Cloudflare Zero Trust vs Proton VPN for Business

Cloudflare Zero Trust

This is proper per-application access rather than a whole-network tunnel: Access is deny by default with allow and block rules per application, and the on-ramps are the Cloudflare One Client, agentless browser access or an IPsec appliance, with Tunnel and IPsec off-ramps on our side — connector and client software are included on every plan. The protocols are unusually well documented (MASQUE over TLS 1.3 with hybrid ML-KEM, IPsec ESP keyed over a TLS-secured control plane). We found no public information on dedicated static egress IPs for the supplier portal, per-operating-system client coverage, or always-on behaviour in the captured pages.

Proton VPN for Business

This is a gateway VPN: shared servers plus dedicated servers and static IPs in 20-plus countries (the captured pages give different figures for the server network, from 13,000 in 120-plus countries to 20,000 in 140-plus), WireGuard or OpenVPN, split tunnelling, a kill switch, and an enforceable always-on mode — and a dedicated IP is exactly what my supplier-portal whitelist needs. Access can be restricted by user, group or role to specific servers, apps or SaaS tools, and external users get time-limited, role-based access. I found no public information on site-to-site links between my two plants, cloud-network connectors, or a connector that reaches the ERP and file server without inbound firewall rules, which is what would really replace my weekend firewall upgrades.

Cloudflare Zero Trust

Sign-in with Microsoft Entra ID, Google, Okta or a SCIM-provisioning identity provider is documented, with deny-by-default policies per application, Include/Require/Exclude rule logic, and device posture checked from the client or a third-party provider — and a user revoked in the IdP is forced to re-attest, which is the same-day leaver handling I need. Identity and device posture are checked per request, and non-identity signals are polled continuously during the session; policies run as code through the API and Terraform. We found no public information on just-in-time approvals, session re-authentication, or named MDM or EDR tools feeding posture in the captured pages.

Proton VPN for Business

Single sign-on with Microsoft Entra ID, Okta, Google Workspace and any SAML 2.0 provider, SCIM provisioning with identity-provider group changes mirrored automatically, and automated deprovisioning are documented — a leaver loses access the same day, which is precisely my requirement. Two-factor authentication can be enforced for admins or all users, user groups can be restricted to named Gateways and shared servers, and least-privilege segmentation via dedicated IPs is claimed. I found no public information on device posture checks such as operating-system version, disk encryption, or EDR and MDM status gating a connection.

Cloudflare Zero Trust

Retention is stated per service and per plan — access logs from 24 hours on Free up to 180 days on Enterprise, admin logs 18 months on all plans — with Log Explorer datasets for access requests, gateway DNS/HTTP/network traffic and device posture, Logpush to SIEM or cloud storage on the contract plan, an audit log API, and webhook and PagerDuty alerting. The 1.1.1.1 resolver is stated not to log personal information, while requests matched by a Bypass policy are not logged.

Proton VPN for Business

Connection and gateway monitoring shows who connected, on what device, to which server and gateway, and the activity monitor logs failed sign-ins and account, organization and gateway events per user, searchable by name, email and time range, exportable as CSV on the Professional plans; the vendor also states plainly that it records no online activity, browsing history, IP addresses or session lengths. What is missing for me: the retention period for these activity logs is not stated on any captured page, and the SIEM connector is referenced as a documentation item and a Professional-tier feature without naming the tools it feeds, so I cannot yet promise my auditor where the trail lands.

Cloudflare Zero Trust

The API and Terraform management is real and well documented, with a dashboard read-only mode that forces every change through code and scoped API tokens so a teammate can only touch the Zero Trust settings; support channels are listed per plan, from community forums and Discord on Free to phone, chat and ticket on contract. We found no public information in the captured pages on pushing the client through Intune or another MDM, admin role granularity beyond Super Administrators, a multi-tenant console, or a self-hosted edition — and for a three-person team the MDM gap is the one that bites.

