# OpenVPN CloudConnexa — Business VPN & Zero Trust Access

OpenVPN CloudConnexa by OpenVPN, Inc. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: OpenVPN, Inc. (https://openvpn.net/cloud-vpn/)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/openvpn-cloudconnexa
- Alternatives: https://whats-best.ai/software/business-vpn/openvpn-cloudconnexa/alternatives ([markdown](https://whats-best.ai/software/business-vpn/openvpn-cloudconnexa/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: OpenVPN, Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S5]

## The panel's verdict

OpenVPN CloudConnexa is a cloud-delivered VPN and zero-trust access service. Its strongest criterion is access and connectivity, where five of six judges scored 7: access groups scoping traffic to named applications and IP services, zero-trust site-to-site over OpenVPN or IPsec, connectors as software routers on VMs, a full mesh across 30+ data centers, and clients for Windows, macOS, Android, iOS and ChromeOS. Identity and policy, visibility and audit, deployment and administration and pricing transparency cluster at 6-7, resting on published per-plan log retention, a stable API with a Terraform provider, and public prices — Starter free, Essential $7/seat/mo, Premium $9.50/seat/mo. Architecture and assurance scores 5-6; SOC 2 Type 2 and ISO 27001 are stated, but we found no public information on a status page or on what the vendor's infrastructure can see. Sovereignty scores 3-4: OpenVPN, Inc. is a Delaware corporation, we found no public information on where account data, identities or logs are stored, and the published EU, UK and Swiss addenda do not place identities in Europe. No criterion splits the judges by more than a point.

**Speaks for it:**
- Access rules reach down to named applications and IP services, with access groups that govern site-to-site links as well as user access.
- Per-seat prices are public — Starter free with no credit card required, Essential $7/seat/mo, Premium $9.50/seat/mo — with per-tier limits for connectors, log retention and streaming events spelled out.
- Log retention is published per plan, audit logs from 7 to 365 days, and traffic-flow logs show which private applications were accessed by whom.
- A stable public API with Swagger documentation and a Terraform provider cover access-policy and network changes as code.
- SAML SSO runs beside local credentials so contractors can be onboarded without entering the corporate directory, and SCIM arrives with Premium.

**Held against it:**
- Sovereignty scores 3-4: the contracting entity is OpenVPN, Inc., a Delaware corporation, and we found no public information on where account data, identities or logs are stored.
- The captured pages give different figures for the Starter plan's included seats — three on the pricing page, five in the FAQ.
- We found no public information on multi-factor authentication as a named capability, on named identity-provider integrations, or on just-in-time access.
- We found no public information on a public status page, a bug bounty, or on what the vendor's points of presence can see of traffic.
- We found no public information on the price of the SCIM add-on, dedicated gateways or static IPs, or on minimum term and VAT treatment.

**Best for:**
- You need zero-trust access down to named applications and IP services for users and sites, with contractors onboarded outside your corporate directory.
- You want to budget without a sales call — per-seat prices and per-tier limits for connectors, log retention and streaming events are public.
- You run policy as code — the Terraform provider is explicitly pitched for access-policy changes and the public API is stable and Swagger-documented.
- You administer several isolated networks — multiple overlay networks from a single owner account are documented, suiting an MSP or multi-site IT team.

