one vendor risk for another. You have to audit *their* logging and retention policies just as thoroughly. I've found some are surprisingly vague about log granularity and immutable storage, even when they advertise "audit trails."
The real question for the OP's team might be whether they need connection logs for compliance only, or for actual security monitoring. If it's the latter, you need to be able to alert and investigate, not just store. That pushes you towards a platform with integrated SIEM feeds or open APIs, which narrows the field again.
Cheers, Henry
That's a really good way to put it, the liability shift. I hadn't thought about the log storage itself becoming a new compliance surface. Makes sense.
So when you pick a zero-trust platform, you're essentially doing a vendor audit on their logging system instead of building your own? That still sounds easier than self-hosting, but I guess you have to trust their logs are actually immutable and detailed enough. Is that usually covered in their security whitepapers?
Still learning.