Business VPN & Zero Trust Access
OpenVPN CloudConnexa
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by OpenVPN, Inc. · openvpn.net
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
OpenVPN CloudConnexa at a glance
- Vendor
- OpenVPN, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates OpenVPN CloudConnexa 3/5, the mean of 6 judges. OpenVPN CloudConnexa is a cloud-delivered VPN and zero-trust access service. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
OpenVPN CloudConnexa is a cloud-delivered VPN and zero-trust access service. Its strongest criterion is access and connectivity, where five of six judges scored 7: access groups scoping traffic to named applications and IP services, zero-trust site-to-site over OpenVPN or IPsec, connectors as software routers on VMs, a full mesh across 30+ data centers, and clients for Windows, macOS, Android, iOS and ChromeOS. Identity and policy, visibility and audit, deployment and administration and pricing transparency cluster at 6-7, resting on published per-plan log retention, a stable API with a Terraform provider, and public prices — Starter free, Essential $7/seat/mo, Premium $9.50/seat/mo. Architecture and assurance scores 5-6; SOC 2 Type 2 and ISO 27001 are stated, but we found no public information on a status page or on what the vendor's infrastructure can see. Sovereignty scores 3-4: OpenVPN, Inc. is a Delaware corporation, we found no public information on where account data, identities or logs are stored, and the published EU, UK and Swiss addenda do not place identities in Europe. No criterion splits the judges by more than a point.
Speaks for it
- Access rules reach down to named applications and IP services, with access groups that govern site-to-site links as well as user access.
- Per-seat prices are public — Starter free with no credit card required, Essential $7/seat/mo, Premium $9.50/seat/mo — with per-tier limits for connectors, log retention and streaming events spelled out.
- Log retention is published per plan, audit logs from 7 to 365 days, and traffic-flow logs show which private applications were accessed by whom.
- A stable public API with Swagger documentation and a Terraform provider cover access-policy and network changes as code.
- SAML SSO runs beside local credentials so contractors can be onboarded without entering the corporate directory, and SCIM arrives with Premium.
Held against it
- Sovereignty scores 3-4: the contracting entity is OpenVPN, Inc., a Delaware corporation, and we found no public information on where account data, identities or logs are stored.
- The captured pages give different figures for the Starter plan's included seats — three on the pricing page, five in the FAQ.
- We found no public information on multi-factor authentication as a named capability, on named identity-provider integrations, or on just-in-time access.
- We found no public information on a public status page, a bug bounty, or on what the vendor's points of presence can see of traffic.
- We found no public information on the price of the SCIM add-on, dedicated gateways or static IPs, or on minimum term and VAT treatment.
Best for
- You need zero-trust access down to named applications and IP services for users and sites, with contractors onboarded outside your corporate directory.
- You want to budget without a sales call — per-seat prices and per-tier limits for connectors, log retention and streaming events are public.
- You run policy as code — the Terraform provider is explicitly pitched for access-policy changes and the public API is stable and Swagger-documented.
- You administer several isolated networks — multiple overlay networks from a single owner account are documented, suiting an MSP or multi-site IT team.
Avoid if
- You must keep account data, identities and logs in the EU — ask the vendor: the public pages we read do not show it
- Your fleet includes Linux machines or needs clientless browser access — the captured client list covers Windows, macOS, Android, iOS and ChromeOS, and we found no public information on clientless access.
- You need priced add-ons before committing — the SCIM add-on and dedicated gateways are unpriced on the captured pages and Enterprise & IoT is quoted only on request.