**Avoid if:**
- You must keep account data, identities and logs in the EU — ask the vendor: the public pages we read do not show it
- Your fleet includes Linux machines or needs clientless browser access — the captured client list covers Windows, macOS, Android, iOS and ChromeOS, and we found no public information on clientless access.
- You need priced add-ons before committing — the SCIM add-on and dedicated gateways are unpriced on the captured pages and Enterprise & IoT is quoted only on request.
- You want this specific cloud service self-hosted — the self-hosted Access Server the vendor documents is a separate product line.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 |
| Identity, access policy & device posture | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Logs, audit trail & incident response | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Deployment, API & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 |
| Architecture, reliability & security assurance | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 1.5/5 | 1.5/5 | 2/5 |
| Pricing transparency | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Certifications: SOC 2 Type 2 · GDPR · HIPAA · ISO 27001 [S5]
- Certifications: SOC 2 Type 2 · ISO/IEC 27001:2022 · HIPAA · GDPR [S11]
- Control access control: 12 · Access Control [S9]
- Control business continuity: 6 · Business Continuity and Disaster Recovery [S9]
- Control change management: 5 · Configuration and Change Management [S9]
- Control contingency planning: 6 · Contingency Planning [S9]
- Control incident response: 5 · Incident Response [S9]
- Control infosec program: 6 · Information Security Program Management [S9]
- Controls count: 74 [S9]
- Documents count: 13 [S9]
- GDPR: yes [S1]
- HIPAA: yes [S1]
- HIPAA self assessment: request · yes [S9]
- ISO 27001: yes [S1]
- ISO 27001 audit report: request · OpenVPN 27001 Audit Report 2024 [S9]
- ISO 27001 certificate: download · yes [S9]
- Privacy policy: yes [S9]
- SOC 2: yes [S1]

**Data**
- Access visibility logs: 30 · 7 [S5]
- Audit logs: 180 · 7 · 90 · 365 [S5]
- Dns logs: 30 · 7 [S5]
- Ids ips webfiltering logs: 60 · 7 · 30 · 90 [S5]
- Log streaming events: 10M · 500k · 50M [S5]
- Session logs: 60 · 7 · 30 · 90 [S5]

**Hosting**
- Pop regions: FAQ on PoP locations; example region London [S1]
- Website: https://openvpn.net [S9]

**Integrations**
- API credentials: yes [S4]
- API purpose: configure and manage WPC programmatically [S4]
- API stable: yes [S4]
- API terraform: yes · yes [S2]
- API versions: v1.2.3 · v1.2.0 · v1.0 · beta v0.16.0 [S4]
- Mcp server: yes [S4]
- Migration guide: yes [S4]
- Public API: yes [S5]
- Swagger docs: yes [S4]
- Terraform: yes [S5]
- Terraform provider: yes [S4]

**Legal**
- Affiliate agreement: yes [S7]
- Connect certified agreement: yes [S7]
- DPA download: yes [S7]
- Entity: OpenVPN, Inc. [S7]
- EU DPA scc: yes [S7]
- Eula variants: CloudConnexa · Access Server · Connect [S7]
- Mpsa download: yes [S7]
- Subcontractor baa: yes [S7]
- Swiss DPA: yes [S7]
- Terms of use pdf: yes · yes [S7]
- UK DPA: yes [S7]

**Pricing**
- Enterprise iot: Enterprise & IoT · yes [S5]
- Essential: Essential · 70 · 7 · 20 [S5]
- Free tier features: All plans include granular Zero-Trust access policies, DNS filtering, IDS/IPS, global private network, instant scaling, unified console, easy connector setup [S5]
- Premium: Premium · yes · 95 · 9.5 · 20 [S5]
- Starter: Free, no credit card required · Starter · 0 · USD [S5]
- Starter free seats: 5 · 100 [S1]
- Starter seats: 3 [S5]
- Subscription example: 11400 [S1]
- Trial: 14 [S5]

