Summary: “We could do anything we wanted with the AWS setup, but managing VPNs is not our job. The NordLayer approach fits with that far better than AWS.”
ID-Pal is an AI-powered identity verification platform used by regulated businesses and individuals in over 190 countries. It covers all the bases for anti-money laundering (AML) screening. This 80-person company operates out of Dublin, London, New York, Columbus, Ohio, and Lisbon and has a hybrid and remote work policy.
Security is at the heart of what ID-Pal does, and was one of the reasons for choosing NordLayer. Getting the ISO 27001 certification was one of the first things ID-Pal did as a company. Its key selling point is that it is the only identity verification company with zero access to customer data.
ID-Pal wanted to protect its distributed team without being overwhelmed by manual admin work, so it moved to NordLayer. We spoke with Robert O’Farrell, the company’s CTO and co-founder, about the challenges NordLayer helped solve and the results ID-Pal experienced.
Before NordLayer, ID-Pal relied on a manual process to control access to its AWS environments. The DevOps team had to maintain allowlists for more than 50 IP addresses across dozens of the company’s infrastructure components.
Each environment had to be managed separately. Whenever an IP address changed, or a user joined or left the company, the team had to update and duplicate the same access rules across several environments. ID-Pal eventually reached the AWS security group limit and had to create additional groups, which added more lists to maintain.
This fragmented setup consumed a great deal of the DevOps’ time each month. It also increased the risk of inconsistent rules, missed updates, and access that remained active after offboarding.
However, as the company’s CTO stresses, this manual approach was never the plan. It was created as a temporary measure to block automated attacks against the company’s non-production environments.
“Attackers were clearly looking for weaknesses that could be exploited in production, or that might already exist there. We detected that activity and responded the same day. It was a major operational burden.”
ID-Pal soon concluded that it needed a dedicated security solution that could centralize access, remove repetitive IP updates, and reduce the workload placed on its DevOps team. The company found the answer in NordLayer.
Robert O’Farrell was already familiar with the Nord Security brand because he had used NordVPN for a long time. However, he didn’t want that experience to influence the decision about choosing a security provider. After researching and comparing several business VPN solutions, his team selected NordLayer.
“We also considered AWS’s own VPN solution. However, when we compared the ease of rollout and ongoing maintenance, the choice was clear: NordLayer would save us a significant amount of time.”
Security due diligence was also a key part of the decision. As ID-Pal holds the ISO 27001 certification, it must follow a strict vendor assessment process. Robert O’Farrell explains that NordLayer passed this review without any issues:
“NordLayer performed well during our due diligence process. It required little manual work, had a limited impact on our existing infrastructure, and was easy to introduce across the team. Today, everyone on the technology team uses it.”
ID-Pal is primarily an AWS company. Before adopting NordLayer, the DevOps team had to manually manage over 50 individual IP addresses across the AWS web application firewall (WAF) and multiple security groups. Robert O’Farrel recalls:
“There were more than 50 users altogether, including those from third-party platforms that we’ve integrated. It was a real pain for us.”
Another issue was that maintaining duplicate access rules across multiple environments exceeded AWS security group limits and required 40 hours of IT admin work per month—equivalent to a quarter of a full-time DevOps engineer’s workload. The company’s CTO says that every manual entry also raised the risk of human error:
“I always try to remove manual and duplicate steps wherever possible. When the same activities have to be repeated across different systems, the risk of mistakes increases, especially during onboarding and offboarding.”
With NordLayer, ID-Pal was able to retire much of its manual IP management, reduce IT admin by 40 hours per month, and centralize access through virtual private gateways, each with a dedicated IP address.
Although the manual controls that ID-Pal was using before NordLayer provided security, the overall process was fragmented. Access rules and allowlists had to be kept identical across several environments. This setup was time-consuming.
Thanks to NordLayer’s centralized and easy-to-use Control Panel, the DevOps team can now monitor all the company users’ access in one place, making security management much more efficient.
Robert O’Farrell explains why NordLayer is easy to use:
“NordLayer makes feature configuration intuitive, so I don’t have to learn how every component works. I can simply specify that I need two IP addresses for redundancy, and that’s all I need to know. With many other services, there are dozens of complex components, and it is easy to miss an important security setting.”
ID-Pal started with a pilot rollout of 12 users that included QA developers, one DevOps team member, the head of DevOps, and the CTO. After a successful trial, the company deployed NordLayer across the whole technology team and scaled up to 36 active users.
The full rollout was straightforward. The company’s CTO says that the DevOps team completed it in under 2 weeks:
“Our DevOps team configured access across all AWS environments within a week. The full rollout was completed across all non-production and pre-production environments within a maximum of 2 weeks, which is the length of our sprint.”
ID-Pal chose NordLayer because it provides strong protection with minimal administrative drag. What made the difference:
Robert O’Farrell shares his tips on business security:
In under two weeks, ID-Pal replaced a temporary, error-prone manual IP setup with NordLayer’s dedicated IP. This allowed the company to reclaim around 40 hours a month, reduce the risk of human error, and maintain its focus on providing identity verification with zero data access.
Any team carrying the same manual overhead can do the same. If managing VPNs and IP addresses is pulling your team off the work that moves your business forward, NordLayer’s here to take it off your plate. Talk to our team to find the plan that fits your needs.
Joanna Krysińska
Senior Cybersecurity Copywriter
Joanna writes about zero trust, network security, access control, and threat prevention, but her cup of tea is compliance and how regulations shape security controls. Her work also includes the dark web topics and the methods cybercriminals use to target companies, such as social engineering or ransomware attacks, for example.
Subscribe to our blog updates for in-depth perspectives on cybersecurity.