- You want this specific cloud service self-hosted — the self-hosted Access Server the vendor documents is a separate product line.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 3 of 5 |
| Logs, audit trail & incident response | 3 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 3 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
For my two plants and the Vienna sales office this covers a lot: granular access per application and IP service, zero-trust site-to-site links with per-network access groups, IPsec and OpenVPN protocols, connectors deployable as VMs, and a full mesh across 30+ data centers with a London point of presence named. The client list covers Windows, macOS, Android, iOS and ChromeOS — we found no public information on a Linux client, on always-on auto-connect, or on a dedicated static IP for our supplier portal. 1 2 5 11
The DevOps Engineer
The full-mesh PoP overlay reaches sites, cloud networks and users with per-application and per-IP-service rules, zero-trust site-to-site, hybrid cloud links and self-run connectors, over documented IPsec and OpenVPN protocols across 30+ data centres. The captured client list names Windows, macOS, Android, iOS and ChromeOS without Linux, and we found no public information on connectors running as containers, deployment without inbound firewall rules, always-on or auto-connect behaviour, or a full named list of gateway regions. 1 2 5 11
The MSP Technician
Site-to-site links with zero-trust policies, connectors deployed as VM-based software routers, and per-application access with domain-based routing and port-level IP services cover how my thirty clients would use it, over IPsec or OpenVPN protocols on a worldwide full-mesh point-of-presence network spanning 30+ data centers. Connect clients are listed for Windows, macOS, Android, iOS and ChromeOS; we found no public information on a Linux client, always-on or auto-connect modes, clientless browser access, or named gateway regions beyond a London example. 1 2 5 11
The Operations Manager
For my freelancer problem this is close to the target: onboarding with just a URL, access rules granular down to named applications and IP services, split tunnelling, and clients for Windows, macOS, Android, iOS and ChromeOS reaching a worldwide mesh of 30+ data centres. Site-to-site via OpenVPN-compatible routers and software connectors covers our own office side. I found no public information on a Linux client, clientless browser access, always-on behaviour or dedicated static IPs. 1 2 5 11
The Information Security Officer
Access is granted per resource rather than per network — granular policies for named network resources, domain-based application routing and micro-segmentation, and zero-trust rules that govern site-to-site links as well as user access. Clients are documented for Windows, macOS, Android, iOS and ChromeOS, connectors run as software routers on VMs, protocols are OpenVPN and IPsec, and the footprint is 30-plus data centres worldwide with London named as a PoP example. We found no public information on always-on auto-connect, clientless browser access for contractors without a managed device, or per-gateway performance figures. 1 2 5 11
The Skeptic
Per-resource access is genuinely documented, not just a flat VPN: Access Groups that scope even site-to-site traffic to named applications and IP services, micro-segmentation, Connectors run as software routers on VMs, and site-to-site over OpenVPN or IPsec across a full mesh of PoPs in 30+ data centers. Clients are listed for Windows, macOS, Android, iOS and ChromeOS, and contractors can be onboarded with local credentials outside the corporate directory. We found no public information on peer-to-peer connections with relay fallback, always-on or auto-connect, clientless browser access, or gateway throughput. 1 2 5 11
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
SAML single sign-on with SCIM provisioning is what I need so a leaver is cut off the same day — SCIM sits in Premium (an add-on for Essential), and the identity providers themselves are never named, so Entra ID is implied rather than confirmed. Policies combine identity, device and location context with granular per-resource rules and device posture checks, but the posture parameters and any EDR or MDM sources are not described. We found no public information on just-in-time access or session re-authentication. 1 2 5 13
The DevOps Engineer
SAML and LDAP single sign-on ship on Essential, SCIM arrives on Premium or as an add-on, access groups plus location-context and device-posture policies gate named applications and IP services, passkeys are supported, and the Terraform provider is explicitly pitched for access-policy changes — exactly the configuration-as-code workflow I want. We found no public information on named identity providers, multi-factor enforcement, just-in-time access with approval, or session re-authentication. 1 2 5 13
The MSP Technician