**Product**
- Access groups: 50 · 2 · 10 · 100 (increasable) [S5]
- Access groups network connections: yes [S11]
- Access logs: yes [S1]
- Access server active active cluster: yes [S11]
- Access server cloud marketplaces: AWS · Google Cloud · Oracle · Azure · DigitalOcean [S11]
- Access server self hosted: yes · self-hosted [S11]
- Access visibility: Access Visibility traffic flow logs · yes [S2]
- Actionable visibility: Actionable Visibility (Connections, Audit Log, Access Visibility, Cyber Shield) · yes [S2]
- Apphub application sharing: Application Sharing with AppHub · yes [S2]
- Application based domain routing: Application-based Domain Routing · yes [S2]
- Applications domain routing: 500 · 10 · 200 · 1000 (increasable) [S5]
- Client platforms: Windows · macOS · Android · iOS · ChromeOS [S1]
- Cloud protection ztna: Cloud Protection/ZTNA · yes [S2]
- Cloudconnexa cloud delivered: yes · cloud-delivered [S11]
- Cloudconnexa granular access control: yes [S11]
- Cloudconnexa smart routing: yes · yes [S11]
- Cloudconnexa worldwide pops: yes [S11]
- Cloudconnexa zerotrust vpn: CloudConnexa is a zero trust cloud VPN service [S1]
- Company trust: 20000 [S1]
- Connectors: 1000 · 2 · 500 · custom [S5]
- Content filtering categories: 40+ [S1]
- Cyber shield: Cyber Shield provides customizable IDS/IPS and Content Filtering for remote access [S2]
- Data centers: 30+ [S5]
- Device posture: yes [S1]
- Device posture group assignment: yes · yes [S13]
- Device posture group side assignment: yes [S13]
- Device posture policies: Device Posture Policies · yes [S2]
- Device posture policies: 10 · 1 · 5 · 100 (increasable) [S5]
- Device posture policy edit assignment: yes [S13]
- Device posture reassignment behavior: yes [S13]
- Devices per user: 5 · 1 · 3 · 5 [S5]
- Dive: Device Identity Verification Enforcement (DIVE) · yes [S2]
- Dns log: DNS Log · yes [S2]
- Dns logs: yes [S1]
- Enterprise features: Enterprise & IoT adds configurable usage thresholds, custom pricing, named contact, guided onboarding & POC [S5]
- Essential features: Essential adds LDAP and SAML, IPsec protocol support, log streaming to SIEM, public API, application sharing, 24-7 priority support [S5]
- Flexible internet routing: Flexible Internet Routing · yes [S2]
- Free trial: FAQ topic on free trial [S1]
- Full mesh: yes [S5]
- Full mesh topology: Full-Mesh Topology of worldwide PoPs · yes [S2]
- High availability: yes [S5]
- Hybrid cloud: yes [S11]
- Identity device location policies: Access policies use identity, device, and location context [S1]
- Ids ips builtin: yes [S11]
- Ids ips policies: 10 · 1 · 5 · 100 (increasable) [S5]
- Internet gateway selection: Internet Gateway Selection · yes [S2]
- Iot security: IoT Security · yes [S2]
- Ip services: 500 · 10 · 200 · 1000 (increasable) [S5]
- Ipsec support: IPSec protocol support · yes [S2]
- Limits increasable: starred limits can be increased upon request via Enterprise plan [S5]
- Location context policies: Location Context Policies · yes [S2]
- Location context policies: 10 · 1 · 5 · 100 (increasable) [S5]
- Log streaming: yes [S1]
- Micro segmentation: yes [S1]
- Multiple authentication methods: SAML SSO and local credentials side by side · yes [S2]
- Multiple isolated overlay networks: Multiple Isolated Overlay Networks from a single Owner account · yes [S2]
- Network concealment: yes [S1]
- Overlapping ips: yes [S5]
- Passkey authentication: Passkey Authentication · yes [S2]
- Password policy manager: Password Policy Manager · yes [S2]
- Point and click configuration: Web-based administration and configuration wizards · yes [S2]
- Premium features: Premium adds SCIM, multiple authentication methods, increased log retention and network limits, 10M log streaming events, dedicated account manager, 99.9% uptime SLA [S5]
- Protocols ipsec openvpn: IPsec · OpenVPN [S1]
- Quickstart time: 20 [S1]
- Restricted internet access: Restricted Internet Access · yes [S2]
- Router site to site: yes [S11]
- SCIM: Add on for Essential tier · yes [S5]
- Software router connectors: yes [S1]
- Split tunneling: FAQ topic on split tunneling support [S1]
- Threat defense: yes [S1]
- Trial free start: yes [S2]
- Trusted organizations: 20,000+ [S5]
- URL based onboarding: yes [S1]
- Ztna site to site: yes [S11]