Proton VPN for Business

Intune deployment is documented in real depth — a Win32 package with a PowerShell install command, an automatic-install dependency toggle, and always-on enforcement on Windows 10 build 19041 and higher — which is exactly the silent, self-connecting rollout my three-person team wants. A central admin console, admin roles assignable to groups on the Professional plans, 24/7 chat, phone and screen sharing from six users, and a dedicated account manager included on all tiers round out the picture. The API appears only as "API integrations" on the enterprise page rather than a documented REST reference, and I found no public information on centrally managed client updates, Terraform or a self-hosted edition; the MSP portal exists but the documented pilot covers Proton Pass, not the VPN.

Cloudflare Zero Trust

The encryption story is the best documented I have read — MASQUE and TLS 1.3 with hybrid ML-KEM from the device, post-quantum hops inside Cloudflare's network, IPsec ESP keyed over a TLS-secured control plane — alongside a 100% uptime SLA, a DPA commitment to independent external audit reports no older than thirteen months, and ISO 27001:2022, SOC 2 Type II, German C5 and the EU Cloud Code of Conduct. We found no public information on a whitepaper describing what Cloudflare itself can see, open-source components, a bug bounty, or a public status page and incident history in the captured pages.

Proton VPN for Business

All apps are open source with a public VPN repository, independently audited, ISO 27001 certified and SOC 2 Type II audited, the WireGuard protocol and AES-256 or ChaCha20 ciphers are named, every connection uses a unique key, and there is a proper disclosure programme with legal safe harbour, a bug bounty, anonymous and PGP-encrypted submissions, and a five-business-day acknowledgement. I found no public information on a published architecture showing what the control plane and gateways can see, a public status page with incident history, or documented high-availability failover. I also note the terms state their SLA section does not apply to the dedicated-IP feature of Business and Enterprise subscriptions — the very piece I would depend on.

Cloudflare Zero Trust

The contracting party is Cloudflare, Inc. of San Francisco under California law, information is primarily stored in the United States and the EEA, and support runs through US subprocessors such as Salesforce and Slack — though safeguards are stated (Data Privacy Framework, standard contractual clauses as fallback, the EU Cloud Code of Conduct) and the subprocessor list with locations is published. The Data Localization Suite can restrict storage and log destinations to a specific region including the EU, and traffic inspection can be pinned to EU data centres. No EU contracting entity or EU representative is shown on the captured pages, so the chain is workable for us but not European.

Proton VPN for Business

Proton AG in Geneva is the contracting entity under Swiss law, supervised by the non-profit Proton Foundation, with a designated EU representative in Luxembourg and a data processing agreement available; the privacy policy lists each subprocessor with its purpose, location and transfer safeguards — Chargebee, Stripe, PayPal and Zendesk in the United States, Atlassian across the EU, US and UK, support in Macedonia and Taiwan. Disclosure of user data requires a binding request from competent Swiss authorities, which I find reassuring. But I found no public information on where account data and the activity logs are actually hosted, and the gateway locations across and outside Europe are simply part of how the product works.

Cloudflare Zero Trust

The Free Plan is "$0 forever" with a 50-user limit, billing is monthly, annual or pay-as-you-go by credit card, taxes are excluded and fees are nonrefundable, and the inclusions and add-ons per tier are listed clearly. But the Contract Plan is an "Annual custom price per user" and no per-user figure for the paid tiers appears in the captured pages, so I cannot compute the annual cost for 140 people before the budget round.

Proton VPN for Business

Four business tiers are public with a price per user — VPN Essentials at €6.99/user per month, VPN Professional at €9.99/user per month, VPN and Pass Professional at €10.99/user per month, Workspace Standard at €12.99/user per month — with minimum seats, billing examples, a 22% yearly discount, a 30-day money-back guarantee, a 30-day cancellation notice, early-termination terms and reverse-charge VAT handling for business plans. The dedicated IP my supplier portal needs is priced openly at +€39.99/month per IP, and single sign-on with SCIM arrives on Professional, so I can compute my real annual cost from public pages alone. Only Enterprise is "Let's talk" and the Lumo add-on carries a free trial but no price, which keeps this just short of fully computable.