Policies combine identity, device and location context, SAML and LDAP land on the Essential plan while SCIM waits for Premium, and device posture with continuous evaluation, device identity verification and passkeys are documented down to how posture policies bind to user groups. We found no public information on multi-factor authentication as a named capability, integrations with specific identity providers, or posture checks fed from EDR or MDM tools. 1 2 5 13
The Operations Manager
Access Groups limit who reaches which application or IP service, and SAML SSO runs beside local credentials so freelancers never enter our directory — exactly the setup I run. SCIM for automatic deprovisioning when a contract ends sits in higher tiers or as an add-on, and device posture with multiple parameters is tied to user groups. I found no public information naming identity providers, just-in-time access, or posture checks fed by EDR or MDM tools. 1 2 5 11 13
The Information Security Officer
Policies use identity, device and location context, device posture is evaluated continuously with documented policy-to-group assignment rules, and Device Identity Verification Enforcement restricts connections to authorized devices — the resource-level, device-checked model my auditor asks about. SAML SSO runs beside local credentials, SCIM deprovisioning comes with Premium (an add-on on Essential), and passkeys plus a password policy manager are listed. We found no public information naming identity providers, multi-factor authentication requirements, posture fed from EDR or MDM tools, or just-in-time approval with expiry. 1 2 5 13
The Skeptic
SAML SSO runs beside local credentials, SCIM arrives with Premium as an add-on on Essential, policies take identity, device and location context, device posture is enforced per user group with tiered policy counts, and access-policy changes are automatable through Terraform. We found no public information on named identity-provider integrations, multi-factor authentication as such, just-in-time or time-limited access, session lifetimes, or revocation when a device is lost. 1 2 5 13
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Retention is published per plan to the day — audit logs 7 to 365 days, session and IDS/IPS logs up to 90, DNS logs up to 30 — and log streaming to a SIEM carries daily event budgets of 500k to 50M depending on tier. Traffic-flow logs show which private applications were accessed by whom, plus blocked flows and DNS query statistics, which is what I need after an incident. We found no public information on security alerts or webhooks, or on a statement of what traffic content is not logged. 1 2 5
The DevOps Engineer
Retention is published per log type and per plan — audit logs run to 365 days on Enterprise — alongside session logs, DNS logs, IDS/IPS logs, traffic-flow access visibility showing which applications were reached by whom, and tiered daily quotas for streaming to a SIEM. We found no public information on named SIEM destinations, alerting or webhooks, a documented log schema, or a statement of what traffic data is not logged. 1 2 5 14
The MSP Technician
Retention is published per plan — audit logs from 7 days on the free tier to 365 days on Enterprise, session logs to 90 days, and SIEM log streaming with daily caps of 500k to 50M events — and traffic flow logs show which private applications were accessed by whom, which is what I hand a client after an incident. We found no public information on alerts or webhooks, a documented log schema, a live session view with disconnect, or a statement of what traffic data is not logged. 2 5
The Operations Manager
The retention ladder is published per plan — audit logs from 7 to 365 days, with session, DNS and access-visibility logs tiered likewise — and traffic flow logs show which private application was reached by whom, which is what I need to answer a client's audit question. Log streaming to SIEM is included from the paid tiers with daily event caps. I found no public information naming the SIEM tools, security alerts or webhooks, or what traffic content is not logged. 1 2 5
The Information Security Officer
Audit logs are retained up to 365 days on Enterprise, traffic-flow logs show which private applications were accessed by whom, DNS and session logs are retained per plan, and log streaming to a SIEM is included from Essential upward with daily event caps per plan. Who reached what, and every admin change, can therefore reach my SIEM. We found no public information naming the SIEM destinations, alerting or webhooks on security events, the log schema, or the ability to view and terminate active sessions. 1 2 5
The Skeptic
Every log family is tiered and public — audit logs from 7 to 365 days by plan, session logs to 90, DNS and access-visibility logs to 30, with log streaming to SIEM capped at 500k to 50M events per day — and traffic-flow visibility names which private applications were reached by whom. We found no public information on alerts or webhooks, ending an active session from the console, a documented log schema, or any statement of what traffic data is not logged. 1 2 5
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