**Subprocessors**
- Count: 10 [S9]
- Quickbooks intuit: Quickbooks (Intuit) · Accounting software · United States · European Economic Area [S9]

**Support**
- Account manager: yes [S5]
- Availability: 24/7 [S11]
- Guided implementation: yes [S5]
- Hours: 24/7 [S5]
- Priority: yes [S5]
- Security contact email: security@openvpn.com · security contact [S9]
- Twenty four seven: 24/7 [S1]

## Questions

### Is OpenVPN CloudConnexa European?

No. whats-best.ai classifies OpenVPN CloudConnexa as Rest of world.

### Where does OpenVPN CloudConnexa store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does OpenVPN CloudConnexa have a free plan?

Yes. OpenVPN CloudConnexa has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19192).

### What are the best alternatives to OpenVPN CloudConnexa?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [OpenVPN CloudConnexa alternatives](https://whats-best.ai/software/business-vpn/openvpn-cloudconnexa/alternatives).

## What this page leaves out

- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (product page): https://openvpn.net/cloud-vpn/ (checked 2026-11-05)
- [S2] Features page: https://openvpn.net/cloud-vpn/features/ (checked 2026-11-05)
- [S3] Features page (zero trust network access): https://openvpn.net/use-cases/zero-trust-network-access/ (checked 2026-11-05)
- [S4] API documentation: https://openvpn.net/cloud-docs/developer/ (checked 2026-11-05)
- [S5] Pricing page: https://openvpn.net/cloud-vpn/pricing/ (checked 2026-11-05)
- [S6] About page: https://openvpn.net/about/ (checked 2026-11-05)
- [S7] Terms and legal documents: https://openvpn.net/legal/ (checked 2026-11-05)
- [S8] Privacy policy: https://openvpn.net/privacy-policy/ (checked 2026-11-05)
- [S9] Security / trust page: https://trustcenter.openvpn.com/ (checked 2026-11-05)
- [S10] Access model & connectivity — found from sitemap: https://openvpn.net/cloud-vpn/features/full-mesh-topology/ (checked 2026-11-05)
- [S11] Access model & connectivity — found from sitemap: https://openvpn.net/use-cases/site-to-site-vpn/ (checked 2026-11-05)
- [S12] Identity, access policy & device posture — found from sitemap: https://openvpn.net/cloud-docs/owner/users/users---device-posture/about-device-posture/ (checked 2026-11-05)
- [S13] Identity, access policy & device posture — found from sitemap: https://openvpn.net/cloud-docs/owner/users/users---device-posture/assign-a-device-posture-policy-to-a-user-group/ (checked 2026-11-05)
- [S14] Logs, audit trail & incident response — found from sitemap: https://openvpn.net/cloud-vpn/features/logs-audit-streaming/ (checked 2026-11-05)
- [S15] Logs, audit trail & incident response — found from sitemap: https://openvpn.net/cloud-docs/owner/api---logs/api---logs---log-streaming/about-log-streaming/ (checked 2026-11-05)
- [S16] Deployment, API & administration — found from sitemap: https://openvpn.net/cloud-docs/developer/cloudconnexa-terraform-provider/ (checked 2026-11-05)
- [S17] Deployment, API & administration — found from sitemap: https://openvpn.net/connect-docs/videos/video--deploy-openvpn-connect-via-microsoft-intune/ (checked 2026-11-05)
- [S18] Architecture, reliability & security assurance — found from sitemap: https://openvpn.net/vulnerability-disclosure-policy/ (checked 2026-11-05)
- [S19] Architecture, reliability & security assurance — found from sitemap: https://openvpn.net/security-advisories/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "OpenVPN CloudConnexa — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/openvpn-cloudconnexa

Corrections: https://whats-best.ai/correct/1601?target=page