A stable, versioned REST API with Swagger documentation, a Terraform provider, web-based admin wizards and multiple isolated networks under one owner account — a platform my three-person team can actually run, with first connection promised in under 20 minutes. The documentation includes a video on deploying the client through Microsoft Intune, which is exactly how we would roll it out. We found no public information on granular admin roles, a service-provider multi-tenant console, or how client updates are managed. 1 2 4 5 17
The DevOps Engineer
A stable public API with Swagger documentation, a Terraform provider for managing resources as code, Intune-based client deployment, web consoles with configuration wizards, multiple isolated overlay networks under one owner account, and 24/7 tiered support cover most of what a small platform team needs. We found no public information on granular admin roles, a service-provider multi-tenant console, or a self-hosted edition of CloudConnexa itself. 2 4 5 17
The MSP Technician
A stable, documented REST API with Swagger docs and a Terraform provider, plus multiple isolated overlay networks under a single owner account, mean one login running a separate network per client, with a web console, setup wizards and a stated start in under 20 minutes. A captured guide covers rolling the Connect client out through Microsoft Intune; we found no public information on granular admin roles or per-tenant billing for service providers, and the self-hosted Access Server the vendor documents is a separate product from this cloud service. 1 2 4 5 17
The Operations Manager
A web console with configuration wizards, a start in under 20 minutes, URL onboarding and an Intune deployment walkthrough mean my hourly-billed external provider can hand this over without a project, and a stable documented API, a Terraform provider and several isolated networks under one owner account cover growth. Support is stated as 24/7 with priority tiers per plan. I found no public information on administrator roles, a multi-tenant console for service providers, or centrally managed client updates. 1 2 4 5 17
The Information Security Officer
A web administration console with configuration wizards, a stable documented public API with Swagger and versioned releases, a Terraform provider for policy and network changes, multiple isolated overlay networks under one owner account, and 24/7 support stated per plan cover how a small team would run this, with first connection advertised in under 20 minutes. We found no public information on administrator roles, MDM deployment of clients with preconfigured settings, or a service-provider multi-tenant console, and the self-hosted Access Server is a separate product line. 1 2 4 5
The Skeptic
A stable public REST API with Swagger documentation, a Terraform provider, an Intune deployment guide for the client, web administration wizards, multiple isolated overlay networks from one Owner account, and 24/7 support are all evidenced. We found no public information on administrator roles, a service-provider or multi-tenant console, centrally managed client updates, or webhooks; the vendor's self-hosted Access Server is a separate product rather than a self-hosted edition of this one. 2 4 5 17
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
SOC 2 Type 2 and ISO/IEC 27001:2022 are stated with the ISO certificate downloadable and the 2024 audit report available on request, alongside a trust centre listing 74 controls, a security contact, a vulnerability disclosure policy page, and a 99.9% uptime SLA on Premium. The full-mesh point-of-presence topology is described, but we found no public information on a published architecture whitepaper, on what the vendor can see, on a bug bounty, or on a public status page with incident history. 2 5 9 11 18
The DevOps Engineer
The trust centre publishes an ISO 27001:2022 certificate for download with the 2024 audit report available on request, SOC 2 Type 2, 74 mapped controls, a security contact, a vulnerability disclosure policy, a security advisories page, and a 99.9% uptime SLA on Premium, with the protocols named. We found no public information on a published architecture stating what the points of presence can see, failover behaviour for existing connections, open-source components, a bug bounty, or the vendor's status page and incident history. 5 9 18 19
The MSP Technician
SOC 2 Type 2 and ISO/IEC 27001:2022 are stated with a downloadable ISO certificate, a dated 2024 audit report available on request, and a trust centre listing 74 controls, and a 99.9% uptime SLA applies from Premium up. The full-mesh point-of-presence core and high availability are described in outline; we found no public information on the vendor's own status page and incident history, on key handling, on what the vendor can see of traffic, or on a bug bounty — the disclosure contact is security@openvpn.com. 2 5 9
The Operations Manager
SOC 2 Type 2 and ISO/IEC 27001:2022 with a downloadable certificate, a security contact, a vulnerability disclosure policy and published security advisories are things I can hand to a client's procurement team, and the Premium plan carries a 99.9% up-time SLA. The published architecture is essentially the PoP mesh with direct and indirect routes. I found no public information on a security whitepaper describing what the vendor can see, a bug bounty, a public status page, or what happens to live connections if the control plane goes down. 1 2 5 9 18 19
The Information Security Officer
SOC 2 Type 2 and ISO/IEC 27001:2022 are claimed with the ISO certificate downloadable and a 2024 audit report available on request, a 99.9% uptime SLA applies to Premium, high availability is listed, a security contact is published, and the architecture is a full mesh of worldwide PoPs carrying OpenVPN or IPsec traffic. An independent audit with a published certificate is what I can put in front of my auditor. We found no public information on a whitepaper describing what the vendor's infrastructure can see, a bug bounty, the vendor's status page and incident history, or the behaviour of existing connections during a control-plane outage. 1 2 5 9
The Skeptic
The ISO 27001 certificate is downloadable, SOC 2 Type 2 is stated, a trust page lists 74 controls and 13 documents, a 99.9% uptime SLA applies from the Premium plan, and a security contact plus published vulnerability-disclosure and security-advisories pages exist. The 27001 audit report itself is available only on request, and we found no public information on what the coordination servers can see, key management, control-plane failover, or whether existing connections survive a vendor outage. 1 5 9 18 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
From Austria this is the weak spot: the vendor is OpenVPN, Inc., a US corporation, and we found no public information on where account data, identities, or connection logs are stored or processed. What is published is a downloadable data processing agreement with an EU addendum on Standard Contractual Clauses, plus a list of ten subprocessors with their regions — the one example shown, QuickBooks, processes in the United States and the European Economic Area. 1 7 9
The DevOps Engineer
The contracting entity is OpenVPN, Inc., a US company, and we found no public information on where account data, identities, connection logs and configuration are stored or processed. On the plus side, ten subprocessors are listed with their regions, a general data processing agreement plus EU, UK and Swiss addenda with standard contractual clauses is downloadable, and ISO 27001 and SOC 2 are stated. 7 9
The MSP Technician
The contracting entity is OpenVPN, Inc., a Delaware corporation per the captured terms, and the legal pages publish a general data processing agreement plus EU, UK and Swiss addenda with standard contractual clauses, while the trust centre lists ten subprocessors with their regions. We found no public information on where account data, identities or logs are stored, on an EU hosting option, or on who operates the points of presence; a London point of presence is the only European footprint indicated. 1 7 9
The Operations Manager
The contracting entity is OpenVPN, Inc., a US corporation, and we found no public information on where the control plane, logs or account data are hosted. A downloadable data processing agreement with EU standard contractual clauses and a trust-centre list of ten subprocessors with their regions is real, but no EU hosting option or EU entity appears on the captured pages. 7 9
The Information Security Officer
The contracting entity is OpenVPN, Inc., a US corporation, and we found no public information on where account data, user and device identities, connection logs and configuration are stored or processed; the trust centre lists ten subprocessors, the one captured being QuickBooks by Intuit for accounting across the United States and the European Economic Area. Downloadable general, EU (with Standard Contractual Clauses), UK and Swiss data processing agreements exist, but these pages do not let me place identities and logs in Europe. 7 9
The Skeptic
OpenVPN, Inc. is a Delaware corporation and we found no public information on where the control plane, account data, identities or logs are stored and processed — the London PoP is a network location, not a data-residency statement. A general data processing agreement plus EU, UK and Swiss addenda with Standard Contractual Clauses are published and ten subprocessors are listed with regions shown for at least one, which sits above a bare privacy policy but shows no EU hosting, EU entity or EU representative. 1 7 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Per-seat prices are public — Starter free, Essential at $7/seat/mo, Premium at $9.50/seat/mo, with an annual discount of up to 20% — and the plan comparison shows feature by feature what each tier includes, so SSO at Essential, SCIM at Premium, and log retention and streaming budgets per plan are all visible before I talk to anyone. Enterprise and IoT is custom-quoted, the SCIM add-on for Essential carries no public price, and we found no public information on minimum term or VAT treatment. The captured pages also give different figures for the Starter plan's free seats. 1 5
The DevOps Engineer
Per-seat prices are public for every named tier — Starter free, Essential at $7/seat/mo, Premium at $9.50/seat/mo with an annual discount of up to 20% and worked example totals — and the tier tables spell out connectors, access groups, devices per user, log retention and streaming quotas per plan, so feature gating is unusually computable. Enterprise is custom-quoted, add-ons such as the Essential SCIM pack are unpriced, we found no public information on minimum seats, minimum term or VAT treatment, and the captured pages give different figures for the Starter plan's included free seats (three versus five). 1 5
The MSP Technician
Starter is free and the paid tiers are public at $7/seat/mo for Essential and $9.50/seat/mo for Premium with annual savings of up to 20%, and the per-tier limits — connectors, access groups, applications, IP services, devices per user, log retention — are unusually explicit, so I can quote a client without a sales call. The captured pages give different figures for the free tier's seats, three on the pricing page and five in a support FAQ, Enterprise & IoT is custom pricing through sales, the SCIM add-on is unpriced, and we found no public information on dedicated gateway or static IP prices, minimum term, or VAT treatment. 1 5
The Operations Manager
Prices are public and exact — Essential at $7/seat/mo and Premium at $9.50/seat/mo with an annual discount of up to 20%, a free Starter and a 14-day trial — and the plan tables publish connectors, devices per user, policies and log retention per tier, so I can budget without a sales call. The captured pages give different figures for the free plan's seats, three on the pricing page and five in an FAQ, and dedicated gateways or static IPs, VAT treatment and minimum term are not priced anywhere I read. 1 5
The Information Security Officer
Starter is free, Essential is $7/seat/mo and Premium $9.50/seat/mo with a stated annual discount of up to 20%, and the plan matrix is unusually explicit about per-tier inclusions such as log retention days, connector counts, devices per user and daily streaming events. Enterprise & IoT is custom-priced on request, and the price of the SCIM add-on, dedicated gateways or static IPs, minimum term and VAT treatment are not shown; the captured pages also give different figures for the Starter plan's free seats. 1 5
The Skeptic
The tiers are public with per-seat prices and unusually granular per-plan limits — $7/seat/mo Essential, $9.50/seat/mo Premium, Starter Free, annual discount "save up to 20%", Enterprise custom — covering connectors, access groups, IP services, devices per user, retention days and streaming events. The captured pages give different figures for the Starter plan's included seats (three on the pricing page, five in the FAQ), and we found no public information on VAT treatment, minimum term, or the price of add-ons such as SCIM beyond contacting sales. 1 5
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about OpenVPN CloudConnexa
Is OpenVPN CloudConnexa European?
No. whats-best.ai classifies OpenVPN CloudConnexa as Rest of world.
Where does OpenVPN CloudConnexa store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does OpenVPN CloudConnexa have a free plan?
Yes. OpenVPN CloudConnexa has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to OpenVPN CloudConnexa?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: OpenVPN CloudConnexa alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (product page) openvpn.net Checked 5 Nov 2026 Details →
- 2 Features page openvpn.net Checked 5 Nov 2026 Details →
- 3 Features page (zero trust network access) openvpn.net Checked 5 Nov 2026 Details →
- 4 API documentation openvpn.net Checked 5 Nov 2026 Details →
- 5 Pricing page openvpn.net Checked 5 Nov 2026 Details →
- 6 About page openvpn.net Checked 5 Nov 2026 Details →
- 7 Terms and legal documents openvpn.net Checked 5 Nov 2026 Details →
- 8 Privacy policy openvpn.net Checked 5 Nov 2026 Details →
- 9 Security / trust page trustcenter.openvpn.com Checked 5 Nov 2026 Details →
- 10 Access model & connectivity — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 11 Access model & connectivity — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 12 Identity, access policy & device posture — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 13 Identity, access policy & device posture — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 14 Logs, audit trail & incident response — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 15 Logs, audit trail & incident response — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 16 Deployment, API & administration — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 17 Deployment, API & administration — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 18 Architecture, reliability & security assurance — found from sitemap openvpn.net Checked 5 Nov 2026 Details →
- 19 Architecture, reliability & security assurance — found from sitemap openvpn.net Checked 5 Nov 2026 Details →